World

Researchers have disclosed and remotely mitigated a serious flaw in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, that put millions of computers at risk of remote code execution. The vulnerable component was the app's updater, which could have been abused by attackers to run malicious code with elevated privileges on affected systems.

Because the project is no longer maintained and the updater remained active, the research team took the unusual step of remotely disabling it themselves, effectively closing the attack vector for the entire install base rather than waiting on a patch that would never come. This is a notable case of abandoned software continuing to carry risk long after development stops, since update mechanisms often run with high privileges and can serve as a foothold if they fall into the wrong hands.

• The affected application is the discontinued Time4Popcorn client.
• The vulnerable component is its auto-updater, which could enable code execution with elevated privileges.
• Researchers remotely disabled the updater to neutralize the flaw for existing users.

If you or anyone you know still has this client installed, uninstalling it entirely is the safest path, as no official fixes will be coming.

Source: Unknown

Have you come across abandoned applications still running privileged updaters in your environment, and how are you handling them?

Microsoft is expanding its phishing defenses into Teams, with AI-powered, context-aware detection for messages rolling out starting in early November 2026. The goal is to catch phishing attempts that rely on conversational context rather than the static indicators that traditional email filters typically flag.

The detection is designed to analyze the surrounding conversation and intent behind a message, rather than judging a single message in isolation. This matters for Teams because attackers increasingly use chat-based lures — such as fake IT requests or credential-harvesting links — that may not look suspicious on their own but stand out in the context of an ongoing thread.

Key details as announced:

• Feature: AI-powered, context-aware phishing detection for Teams messages
• Rollout window: early November 2026
• Focus: identifying phishing that leverages conversational context, not just message content

For defenders, this is a reminder that collaboration platforms are now a first-class phishing surface and should be covered by awareness training and reporting workflows alongside email.

Source: Unknown

Does your organization currently include Teams messages in its phishing reporting and response procedures, or is email still the only channel covered?

Quest Diagnostics, a major American clinical laboratory company, has confirmed a data breach affecting patient records. The company disclosed that a threat actor gained unauthorized access to its Quanum LSM system, which led to the exposure of patient information.

Details on the exact scope of the exposed data, the number of affected individuals, and how the intrusion occurred have not been fully detailed in the disclosure. Quest Diagnostics has confirmed the incident and is reportedly notifying impacted parties as the investigation continues.

• Threat actor obtained unauthorized access to the Quanum LSM system
• Patient records were exposed as a result
• The exact number of affected patients has not been disclosed in the report

Organizations that rely on third-party laboratory and clinical service providers should review their own exposure and monitor for notifications from Quest Diagnostics regarding affected records.

Source: Unknown

Has your organization received any notification related to this breach, or are you reviewing third-party laboratory providers for similar exposure?

The PHP security team has published mitigation guidance for a new remote code execution vulnerability that currently has no patch available. Exploitation is only possible on systems running non-default configurations, which limits the exposure surface but does not eliminate the risk for affected deployments.

Key points from the advisory:

• The flaw allows remote code execution under specific, non-default configuration setups
• No official patch has been released at this time
• The PHP team has provided mitigation measures to reduce exposure until a fix is available

Administrators running PHP in production should review their configurations against the reported conditions and apply the recommended mitigations as soon as possible. Since a patch is not yet available, configuration-level defenses are the primary recourse for vulnerable environments.

Source: Unknown

Does your organization run PHP with any non-default configurations that could fall within the scope of this advisory?

AI agents granted access to email, browsers, and plugins can be manipulated through malicious content into executing commands, stealing data, or deleting files — all using permissions the agent already holds. Gen Digital describes this risk in the context of its Agent Trust Hub, which is designed to protect agents through skill verification, secure connectivity, and runtime controls that intercept dangerous actions.

The core concern is straightforward: once an agent has legitimate access, the attack surface shifts from breaking in to influencing what the agent does with that access. Malicious emails, websites, and plugins are the delivery mechanisms, and the agent's own permissions do the rest.

Gen Digital's approach centers on three layers:

• Skill verification, to check what an agent is capable of doing
• Secure connectivity, to control how it reaches external services
• Runtime controls, to intercept dangerous actions as they happen

Source: BleepingComputer

Does your organization have any runtime controls in place for AI agents that hold elevated permissions?

The PHP project has disclosed another remote code execution risk just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, only affects web applications that are configured in an unusual way, and the PHP team assesses it as an unlikely risk.

Because of that limited exposure, PHP is not shipping an emergency fix for CVE-2026-115560. Instead, the project recommends disabling a specific feature as the primary mitigation step. Administrators running PHP in non-standard configurations should review their setups and turn off that feature where it is not required.

Key points:

• A new RCE vector, CVE-2026-115560, follows the emergency PHP2Shell patches by two days.
• Exploitation depends on an unusual web application configuration, so PHP rates the risk as unlikely.
• No emergency patch is planned; the recommended action is to disable the affected feature.

Given that this arrives so soon after the PHP2Shell fixes, teams should confirm which PHP configurations they actually run and apply the recommended setting change rather than waiting for a patch.

Source: The Hacker News

Does your organization rely on the feature PHP is recommending to disable, and if so, how are you handling the trade-off?

Pillow, the widely used image processing library for Python, has a serious security issue that could allow attackers to execute operating system commands on a server. The vulnerability is tracked as CVE-2026-112900 and stems from how Pillow handles EPS image files.

When opening an EPS image, Pillow passes the file name to Ghostscript, a separate program it invokes to convert the image into pixels. The problem is that Pillow does this without validating or checking the file name first, which opens the door to command injection. An attacker who can supply a crafted image could abuse this behavior to run arbitrary OS commands on the affected server.

Key points:

• Affected component: Pillow EPS image handling
• Root cause: file names passed to Ghostscript without validation
• Impact: potential operating system command execution
• Attack vector: a crafted image supplied to the application

If your applications accept user-uploaded images and use Pillow to process them, this is worth prioritizing. Review any code paths that open EPS files, and consider restricting EPS processing or isolating image conversion from the host environment until a fix is available.

Source: The Hacker News

Does your organization process user-supplied images with Pillow, and if so, how are you planning to mitigate this?

Threat actors have been attempting to exploit the newly disclosed PHP2Shell vulnerabilities in an effort to recruit infected systems into a Mirai botnet variant known as Potassium. According to reporting, these attempts have so far been unsuccessful, and it appears that weaponizing the flaws may be more difficult than initially assumed.

The attacks target CVE-2026-109618 and CVE-2026-109619, both of which carry a CVSS score of 9.2. These vulnerabilities can result in unauthenticated remote exploitation, which explains the high volume of exploit attempts observed against exposed systems.

Key points for defenders:

• The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS scale.
• Exploitation attempts are widespread, but current efforts to deploy the Potassium Mirai variant have not succeeded.
• The difficulty of reliably weaponizing the flaws may be limiting attackers' success for now.
• Despite failed attempts, the high severity rating and automated scanning activity mean exposed systems should still be treated as at risk.

Organizations running affected PHP deployments should prioritize patching and monitor for exploit attempts targeting these vulnerabilities, as botnet operators continue to probe for weaknesses at scale.

Source: [email protected] (The Hacker News)

Has your organization seen scanning or exploitation attempts targeting these PHP2Shell flaws, and how are you handling mitigation?

This week has been a busy one for security teams, with a cluster of critical vulnerabilities and supply chain incidents demanding attention. Among the most significant are serious remote code execution flaws in PHP and GitLab, alongside notable Linux security bugs and a Node.js RCE issue.

Certificate trust also took a hit, with eMudhra certificates reported as compromised. On the software supply chain side, a LiteLLM release was found to have been hacked, and hundreds of Tor relays were hijacked. Separately, an authentication bypass affecting Laravel applications has been flagged, and a flaw in Signal related to call handling was also disclosed.

The reporting also touches on leaked AI secrets and source code theft involving PingCAP, underscoring that credential and data exposure incidents are continuing alongside traditional vulnerability disclosures. The source notes that these items are only part of a larger roundup, with many more stories covered beyond the headline issues.

• Review exposure to the PHP and GitLab RCE flaws and patch where applicable
• Audit reliance on eMudhra certificates
• Verify the integrity of any LiteLLM deployments
• Check Laravel authentication configurations and Node.js dependencies
• Treat leaked secrets as compromised and rotate them promptly

Source: [email protected] (The Hacker News)

Has your organization already started patching the PHP or GitLab flaws, or are you still assessing exposure?

Arista has disclosed a critical zero-day vulnerability in VeloCloud Orchestrator (VCO), the central management system used to administer VeloCloud SD-WAN networks. According to the company's advisory published on October 22, the SQL injection flaw is already being exploited in real-world attacks.

The most concerning aspect of this vulnerability is how little access an attacker needs to abuse it. Anyone who can authenticate to the orchestrator — including a user holding only a read-only customer account — can exploit the flaw to escalate their privileges to operator level, which is the highest tier of control over the system.

Key points to be aware of:

• The vulnerability is a SQL injection issue in VeloCloud Orchestrator (VCO).
• Exploitation requires only a valid login; a low-privileged read-only account is sufficient.
• Successful exploitation grants operator privileges, the top level of control over the orchestrator.
• The flaw is a zero-day and has been observed exploited in active attacks.
• Arista published its advisory on October 22.

If your organization runs VeloCloud SD-WAN, review the advisory directly and apply any guidance or fixes Arista has issued. Given that a read-only account is enough to weaponize this flaw, auditing orchestrator accounts and their access levels should be a priority while remediation is underway.

Source: [email protected] (The Hacker News)

Does your organization run VeloCloud Orchestrator, and if so, how are you approaching mitigation?

There is likely an AI agent running on a laptop somewhere in your network right now. It stores API keys and database passwords, can reach internal systems, and operates without anyone watching it.

Nobody reviewed its access. Nobody owns it.

If a human employee had that much reach with that little oversight, most organizations would classify it as an insider risk. Yet many teams still treat the agent as just another productivity tool. That gap between the access an agent holds and the accountability behind it is the focus of an expert webinar from The Hacker News, which examines how these unmanaged agents become an organization's newest insider threat.

Key points to consider about the risk:

• AI agents can hold credentials such as API keys and database passwords
• They may have access to internal systems with little or no oversight
• Often no one has formally reviewed their permissions
• In many cases, no single person or team is accountable for them

If you want the full expert breakdown, the webinar is available through the source link below.

Source: The Hacker News

Does your organization know which AI agents are running on employee machines and what credentials they hold?

The LiteLLM project suffered a supply chain compromise after attackers gained access to its release pipeline and pushed malicious artifacts to both PyPI and Docker Hub. The poisoned releases carried an info-stealer designed to harvest credentials, secrets, and environment variables from affected systems.

The malicious PyPI package and Docker images were published through the project's own release process, meaning anyone who pulled the affected versions during the exposure window may have run the payload. The stolen data set includes credentials, secrets, and environment variables — exactly the material that grants further access to cloud accounts, CI/CD systems, and downstream services.

If you use LiteLLM, treat any install or container pull from the affected period as potentially compromised:

• Audit dependency versions and image digests pulled recently against the project's official advisories
• Rotate credentials, API keys, secrets, and environment variables exposed to affected environments
• Review CI/CD and cloud logs for anomalous activity from hosts running the package or images
• Pin to verified versions and digests once the maintainers confirm clean releases

The project has not yet published a full timeline of the compromised release window, so teams should monitor its official channels for updates before reinstalling.

Source: Unknown

Has your organization pulled any LiteLLM packages or images recently, and have you rotated the secrets they could reach?

Railway has issued an urgent warning to users after detecting suspicious activity on the systems that store customer environment variables earlier this week. The cloud platform is advising developers to rotate their secrets as a precaution while the investigation continues.

The activity was identified on infrastructure responsible for holding environment variables, which often contain API keys, database credentials, and other sensitive configuration data. Railway has not disclosed the full scope of the incident or confirmed whether any customer data was accessed, but the warning indicates the company is treating the matter seriously.

• Rotate any secrets stored in Railway environment variables, including API keys, tokens, and database credentials.
• Review access logs and monitor for unusual activity tied to exposed credentials.
• Follow any further guidance Railway publishes as its investigation progresses.

Developers using Railway for deployment should treat credentials stored in the platform as potentially exposed until more details are available, and rotating them promptly is the safest course of action.

Note: No specific CVE ID or advisory number has been provided in connection with this incident.

Source: Unknown

Have you rotated your Railway secrets yet, and are you seeing any signs of abuse in your logs?

Capcom has confirmed that attackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer email addresses and associated account information. The company has acknowledged the incident publicly and is in the process of notifying those affected.

The exposed data centers on email addresses tied to CAPCOM ID accounts, which fans use to access the company's games and online services. Capcom has not released a full breakdown of every data element involved beyond the email addresses and related account details, so customers should treat any information linked to their CAPCOM ID profile as potentially compromised.

Affected users should be alert to phishing attempts that reference Capcom or CAPCOM ID, since exposed email addresses make convincing lures easier to craft. As a precaution:

• Watch for unsolicited emails claiming to come from Capcom and verify links independently rather than clicking through.
• Reuse of the same password across CAPCOM ID and other services should be stopped immediately, with unique credentials set per account.
• Enable multi-factor authentication wherever it is offered on accounts tied to the same email address.
• Monitor for unusual login activity and report suspicious messages to Capcom's support channels.

XploitLK will continue tracking official statements from Capcom as further details on the scope of the breach emerge.

Source: BleepingComputer

Has your organization reviewed third-party gaming or membership accounts tied to corporate email addresses in light of this breach?

Arista Networks has released security updates to address an actively exploited zero-day vulnerability impacting VeloCloud Orchestrator (VCO) On-Prem deployments. The company confirmed the flaw is being exploited in the wild, making patching a priority for organizations running the on-premises version of the orchestrator.

The affected product is VeloCloud Orchestrator On-Prem, and administrators are urged to apply the available updates as soon as possible. Arista has not disclosed specific technical details about the exploitation activity in the advisory.

• Identify any VeloCloud Orchestrator On-Prem instances in your environment
• Apply the latest security updates from Arista without delay
• Monitor for signs of compromise and review access logs on exposed VCO deployments

Given that the vulnerability is under active exploitation, delaying patching leaves on-prem orchestrators exposed to potential attack. Organizations should treat this with urgency and verify that all VCO instances are running the fixed release.

Source: BleepingComputer

Does your organization run VeloCloud Orchestrator on-prem, and have you already scheduled the update?

Researchers at Amazon Threat Intelligence report that attackers started exploiting the PHP2Shell vulnerabilities four days before patches for the flaws became available on Wednesday. The exploitation activity predates the public fix, indicating that threat actors were already active against vulnerable systems while defenders had no vendor patch to apply.

At this stage, the source material does not provide specific identifiers, affected version lists, or indicators of compromise beyond the exploitation timeline, so details beyond what has been published should be treated cautiously. Organizations running PHP-based services should prioritize reviewing their exposure and apply the vendor patches as soon as possible, while monitoring for signs of compromise that may date back to the pre-patch exploitation window.

Given that attacks began before fixes existed, a patching-only response may not be sufficient. Teams should also review logs from the days preceding the patch release and consider whether any suspicious activity occurred during that period.

Source: Unknown

Has your organization checked for signs of PHP2Shell exploitation dating back to before the patches were released?

Modern attacks no longer unfold over days or weeks. According to an analysis by Exaforce, attackers can steal credentials and start exfiltrating data within minutes, frequently outpacing the response time of security teams. The firm examined real-world incidents involving stolen GitHub tokens, malicious AI installers, and MFA phishing to illustrate how compressed the attack window has become.

The common thread across these cases is speed. Once credentials are compromised, the time between initial access and active data theft is short enough that manual investigation and triage simply cannot keep up. This is what the report describes as machine speed attacks, and it argues that detection and response must operate at the same pace, with automated containment playing a central role rather than serving as an optional enhancement.

Key takeaways from the analysis:

• Credential theft and data exfiltration can occur within minutes of initial compromise.
• Stolen GitHub tokens, malicious AI installers, and MFA phishing were among the real-world attack vectors examined.
• Human-speed response processes are insufficient against attacks that progress this quickly.
• Faster detection paired with automated containment is presented as critical to closing the gap.

For defenders, the implication is that any workflow dependent on manual escalation before containment will consistently lag behind an adversary operating at machine speed.

Source: Unknown

Does your organization have automated containment in place, or does response still depend on manual triage?

GitLab has released security patches addressing a maximum-severity vulnerability in its Regular Expression Compiler that could allow remote attackers to execute arbitrary code on vulnerable servers, the company has warned.

The flaw carries the highest possible severity rating, meaning organizations running affected GitLab deployments should treat patching as an urgent priority. Successful exploitation could give an unauthenticated attacker a path to run their own code on the server, which in a source-code management platform like GitLab is a serious exposure given the sensitive repositories and CI/CD pipelines it typically hosts.

Affected administrators are advised to:

• Apply the latest security patches from GitLab without delay
• Review their GitLab instance version against the vendor's patched releases
• Monitor for signs of unexpected or unauthorized activity on exposed instances
• Restrict public exposure of GitLab servers where operationally feasible

The advisory does not provide a specific CVE identifier in the details available, so teams should refer directly to GitLab's official security release announcement to confirm which versions are affected and which builds contain the fix. As with any critical remote code execution issue, delaying the update leaves the instance open to potential exploitation, and self-managed installations that face the internet carry the greatest risk.

Source: Unknown

Have you already patched your GitLab instance, or are you still mapping out the upgrade window?

A threat actor has breached the website of TeamUpdraft, the developer behind widely used WordPress backup and security plugins, in an incident that may have exposed UpdraftCentral connection keys. These keys are significant because they allow commands to be sent to connected WordPress sites, meaning stolen keys could potentially be abused to backdoor those installations.

At this stage, the exact scope of the compromise and the number of affected sites are not fully clear. Site administrators running UpdraftPlus or other TeamUpdraft products connected to UpdraftCentral should treat their connection keys as potentially compromised and review their installations for signs of unauthorized access. Rotating keys and auditing connected sites is advisable until official guidance confirms the full impact.

Source: BleepingComputer

Has your organization rotated UpdraftCentral keys or audited connected WordPress sites in response to this disclosure?

Law enforcement agencies across Africa have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 individuals in a coordinated crackdown known as Operation Serengeti III. The operation focused on major threat categories including business email compromise, ransomware, and online scams.

Key figures from the operation:

• Nearly 11,000 cybercrime networks disrupted
• More than 1,400 arrests made
• Targeted crimes: business email compromise, ransomware, and online scams

These results highlight the scale of cross-border cooperation needed to counter financially motivated cybercrime, which continues to affect organizations and individuals well beyond the African continent.

Source: BleepingComputer

Does your organization factor regional law enforcement operations like this into its threat intelligence and fraud risk assessments?