# Archive
Browse past daily curated stories
Wednesday, October 21, 2026
-
1The Hacker News generalPHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP's security team disclosed two critical vulnerabilities rated CVSS 9.2 (v4.0) affecting all supported branches (8.2–8.5), with watchTowr researchers confirming both flaws enable remote code execution. An emergency out-of-cycle patch was scheduled for release at 14:00 UTC on October 21, triggered after details reportedly leaked ahead of scheduled disclosure. No exploitation has been reported yet, but the PHP2Shell designation and public researcher attention make rapid patching urgent for any PHP-based infrastructure.
-
2The Hacker News generalRussian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
Symantec's Threat Hunter Team attributed a recent espionage campaign to APT28 (aka Fancy Bear, Forest Blizzard), targeting a NATO naval shipbuilder, an aircraft engine manufacturer, and a law enforcement agency across two NATO member states. The attackers deployed a previously undocumented backdoor called HOOKEDGE alongside a new reflective loader. This campaign reinforces APT28's continued focus on Western defense-industrial targets ahead of geopolitical tensions.
-
3The Hacker News generalEight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Eight intermediate CA certificates issued by Indian certificate authority eMudhra were found to have fatally weak private keys — recoverable by anyone — enabling arbitrary trusted certificate forgery for any website. Mozilla, Google Chrome Root Program, Apple, and the Go project (via Go 1.27.3 and 1.26.10) all moved to block the affected certificate chains on October 20. The compromise represents a systemic PKI trust failure, as intermediate CAs can issue certificates for any domain accepted by major browsers.
-
4The Hacker News generalQilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks confirmed ongoing exploitation of CVE-2026-0257 (CVSS 7.8), an authentication bypass in PAN-OS and Prisma Access that allows attackers to establish unauthorized VPN connections and bypass MFA. Both the Qilin and INC ransomware groups have been observed exploiting this flaw, which was patched in May 2026 but continues to be targeted in active campaigns. Organizations running unpatched PAN-OS or Prisma Access should treat this as an immediate remediation priority.
-
5The Hacker News generalCritical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
A public proof-of-concept exploit has been released for CVE-2026-106173 (CVSS 9.4), a critical path traversal vulnerability in Fortinet FortiSIEM that allows unauthenticated remote code execution. The availability of a working PoC dramatically increases exploitation risk for organizations running unpatched FortiSIEM instances. Security teams should apply Fortinet's patch immediately and review FortiSIEM exposure.
-
6SecurityWeek generalAOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
AOMEI Backupper's update infrastructure was compromised in multiple short-burst windows between April and July, during which attackers modified configuration files on update servers to push the ShinyRoad modular backdoor framework to users. AOMEI has not yet notified affected customers despite confirming the breach to Recorded Future News. This supply chain attack is particularly dangerous given AOMEI Backupper's broad deployment across enterprise and SMB environments.
-
7Graham Cluley generalPolice arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
German police arrested a 28-year-old Russian man suspected of being a key Qilin ransomware operator while he was on holiday, with investigators linking him directly to the 2024 attack on blood-testing firm Synnovis that disrupted London NHS hospitals and was connected to a patient death. The arrest is significant given Qilin's active exploitation of CVE-2026-0257 in Palo Alto infrastructure and its FBI designation as one of the most active ransomware groups with 600+ victims since 2024.
-
8The Hacker News generalHackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker hijacked a contributor's GitHub account on October 19 and replaced download archives across five existing releases of OVHcloud's open-source CLI tool with secret-stealing malware, keeping the malicious files live for up to 94 minutes (12:47–14:21 UTC). Any developer who ran the OVHcloud CLI during that window may have had credentials and secrets on disk exfiltrated. This incident underscores the persistent risk of GitHub-based supply chain attacks targeting developer tooling.
-
9The Hacker News generalPegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
Citizen Lab confirmed on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and prominent figure in Serbia's student protest movement, was infected with NSO Group's Pegasus spyware via a zero-click exploit in 2026 — just six days before Serbia's October 25 snap parliamentary election. The finding adds to a pattern of Pegasus targeting Serbian opposition and civil society figures ahead of elections. No interaction was required from Đokić for the infection to succeed.
-
10CyberScoop generalConnectWise customers hit by supply-chain attack linked to compromised API secret
A compromised API secret tied to ConnectWise's Cloud Backup service enabled attackers to authenticate into connected Microsoft 365 tenants, impacting hundreds of confirmed customers in a supply-chain-style attack against the managed service provider platform. ConnectWise responded by resetting credentials, replacing application keys, and taking Cloud Backup offline while the investigation continues. MSPs relying on ConnectWise for M365 backup should audit tenant access logs for unauthorized activity.