Daily Top
The development that matters most today.
RWP reviews current cyber developments and selects the event with the greatest operational or strategic relevance.
Latest
PHP2Shell is in the interpreter. Updating WordPress does not patch it.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 closed CVE-2026-109618 and CVE-2026-109619 on 21 October. CISA and the UK NCSC say take unpatched internet-facing PHP offline. Amazon’s MadPot saw an attempt on 17 October. Neither CVE is on KEV.
Previous assessments
- Plex2Shell is on KEV. A 1.43.3 label is not the fix.
- Siemens confirmed Software Center is loading the attacker’s DLL. Hunt the folder, not the hash.
- ConnectWise named two more IPs. Searching only .128 will miss them.
- ConnectWise disabled seven OAuth apps. Persistence is still in the tenant.
- The SkyKick app credential is in hostile hands. Disable it in every tenant.
- ARMORY CASTLE used BeyondTrust as a zero-day. Rebuild the appliance.
- Cisco split 76519 out of the September group. The attachment is still root.
- Volexity named UTA0576 on patched Connect Secure. Rebuild it.
- CERT-FR named Danfoss AK-SM and AK-SC. Pull the management UI.
- ReliaQuest named Settra on the GlobalProtect cookie. Kill the session.
- Ahsay walked back 10.3.4. The backup server is already in.
- CISA put 107406 on the NetScaler alert. 73.41 is still in.
- FBI seized MicroScan. CISA put five of the exploited CVEs on KEV.
- FBI says FortiBleed is still locking admins out. The ISO is not the close.
- CISA put EOL Hitachi RTU500 on the ICS list. The firmware POST still has no login.
- Eight Atlassian Data Center products will serve a known file without a login.
- CISA put NetScaler SAML overflow on KEV. Last week's RCE build is still in.
- FortiMail is due today. 7.6.7 notes closed CWE-22. PSIRT still says upcoming.
- CISA put Zammad on KEV. 7.2 is the session close. The root bug is still a fight.
- CISA put FortiMail on KEV. The fixed builds are still marked upcoming.
- CISA put SD-WAN Manager on KEV. The May peering patch does not close the API.
- Mandiant named WHIPSHOT on NetScaler. Today's KEV clock does not remove it.
- Apple patched CoreGraphics for a targeted iOS report. iOS 27 is not the fleet.
- CISA put two NetScaler RCEs on KEV. Default config is the precondition.
- The PeopleSoft WAF matched /PSEMHUB/. UNC6240 asked for /%50SEMHUB/.
- CISA put SharePoint on KEV. August's ticket said spoofing. Microsoft now says RCE.
- CISA put WSO2 on KEV. The catalog row says path traversal. WSO2 says JWT.
- WordPress 7.1.2 closed an unauthenticated include. Attackers are already writing PHP to disk.
- CISA put F5 APM OAuth on KEV. Closing the management port does not close the virtual server.
- CISA put Zyxel GS1900 on KEV. GreyNoise already counted 996 switches in 48 countries.
- Jade Sleet's macOS backdoors showed up on an IT-services MacBook. The crypto heist was optional.
- Conductor's 9.8 is unauthenticated GraalVM RCE. 3.30.2 shipped in June. CISA still has no KEV row.
- CISA put three Linux kernel bugs on KEV. The 9.8 is kTLS, not a generic kernel CVE.
- Check Point management is unauthenticated root. LivePatch Take 24 is last week’s VPN. Take 28 is this login.
- Cisco ISE is a CVSS 10 unauthenticated API. Patching without hunting access.log is not remediation.
- CISA marked vCenter CVE-2026-59310 as ransomware. Patching without hunting the appliance is not remediation.
- Cisco Secure Email Gateway is a pre-auth root shell. Closing the admin port does not close the mail path.
- ScreenConnect’s KEV clock is today. Cloud “no action” does not reinstall the host client.
- NCSC-NL expects Check Point VPN RCE any day. LivePatch Take 24 is the patch. Take 18 is not.
- GitLab’s CVSS 10 file-read is on KEV. Patching without hunting the commits API is not remediation.
- An AI-agent campaign compromised 440 PaperCut servers. Patching without hunting the print server is not remediation.
- Cisco FMC is under active root-level exploitation. The hotfix does not clean a box that already ran license.tmp.
- Two Windows EoP zero-days landed in CISA KEV on Patch Tuesday. The 974-CVE count is not the story.
- Adobe ships a CVSS 10 Magento hotfix. Patching without key rotation is not remediation.
- Unpatched Magento and Adobe Commerce RCE is already dropping Linux backdoors
- ASCII smuggling left the LLM paper and showed up as invisible Unicode in 2.3 million phish mails
- Fake IT on Teams was not vishing-for-a-stealer — it was hands-on-keyboard to the domain controller
- Breeze Comet does not encrypt Brazilian banks — it sends Pix as the bank
- The fake Razer/Edge/Kaspersky installer was a regenerated ZIP, not a one-hash IOC
- Spring Ring was Teams-as-helpdesk — 150 people, then PetitPotam toward the DC
- TerminalFix was ClickFix that kept going — stego PNGs, AD recon, then a Python reverse tunnel
- A small UK generator went dark four days — the grid barely noticed, the operator class did
- Three Russian clusters are phishing OAuth — ICE RELIC's door, not a new wiper
- SPECTRE is UAT-10147's cross-platform implant — RTCore64, DBUtil, and a fake acpi_pad.ko
- Winnipeg HSC ransomware hit HVAC and doors — clinical networks held
- DeadLock's encryptor is Rust; the negotiation desk is a Polygon contract and an HTML chat
- Dragos Q2 2026 — 1,140 industrial ransomware claims and still zero Stage 2 ICS kill-chain cases
- Copeland XWEB Pro: 23 bugs, root RCE, and a PoC that lied about the temperature
- Danfoss AK-SM 800A hid a "code of the day" that skipped the login
- Firmware walk-off through the programming interface — Nozomi's PLC extraction note is a trust-boundary problem
- UNC6671 did not retire — BlackFile split into four vishing brands aimed at M&A
- Nozomi's "zero-days at AI speed" is a disclosure-capacity warning — not a new ICS 0-day dump
- macOS ClickFix learned a fingerprinting gate so scanners saw a blank page
- ChainDrop was an npm worm with a postinstall — Unit 42 and Microsoft both treated it as self-propagating supply chain
- CaptiveCrunch put Midnight Blizzard on hotel sign-in pages — the traveler was the payload path
- FBI/EPA: seven states, internet-facing MicroLogix, changed IPs — some pressure loss and flooding
- Tengu is Mirai that tries to stay — IoT persistence, not a plant-floor payload
- Dutch intel found APT28 on cameras along the NATO logistics tail — not just the front
- Q2 2026 email after Tycoon2FA: 92% less kit mail, more Teams and leftover QR
- ACR Stealer showed two intrusion chains — same commodity, different front doors
- ShinyHunters is a brand over OAuth — Salesforce connected apps, not a new VPN 0-day
- ADFS token-signing keys live in Machine DPAPI — a “rotated” cert in the database can be a ghost
- Spring 2026 IoT botnets came in Go — Apex2 and c2c/meow, not a new ICS worm
- Google and the FBI cut NetNut/Popa — residential proxies are the crime WAN
- CyberAv3ngers aimed at sirens and Barix — the technical bar was legacy audio-over-IP, the goal was trust
- StealC rode Amadey — Microsoft and Europol cut 200 C2s, not the infostealer economy
- Handala's Cal Water dump was billing and RTKBase — Cal Water said OT did not move
- Sapphire Sleet poisoned @mastra in 45 minutes — easy-day-js was the dropper, npm was the plant
- UNC6508 spent a year in North American medical research — REDCap was the door, defense intel was the take
- Trane Tracer SC+ had a diagnostic service that was pre-auth root on the cooling controller
- Vertiv UPS cards had 9.8s that translate to "output OFF" for a data hall
- ChatGPT Plus billing mail was a carder page — AI brands are the new Microsoft logo
- Data-center OT is the cooling loop and the substation — NERC already rang the load alarm
- Luna Moth called U.S. law firms as IT — the payload was AnyDesk, not a 0-day
- Dragos Q1 2026 held the high baseline — 1,020 industrial ransomware claims, Qilin and Akira still on top
- Team82 ran Claude Opus on a video intercom they already owned — the LLM found bugs, not a new ICS weapon
- PLCnext "Engineer" was one store-app install away from root
- The Gentlemen encryptor was a Go worm with a password — Storm-2697 sold the rest as RaaS
- Fox Tempest sold 72-hour Microsoft signatures so ransomware looked like AnyDesk
- Kazuar stopped being a backdoor and became an FSB P2P botnet with a local leader
- Nozomi's Sandworm telemetry — 43 days of ignored alerts, then the GRU walked in
- The stealthy intrusion was a signed HPE agent under a third-party IT contract, not a 0-day
- GTIG's first AI-written zero-day was a 2FA logic bug — and they killed the mass run
- "Code of conduct" mail was HR shame as an AiTM kit — 35,000 users, 13,000 orgs
- Q1 2026 email was 8.3 billion phish attempts and a 146% QR spike — then Tycoon2FA got hit
- EnOcean SmartServer turned a timezone IP-852 packet into pre-auth root on the BMS gateway
- ZionSiphon was not water-sector malware — Nozomi called it a mock-up
- CODESYS Service credentials were enough to swap the boot application for a root backdoor
- Sapphire Sleet's macOS heist was a fake Zoom SDK in Script Editor, not a Gatekeeper bypass 0-day
- Storm-2755 stole Canadian paychecks through search-bar Microsoft 365, not a university phishing wave
- CEA-852 made LonTalk a remote protocol — optional HMAC is the design defect
- AA26-097A — they used Studio 5000 on internet PLCs. There was no CVE in the room
- LucidRook only runs if the box looks like Taiwan — Lua stager, fake AV, printers' FTP as C2
- Forest Blizzard did not need malware on the laptop — it needed your home router's DNS
- Storm-1175's Medusa business was the patch gap on the internet, measured in hours
- Hijacked IP cameras became BDA tools — plant-floor CCTV is in the same class
- The Axios npm hijack was a three-hour window on a 70-million-download library — Microsoft says Sapphire Sleet
- Dragos's 2026 landscape brief is the defender translation of the Year in Review — same groups, sharper access-path advice
- M-Trends 2026 — median dwell went the wrong way, and the handoff is 22 seconds
- 2026 tax-season phishing was an accountant-targeting RMM problem, not just refund-QR spam
- Storm-2561's fake VPN clients turned "Pulse Secure download" into a credential form
- Dragos Q4 2025 industrial ransomware — 1,211 claimed hits, Qilin still the volume leader
- Microsoft's AI-as-tradecraft brief is mostly a productivity story — with DPRK IT-worker fraud as the serious case
- GTIG's 2025 zero-day tally was enterprise-heavy: 90 exploited bugs, almost half in business tech
- Tycoon2FA was MFA-bypass as a monthly subscription — Microsoft's March disruption moved the volume, not the motive
- Nozomi's March 2026 Iran-APT note was a telemetry spike, not a new wiper
- LonTalk is still on the internet — Claroty counted a thousand exposed Echelon controllers
- Dragos's 2026 Year in Review is control-loop mapping — ransomware counted as OT by consequence
- UNC1549 still hires aerospace — fake job portals, resume malware, not a new fighter-jet wiper
- DKnife sits on the router — seven years of AitM, ShadowPad as the payload
- Hanwha Wisenet: five mediums, a hard-coded WDM password, and a camera fleet that sits on the OT VLAN anyway
- UAT-8837 is an access team on North American critical infrastructure — Sitecore 0-day, then SharpHound
- RedVDS sold $24 Windows boxes with one cloned hostname — and Microsoft took the storefront to court
- Internal-looking mail was often a routing and spoof-protection failure, not a Microsoft "Direct Send bug"
- React2Shell was a CVSS 10 that China-nexus actors and ransomware both used before most shops patched
- Dragos Q3 2025 counted industrial ransomware victims — not confirmed OT malware
- Shai-Hulud 2.0 turned npm install into a worm and CI into the amplifier
- LANDFALL was a year of Samsung zero-click — WhatsApp image, CVE-2025-21042, Middle East targeting
- PROMPTFLUX and PROMPTSTEAL call the LLM at runtime — malware that writes the next stage
- SesameOp did not hack OpenAI — it used Assistants API as a dead-drop the proxy would allow
- The engineering laptop was the OT perimeter — AutomationDirect Productivity Suite had nine ways in
- Nozomi's summer 2025 ransomware map is sensor alerts, not leak-site headcount
- Azure Blob Storage is being used as phishing host, malware CDN, and quiet C2 — under a Microsoft hostname
- CL0P's Oracle EBS emails were the bill — the 0-day had been in the suite since August
- Storm-2657 stole university paychecks through mailbox rules and Workday SSO, not a payroll CVE
- Microsoft Teams is an authentication and remote-support channel that attackers already treat as one
- GoAnywhere CVE-2025-10035 was already a Medusa door when Fortra still sounded like a patch note
- XCSSET's 2025 turn made shared Xcode projects a developer-to-developer supply chain
- BRICKSTORM lived 393 days on appliances with no EDR — legal and SaaS were the point
- Cognex In-Sight cameras shipped a hard-coded password and cleartext on the line
- The SVG phishing that looked like an LLM still died on mail-flow and infrastructure tells
- CISA's 23 September ICS six-pack was a protocol-trust problem, led by CLICK PLUS
- CISA's 11 September ICS drop was an identity and gateway problem, not a drive firmware problem