Weekly Threat Intel: October 16–23, 2026 — The Indicator

47 Reports analyzed

1,249 IOCs extracted

2 PHP core RCE flaws disclosed October 21

4 Reports on PAN-OS and Fortinet edge exploitation

3 Publishers covering Midnight Mimosa firmware malware

Key Takeaways for Security Professionals

Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

Two critical PHP core flaws have public exploits. Prioritize internet-facing hosts, especially mod_php. PHP 8.1 and older no longer get project fixes, so confirm vendor backports and hunt for double-extension files such as avatar.php.jpg.
Apply WordPress core fixes for WP2Shell and audit for new admins and plugins.

The chain of CVE-2026-63030 and CVE-2026-60137 needs no login. Review requests to /wp-json/batch/v1, unexpected administrator accounts, and plugin directories containing wp2shell_ or temp-write-test files.
Patch NetScaler for CVE-2026-88771 and CVE-2026-107406, then hunt for web shells.

Exploitation moved to mass scanning. Check /var/log/ns.log for poisoned entries, look for Nx_7508 files, and rotate credentials and certificates if the appliance was exposed before patching.
Patch GlobalProtect CVE-2026-0257 and restrict management and VPN portals.

Qilin, INC and k0t all use this flaw. Review VPN logs for the listed source addresses, check Veeam exposure, and protect hypervisor disks that store credentials.
Hunt AOMEI updater activity and unexpected Radmin folders on Windows endpoints.

Update configs were altered for minutes, so look for NitroRuntime scheduled tasks, upgrade-now.exe, and Radmin directories under LOCALAPPDATA on machines running AOMEI products.
Remove LiteLLM 1.107.0 and rotate AI API keys and CI secrets.

Search environments for cook.pth and the /tmp/.pc_ marker file, and audit workflows named security-check.yml or security-audit.yml, which GhostAction used to steal cloud and AI credentials.
Block outbound finger.exe and restrict pasting commands from fake CAPTCHAs.

The Amazon-themed ClickFix campaign chained a finger command into Lumma Stealer and NetSupport. Alert on finger.exe use and unapproved NetSupport Client32.exe installs.

Contents

PHP2Shell Puts Every PHP Web Server at Risk While WordPress, FortiSIEM and GitLab Get Exploit Code
NetScaler, Palo Alto and Fortinet Edge Devices Remain the Main Way In
Update Channels, Packages and Firmware Were Tampered With
Russian, North Korean and Chinese Operators Target Defense, Finance and Infrastructure
AI Is Both the Attack Tool and the Target
Backup Servers, VPNs and Defender Tampering Precede Encryption
ClickFix, Credential Phishing and Mobile Banking Malware

PHP’s core runtime, not an application, was the defining vulnerability this week: CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21 with public exploits, alongside WordPress core, FortiSIEM and GitLab exploit details. Edge devices stayed the main intrusion route, with NetScaler, GlobalProtect and FortiGate all in play. Supply chain compromises reached an updater, PyPI, GitHub Actions, Terraform look-alikes and Android firmware. State-linked operators from Russia, North Korea and China leaned on trusted binaries, while AI showed up on both sides of the fight.

01 — TOP STORY

PHP2Shell Puts Every PHP Web Server at Risk While WordPress, FortiSIEM and GitLab Get Exploit Code

The week’s most consequential development is a pair of critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21 with exploits already circulating. Three other web-facing platforms drew public exploit details in the same days: WordPress core, FortiSIEM and GitLab.

PHP core — php2shell — 42 IOCs

Critical PHP core RCE flaws affect all versions with PoCs in the wild

SANS ISC describes CVE-2026-109618 and CVE-2026-109619 as critical PHP core vulnerabilities affecting all versions, with proof-of-concept exploits available in the wild. Elastic’s coverage analysis lists the post-exploitation behavior to detect: access confirmation with id and whoami, credential-file reads such as ~/.aws/credentials, and double-extension web shells like avatar.php.jpg. The PHP project shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP 8.1 and older no longer receive project updates, so those estates depend on distribution backports.

42 IOCs · Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 · Unauthenticated web RCE · Hunt double-extension shells

WordPress — WP2Shell — 11 IOCs

WP2Shell chains two core flaws into an unauthenticated admin takeover

Cryptika and CyberPress both describe WP2Shell, which chains CVE-2026-63030 (a REST API batch-route flaw) and CVE-2026-60137 (SQL injection) so an unauthenticated attacker can create admin accounts and upload a web-shell plugin. Look for requests to /wp-json/batch/v1, temp-write-test-* files, and staged archives such as wp2shell_4e9b3641.zip that extract to wp2shell_<hex>.php. Both reports draw on the same underlying research, so treat them as one view.

11 IOCs · Unauthenticated admin creation · Plugin-upload web shell · Watch /wp-json/batch/v1

Fortinet — FortiSIEM — 13 IOCs

Public exploit code for unauthenticated FortiSIEM RCE

A public proof of concept exists for CVE-2026-106173, a critical unauthenticated remote code execution flaw in FortiSIEM’s gRPC service. Both reports point defenders to /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool as files to inspect. Earlier FortiSIEM bugs CVE-2024-23108 and CVE-2025-64155 are cited as prior art.

13 IOCs · Unauthenticated gRPC RCE · Public PoC · Inspect redishb.sh

GitLab — CI/CD regex overflow — 6 IOCs

Rapid7 analyzes unauthenticated command execution in GitLab CI/CD

Rapid7 published a technical analysis of CVE-2026-97229, an integer overflow in GitLab’s CI/CD regular-expression handling that allows unauthenticated command execution. The write-up includes a proof-of-concept invocation and points to the Workhorse log at /var/log/gitlab/gitlab-workhorse/current for investigation.

6 IOCs · Integer overflow · Unauthenticated command execution · Review Workhorse logs

Rank Math PRO — plugin compromise — 5 IOCs

Compromised WordPress plugin installs backdoors that rebuild themselves

Cryptika reports that the Rank Math PRO plugin was compromised to install self-rebuilding backdoors, a fake core file at wp-includes/class-wp-cache-util.php, and malicious database entries. Outbound connections to rank1cdn[.]com and the mail domain wp-mail[.]net are the reported network indicators, and wp core verify-checksums is the suggested first check.

5 IOCs · Fake core file · Self-rebuilding backdoor · wp core verify-checksums

Patch order matters. PHP sits under WordPress, GitLab-adjacent tooling and countless internal apps, so an unpatched runtime makes every application-level fix on this list less useful. Start with internet-facing PHP, especially mod_php deployments, which the PHP team considers highest risk (Help Net Security).

02 — EDGE DEVICES

NetScaler, Palo Alto and Fortinet Edge Devices Remain the Main Way In

Edge exploitation continued on the threads this series has tracked: NetScaler for a third digest, GlobalProtect CVE-2026-0257 now tied to ransomware and a separate intrusion set, and a FortiGate implant first seen last week.

Citrix NetScaler — CVE-2026-88771 / CVE-2026-107406 — 82 IOCs

NetScaler exploitation moves from zero-day to mass attacks

Zscaler details exploitation of CVE-2026-88771 through log poisoning: a payload planted in /var/log/ns.log is later executed, enabling PHP web shells such as Nx_7508.php, a fingerprint file Nx_7508.html, and a FreeBSD implant. Hive Pro adds CVE-2026-107406, a critical memory overflow in SAML configurations that allows unauthenticated code execution or denial of service, alongside the earlier CVE-2026-88772 and CVE-2026-88779. Help Net Security reports attacks escalated to mass scanning after a public proof of concept appeared. This continues the NetScaler thread from the August 29–October 9 and October 9–16 digests.

82 IOCs · Log poisoning · Web shells + FreeBSD implant · SAML overflow CVE-2026-107406

Palo Alto GlobalProtect — CVE-2026-0257 — 12 IOCs

Ransomware crews use GlobalProtect to bypass MFA and reach VMware disks

Cryptika reports exploitation of CVE-2026-0257 to bypass MFA, steal credentials from VMware disks and deploy ransomware; CyberPress names Qilin and INC as the operators and also lists the Veeam flaw CVE-2023-27532. The two reports share a source address, and five indicators overlap with the July 1 report on this flaw, so this is a long-running campaign rather than a new one.

12 IOCs · Qilin + INC · MFA bypass · Veeam CVE-2023-27532 in the chain

k0t — FortiGate, FortiWeb, GlobalProtect — 56 IOCs

Group-IB tracks k0t across three edge product families

Group-IB describes k0t exploiting FortiGate, FortiWeb (CVE-2025-64446) and GlobalProtect to harvest credentials, persist and exfiltrate data. Its toolkit includes AdaptixC2 agents, MeshCentral agents, a Nezha dashboard, and a Python exploit script for CVE-2026-0257. The mix of MeshAgent and AdaptixC2 echoes the legitimate-remote-tool pattern from earlier digests.

56 IOCs · AdaptixC2 + MeshAgent · FortiWeb path traversal · GlobalProtect exploit script

CL-STA-0954 — PEERSTITCH — 40 IOCs

PEERSTITCH implant returns with fuller technical detail

Hive Pro reports that CL-STA-0954 exploited FortiJump (CVE-2024-47575) to steal configurations, then ran PEERSTITCH, a memory-resident ARM64 implant, on FortiGate firewalls. It targets miglogd and iked, alters md-acme.conf, and stages a malicious pM.js. Eight hashes overlap with the October 15 report covered in last week’s digest.

40 IOCs · Memory-resident ARM64 implant · Targets miglogd and iked · FortiJump

Four reports, three vendors, one lesson. Qilin, INC, k0t and CL-STA-0954 all reach the same management and VPN surfaces. Corroboration for CVE-2026-0257 comes from different publishers, but the two PAN-OS write-ups overlap heavily, so count them as related views of one campaign.

03 — SUPPLY CHAIN

Update Channels, Packages and Firmware Were Tampered With

Trust in the delivery path was the common weakness: a software updater, a package registry, a Terraform registry look-alike, CI workflows, vendor credentials and phone firmware.

UNC7017 — AOMEI update tampering — 121 IOCs

AOMEI update configuration was altered for minutes at a time

Google Threat Intelligence attributes the activity to UNC7017, which briefly modified AOMEI’s update configuration files down_html.ini and Notifycfg.ini so clients fetched the CROSSROAD loader, which in turn delivered the SHINYROAD backdoor and an Adaptix C2 beacon. The tampering lasted about five minutes per window, which is why checks of the vendor’s URLs afterwards would show nothing. Cryptika’s report shares 35 indicators with Google’s and is the same story. BleepingComputer reports victims in IT services, telecommunications and higher education.

121 IOCs · Updater config tampering · CROSSROAD → SHINYROAD · NitroRuntime scheduled task

GhostAction — 32 IOCs

GhostAction grows to 790 repositories

Cryptika and CyberPress report that malicious workflows named github_actions_security.yml, security-check.yml and security-audit.yml were pushed to 790 GitHub repositories, up from the 772 in an earlier digest. The workflows exfiltrate cloud credentials and AI API keys, and my-github[.]com and my-gitlab[.]com are flagged as next-phase domains. Both reports share indicators with October 9 and 11 reports on the same campaign.

32 IOCs · Workflow injection · Cloud and AI API key theft · 790 repositories

TraderTraitor — Terraform provider — 163 IOCs

TraderTraitor’s fake Terraform provider gets a fuller write-up

Hive Pro describes the North Korean actor planting FLATROOF and ROOFDECK backdoors through a fake Terraform AWS provider, stealing credentials and crypto wallets. Look-alike registries such as registry[.]hashicorp-aws[.]io and a provider binary named terraform-provider-awsbeta_v1.0.0 are among the indicators. Twelve indicators overlap with the October 8 report on the same campaign.

163 IOCs · FLATROOF + ROOFDECK · Look-alike HashiCorp registries · Credential and wallet theft

LiteLLM — PyPI — 7 IOCs

LiteLLM 1.107.0 on PyPI carried an infostealer and RAT

Cryptika reports that release 1.107.0 of LiteLLM was compromised to distribute an infostealer and RAT aimed at developer credentials and AI service tokens. Check for cook.pth, cook.py, a modified sitecustomize.py, the marker /tmp/.pc_once_72129118c59f5636c0bb and traffic to www[.]litellm[.]dev/healthcheck. This is a single-publisher report.

7 IOCs · PyPI release compromise · .pth startup hook · AI token theft

ConnectWise — vendor credentials — 6 IOCs

Stolen ConnectWise backup-app credentials opened Microsoft 365 tenants

Huntress reports that credentials for ConnectWise’s Cloud Backup and Management application were stolen and abused to access Microsoft 365 environments, read data and persist. The report lists CVE-2025-11371 and a hosting-provider ASN, AS14956, for the unauthorized activity.

6 IOCs · Vendor app credentials · Microsoft 365 access · AS14956

Midnight Mimosa — Android firmware — 125 IOCs

Midnight Mimosa malware ships preinstalled on low-cost Android phones

Polyswarm, Cryptika and CyberPress all describe preinstalled malware in low-cost Android firmware, with the com.android.system.lite enabler and libeasy.so library disabling Google Play protections to install ad-fraud and proxy payloads. Polyswarm and Cryptika share 40 indicators, including the C2 api.weatherlive[.]world. The campaign was also in the October 9–16 digest.

125 IOCs · Preinstalled enabler · Ad fraud + residential proxy · weatherlive C2

eMudhra — intermediate certificates — 9 IOCs

Eight eMudhra intermediate certificates were compromised

Talos reports eight eMudhra intermediate certificates were compromised through weak key generation, which would let an attacker impersonate servers and intercept traffic. The issue affects both TLS and code signing, and Talos lists the certificate hashes for trust-store checks.

9 IOCs · Weak key generation · TLS and code signing · 8 certificate hashes

Ephemeral compromise defeats point-in-time checks. The AOMEI windows lasted minutes, so detection depends on endpoint telemetry from clients that updated during them, not on re-fetching the vendor’s files afterwards.

04 — STATE-LINKED

Russian, North Korean and Chinese Operators Target Defense, Finance and Infrastructure

Four state-linked operations reached analysts this week, each relying on trusted binaries or legitimate services to blend in.

Swallowtail / APT28 — Hookedge — 106 IOCs

Hookedge backdoor reaches defense firms and a naval shipbuilder

Security.com tracks the Russian group as Swallowtail and reports targeting of defense firms in two NATO countries, while Cryptika attributes the same Hookedge activity to APT28 and a naval shipbuilder. Operators used a reflective loader (ld.exe with Events.dat), an SSH key at C:\ProgramData\Adobe\id_rsa for a reverse tunnel, and webhook.site endpoints for canary requests. One dropper hash overlaps with the September 4 BlueDelta HOOKEDGE report.

106 IOCs · Hookedge + reflective loader · SSH tunnel · webhook.site endpoints

Lazarus — Operation FlashHole — 58 IOCs

Lazarus abuses mandatory Korean security software

SecureList describes Operation FlashHole against South Korean organizations, a chain of TechHub, Cubridge, TouchShift, ClientHub and LPEClient that runs under the mandatory security software process INISAFECrossWebEXSvc.exe. Initial links were embedded in a résumé site and an interior-design site, and persistence uses a service at C:\Windows\System32\RasConv\ImeBroker.exe.

58 IOCs · Five-stage chain · Abuses INISAFE service · Korean web-shell C2s

BRONZE SANDCASTLE — 46 IOCs

DLL sideloading through Sandboxie, Java, Krita and NVDA pairs

Cryptika and CyberPress describe a China-linked group using sideloaded DLLs next to trusted executables, such as javaw.exe with jli.dll and SandboxieWUAU.exe with sbiedll.dll, plus a modified Meterpreter-based backdoor. It targets Asia and Africa, uses vssadmin.exe to copy ntds.dit, and calls dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Both reports share four indicators.

46 IOCs · Sideloading pairs · NTDS credential theft · File-sharing services abused

Flax Typhoon / Integrity Tech — 17 IOCs

Automated scanning tools aimed at US critical infrastructure

Polyswarm links Integrity Tech and Flax Typhoon to automated scanning and exploitation tools such as MicroScan, used against US critical infrastructure to steal credentials and email. Listed exploited flaws include CVE-2019-11510 and CVE-2021-22205, with tooling disguised as DiagTrack.exe, conhost.exe and dllhost.exe.

17 IOCs · MicroScan · Old VPN and GitLab CVEs · Masquerading binaries

05 — AI

AI Is Both the Attack Tool and the Target

Reports covered an AI-assisted intrusion framework, an autonomous LLM-hijacking agent, ransomware operators who leaked their own AI-assisted planning, and a defensive win.

ARTEX framework — 31 IOCs

ARTEX combines pentest tooling with AI coding assistants

Zscaler describes actors using the ARTEX penetration-testing framework with AI coding assistants and custom automation, including a gateway at xcai.pro and proxy chains, for financial gain. CyberPress ties the TAG-217 actor and ARTEX to South Korean financial institutions and 68,000 people’s exposed data, and cites CVE-2026-0257. The October 9–16 digest first covered this activity.

31 IOCs · ARTEX · AI gateway + SOCKS pool · South Korean banks

Skynet LLMjacking — 11 IOCs

An autonomous agent hijacks exposed LLMs to attack and mine

Security.com describes an agent that finds exposed AI models and uses them to scan, exploit, steal credentials and mine cryptocurrency without human input. Mining pools such as mine.c3pool[.]com and xmrpool[.]eu and edits to go2rtc.yml are the reported indicators.

11 IOCs · Exposed LLM servers · Autonomous operation · XMR mining pools

INC ransomware — 35 IOCs

Ransomware operators leak their own AI-assisted attack planning

Cryptika reports that ransomware operators who used Claude to plan attacks left chat sessions, infrastructure and encryptor builds on a public server. The exposed material references CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp) and CVE-2026-41940 (cPanel WHM), and three INC leak-site indicators overlap with a July 20 report. This is a single-publisher account.

35 IOCs · AI-assisted planning · INC leak-site domains · Exposed builds

Defensive and risk findings — 6 IOCs

Claude spots a miner, and a report counts dormant agents

Cryptika says Claude found a hidden XMRig miner and a LaunchAgent while building a Mac app, with the miner at /tmp/rigupdater and a pool.hashvault.sh destination. A separate Arrakis Security report finds 76% of AI agents are dormant yet still hold credentials and connections, a vendor statistic worth checking against your own inventory.

6 IOCs · XMRig + LaunchAgent · 76% dormant agents · Credential hygiene

06 — RANSOMWARE

Backup Servers, VPNs and Defender Tampering Precede Encryption

Ransomware reporting this week reinforces the edge story above and the pattern of disabling defenses before encryption.

SafePay — 63 IOCs

SafePay claims 600+ victims through VPNs and backup servers

Cryptika reports SafePay has affected over 600 organizations using stolen credentials and known flaws, including the Veeam bug CVE-2024-40711 and CVE-2023-27532. Tools seen include NetExec (nxc.exe), SharpShares.exe, netscan.exe, WinRAR and Backblaze’s b2.exe. Two hashes overlap with a July 13 report.

63 IOCs · 600+ organizations · Veeam + VPN entry · NetExec and b2.exe exfiltration

The Gentlemen — 27 IOCs

Gentlemen ransomware kills Defender and backups across platforms

Cryptika describes the operation targeting Windows, Linux, NAS and BSD with a double-extortion model. It disables security tooling with a vulnerable driver (BootRepair.sys, CVE-2025-70795) and EDR-killer tools, then destroys backups. Two payload hashes overlap with the May 14 leak-analysis report.

27 IOCs · BYOVD · EDR killers · Windows, Linux, NAS, BSD

ShinyHunters — 1 IOCs

FBI suspects a security executive helped run ShinyHunters’ leak site

Cryptika reports the FBI suspects a cybersecurity executive helped operate an extortion website used to pressure ShinyHunters victims. The site domain, shinywire[.]com, is the only indicator.

1 IOCs · Extortion site · Insider suspicion · Domain only

07 — ALSO WORTH TRACKING

ClickFix, Credential Phishing and Mobile Banking Malware

The social-engineering reports share a theme: lures that borrow trusted brands, trusted senders or the user’s own hands.

ROMULUS ClickFix — 38 IOCs

ROMULUS delivers LegionLoader through ClickFix traps

Cryptika describes the ROMULUS platform using hidden PowerShell, a trojanized IconEdit2Turb.msi installer, a patched sideloaded DLL and encrypted archives to deploy LegionLoader. Nine hashes overlap with the September 29 ChatGPT custom-GPT ClickFix report.

38 IOCs · Trojanized installer · Sideloaded DLL · LegionLoader

Amazon-themed ClickFix — 46 IOCs

A fake CAPTCHA tells victims to run a finger command

Huntress describes a sponsored-ad route to a spoofed Amazon login and fake CAPTCHA that makes victims run finger, leading to Lumma Stealer and NetSupport RMM (Client32.exe), with a separate macOS payload source. Blocking the finger client outbound is a cheap control.

46 IOCs · finger command · Lumma + NetSupport · Sponsored ad lure

Google credential phishing — 12 IOCs

Fake Google Meet and Amazon Music pages target Google accounts

Cryptika reports meet-google[.]cyou and qooglo[.]com stealing Google credentials with 2FA phishing, and an exposed /install page revealed database configuration. Malwarebytes reports fake Amazon Music advertising deals sending YouTube creators to amazonyt[.]com to hijack channels.

12 IOCs · Fake Meet pages · Creator-targeted lure · 2FA phishing

YuanKong and trusted senders — 22 IOCs

Android banking RAT and abuse of legitimate sender infrastructure

Cryptika reports the YuanKong Android RAT uses Accessibility features to steal banking PINs and passwords without needing SMS or contact permissions. Talos shows attackers sending phishing from genuine order-notification systems such as orders.staples.com, so blocking the sender domain is not a safe fix. ANY.RUN’s release post covers Kali365 domains as examples for IOC context.

22 IOCs · Accessibility abuse · Legitimate sender abuse · Kali365 examples

Analyst Assessment: October 16–23, 2026 in Context

Runtime flaws outrank application bugs. A PHP core flaw affects the WordPress, GitLab-adjacent and custom code running on top of it, which is why it leads this digest. The practical risk is inventory: many organizations cannot say which servers run PHP 8.1 or older, or which use mod_php.

Edge exploitation is now continuous, not episodic. NetScaler appeared in three consecutive digests, and PAN-OS and FortiGate reporting overlapped with indicators from July and last week. Several publishers describe the same flaws, but many of these reports are derivative, so the real corroboration is smaller than the report count suggests.

Trust paths are being targeted directly. AOMEI’s updater, a PyPI release, GitHub workflows, look-alike Terraform registries, intermediate certificates and Android firmware all abuse something the victim already trusted. Controls that verify provenance matter more than reputation lists.

What to do now: 1) Patch PHP and confirm backports for unsupported branches. 2) Patch NetScaler, GlobalProtect and FortiSIEM, then hunt for web shells and implants. 3) Remove LiteLLM 1.107.0, rotate AI and CI secrets, and audit GitHub workflows. 4) Search endpoints for AOMEI-related Radmin artifacts. 5) Alert on finger.exe and unapproved remote-access tools.

Sources

Google Threat Intelligence — Investigating Ephemeral Supply Chain Tampering
Cryptika — Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Cryptika — New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
Rapid7 — Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Polyswarm — Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools
Zscaler — CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
huntress.com — ConnectWise Vendor Credentials Abused
Polyswarm — Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain
Hive Pro — Critical NetScaler SAML Flaw Opens Path to Remote Code Execution
Hive Pro — PEERSTITCH: The FortiGate Implant That Hides Inside Trusted Processes
Hive Pro — TraderTraitor Plants Backdoors in the Cloud Engineer's Toolbox
Cryptika — Claude AI Detects Hidden Crypto Miner While Building Temperature Monitor App on Mac
Cryptika — Hackers Using Fake Google Meet Pages to Steal Google Credentials
Cryptika — Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors
Cryptika — Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors
Cryptika — Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks
Security.com Threat Intel — Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
Cryptika — Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys
Cryptika — Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections
Cryptika — WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login
CyberPress - Cybersecurity News — Hackers Infect Android Phones With Malware Before Users Even Turn Them On
CyberPress - Cybersecurity News — Researchers Uncover GhostAction Supply Chain Attack Targeting 790 GitHub Repositories
CyberPress - Cybersecurity News — AI-Assisted Hackers Target South Korean Banks as Breaches Expose 68,000 People’s Data
CyberPress - Cybersecurity News — Qilin and INC Ransomware Hackers Exploit Palo Alto Networks VPN Flaw to Breach Networks
CyberPress - Cybersecurity News — Researchers Uncover How Hackers Can Hijack WordPress Sites Through Malicious Plugin Uploads
Cryptika — FBI Suspects Cybersecurity Executive Helped ShinyHunters Run Extortion Website
SecureList — Operation FlashHole: Lazarus breaks security, defies control
Group IB Blog — Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Cryptika — SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers
Talos — Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Security.com Threat Intel — Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks
Cryptika — Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit That Requires No Login
any.run — Related Threat Context: Cut Time-to-Triage with Actionable Context for Every IOC
Cryptika — Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets
SANS ISC — Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
Huntress — Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
MalwareBytes — Fake Amazon Music x YouTube deal lures creators into a Google login trap
Elastic Security Lab — php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
Cryptika — APT28 Hackers Open Secret SSH Tunnel Into NATO Country’s Naval Shipbuilder Network
CyberPress - Cybersecurity News — Critical Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit Code
CyberPress - Cybersecurity News — Chinese Espionage Hackers Use Modified Meterpreter Malware to Target Organizations in Asia and Africa
Cryptika — Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups
Cryptika — LiteLLM Compromised – Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release
Cryptika — China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials
Cryptika — Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections
Zscaler — Inside a Global AI-Assisted Hacking Campaign
Talos — Compromised eMudhra intermediate certificates
Help Net Security — PHP2Shell PHP vulnerabilities patched (CVE-2026-109618, CVE-2026-109619)
Vercel — PHP security advisory: php2shell (CVE-2026-109618, CVE-2026-109619)
BleepingComputer — Hackers hijack AOMEI update servers to secretly spread malware
Help Net Security — NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

This digest was generated with Claude by Anthropic, based on source reporting from the publications listed above and analysis of 47 IOC submissions to iocget.com between October 16, 2026 and October 23, 2026.

Weekly Threat IntelOctober 16–23, 2026