PHP2Shell reaches hundreds; kernel with 2.1 million exposed

PHP2Shell already reaches hundreds of servers, researcher estimates

Two serious flaws in PHP, named PHP2Shell, allow attackers to control web servers without a password. A researcher estimates several hundred victims in the campaign, with full control obtained on targets linked to the US government. Active exploitation is confirmed.

Breached servers give full control to attackers, with movement to internal systems, cryptocurrency miners, and assessment of ransomware intent. Products that embed PHP are also affected, such as IBM SevOne, QNAP, and Google Cloud Apigee portals.

Takeaway: Widely embedded base software requires tracking advisories from each vendor, not only the original project.

Sources: JPCERT/CC, TechCrunch Security, @hakluke

Binance report traces billion-dollar theft to three engineers

The first incident report from Binance traces the theft of US$ 6.3 billion to a campaign that lasted months and compromised the computers of three engineers, with a fraudulent code test and the abuse of an AI tool.

A single employee computer can reach systems that move billions: the entry point was reportedly the laptop of a DevOps engineer, with access to a container used to send withdrawals. About US$ 3 billion has been frozen; attackers still hold US$ 2.4 billion.

Takeaway: The path to critical systems often starts on an employee computer with access that is too broad.

Sources: @vxunderground, @WatcherGuru, @pashov

WordPress: nearly 63 thousand attacks in 24 hours after the patch

Nearly 63 thousand attack attempts in 24 hours target the WordPress flaw that allows executing code on the server during the update window, without a password. Probing began hours after the release of version 7.1.4, on October 28.

Wordfence has not yet recorded successful breaches, but every outdated site is a target: the attack requires hitting a window of seconds during the core update. CISA (the US cybersecurity agency) keeps the federal deadline of November 6.

Takeaway: Probing starts minutes after the patch; updating fast and checking logs is what separates you from the intruder.

Sources: The Hacker News, @DarkWebInformer, @TheHackersNews, CISA KEV

CISA confirms attacks on Apple flaw fixed two years ago

CISA confirmed active exploitation of an authentication flaw in Apple systems (CVE-2024-27834), used in attacks that install information-stealing malware, according to The Hacker News. The fix has existed for more than two years. Federal agencies have a deadline of November 18.

The flaw affects iPhone, iPad, and Mac, devices used by executives, and opens the way for malware that steals credentials, emails, and corporate data. According to CISA, an attacker with read and write capability bypasses pointer authentication.

Sources: CISA KEV, The Hacker News, @TheHackersNews

GitLab: attack tried 10.0 flaw on a server with updated GitLab

An attacker tried to exploit the maximum severity GitLab flaw on the Alpine Linux project server, on October 20 and 21. GitLab was up to date, but Ruby was not, and the flaw remained exploitable. With no proof of success, the server was rebuilt.

More than 1,000 servers remain exposed to the flaw, which allows executing code without a password through malicious CI (continuous integration) configuration, with risk of source code and secrets theft. CISA confirmed active exploitation; installations with their own Ruby remain vulnerable even with GitLab up to date.

Takeaway: Updating the application may not fix the dependency underneath; the fix must be confirmed, not assumed.

Sources: The Hacker News, @TheHackersNews, @DailyDarkWeb, CISA KEV

Android: more than 40% of devices are left out of the critical fix

More than 40% of Android devices run versions too old to receive the fix for the critical flaw CVE-2026-58868, according to Google data. The flaw allows executing code remotely, without a click or user action, on Android 14 to 17.

There are no confirmed attacks, but part of the corporate fleet can stay exposed indefinitely, since manufacturers and carriers distribute the fix on their own dates. The November bulletin brought 216 fixes, 23 of them critical.

Sources: SecurityWeek, The Hacker News, @DarkWebInformer, @IntCyberDigest

Linux kernel: scan finds 2.1 million accessible servers

A scan found 2.1 million servers accessible over the internet, potential targets of the critical Linux kernel flaw (CVE-2026-98432, score 9.8), which gives full control of the server to a remote attacker, without a password. The number was reported by Marcus Hutchins.

Anthropic demonstrated an exploit written by its AI model that took over test servers with full control in about 53 minutes; the code was not published. Ubuntu has not yet released a fix; Debian and Red Hat have already published.

Sources: The Hacker News, @DarkWebInformer, @IntCyberDigest

Zyxel releases Patch 3 after previous fix fails on switches

A Zyxel zero-day was exploited to attack nearly 1,000 network switches, according to BleepingComputer. The first fix, Patch 2, did not block execution of commands with maximum privileges without a password; Zyxel released Patch 3 for 10 GS1900 models.

Devices with only Patch 2 remained exposed to anyone who could reach the web management interface. Compromised switches can stop the company network and serve as a base for other attacks.

Takeaway: An applied patch is not a fixed flaw: without retesting, the gap can stay open with no one noticing.

Sources: The Hacker News, @BleepinComputer, @TheHackersNews

Group claims leak of 7.7 million records from Brazilian company

Members of the Anka Team group claim to have leaked 7.7 million records linked to Cingular, a Brazilian IT and consulting company. The claimed data includes names, emails, phone numbers, and national and tax identification numbers. A partially redacted sample was published.

Origin and authenticity still lack independent confirmation. If confirmed, the leak exposes personal data with risk of fraud and phishing, and internal information can support later attacks against the company and its clients.

Sources: @DarkWebInformer

Hacker ran 12 AI agents and breached Taipei emergency services

A hacker in Taiwan ran 12 AI agents against hundreds of organizations in 11 countries, according to Acronis, a security company. Among the breached targets are Taipei emergency services, with dispatch records and 2018 patient data extracted.

He gave the lead agent full authority and used local DeepSeek models without security training, after refusals from Grok and MiniMax. The case shows that autonomous agents can be pointed at hundreds of organizations in several countries.

Sources: @IntCyberDigest