Old PHP left without a fix; Nextcloud flaw is exploited

Japanese advisory organizes PHP2Shell fixes; old versions left without a patch

Japan's security center detailed the fixes for the two PHP2Shell flaws: PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus updates from Ubuntu, Red Hat and Peplink. Installations on unsupported versions, 8.1 and earlier, are left without an official fix.

The fix does not even reach everyone. Servers on unsupported versions remain exposed to remote takeover, with no patch planned, and researchers have already documented real PHP2Shell exploitation in production.

Takeaway: Unsupported software turns each new flaw into a permanent risk, with no patch to wait for.

Sources: JPCERT/CC, TechCrunch Security, @zerodayalpha 1, @zerodayalpha 2, @DailyDarkWeb, @0x4D31

PHP2Shell exploitation goes through a Google proxy; Unit 42 corrects its report

A researcher demonstrated that the PHP flaw works behind Google's reverse proxy, used in services such as Cloud Run. The layer many considered protection did not stop the exploitation, which was carried out with an AI agent.

Palo Alto Networks corrected an earlier assessment. The Unit 42 team withdrew the reading that the attack on a European government involved PHP2Shell: it occurred in the context of a vulnerable PHP application. Rushed attributions confuse the response.

Sources: @hakluke, @LiveOverflow, The Hacker News

Nextcloud Collabora flaw is exploited to install backdoors

Hackers break into Nextcloud servers through a flaw in the document editing app, the built-in Collabora CODE. Attackers use the flaw to install backdoors, and CISA (the US cybersecurity agency) added the case to the list of actively exploited flaws.

The fix has existed since September. Servers that have not updated the app may be compromised, with a backdoor installed and corporate data accessible. The alternative is to uninstall the app.

Takeaway: An optional app, with no clear owner and no updates, is usually the easiest target.

Sources: NVD, The Hacker News, Collabora, GitHub Advisory Database, GitHub, Nextcloud community forum

Canada confirms active exploitation of critical FortiSIEM flaw

Canada confirms real attacks on FortiSIEM installations, Fortinet's monitoring tool. The flaw allows executing commands on the server without a password. Demonstration code was published on October 20.

The security tool became the target. Anyone running outdated FortiSIEM may have the alerting system compromised, giving the intruder visibility of the environment. Fortinet still lists the flaw as having no known exploitation.

Takeaway: An outdated monitoring tool hands the intruder full visibility of the environment.

Sources: @DarkWebInformer, @IntCyberDigest

Japanese vendor exposes 1.4 million prepaid cards with PIN

A payments vendor in Japan confirmed a leak of 1,424,748 records of store prepaid cards, with card identifier, PIN and balance. The MOS Burger snack chain confirmed another 1,133,070 records exposed through the same vendor.

The vendor blocked the access, but the damage reaches third-party customers. The flaw was in the web server of the subsidiary Value Design. Names, addresses and credit card data were left out; no losses were reported as of October 23.

Takeaway: The vendor's flaw leaks your customers' data; the reputation damage is yours.

Sources: @DailyDarkWeb

Microsoft releases emergency .NET fix for the Brotli flaw

Microsoft published an emergency fix in .NET for the flaw in the Brotli decompressor, which affects Node.js, Bun, proxies and Python packages. The company admitted that two fixes from October 13 were insufficient.

The reach goes far beyond Node.js. Decompressing malicious data corrupts the memory of .NET applications, Visual Studio and PowerShell, Envoy and Istio proxies, and Python packages. Every piece of software that receives compressed data from third parties needs an update.

Sources: Microsoft, The Hacker News, @ethiack, @IntCyberDigest, @BleepinComputer, @DarkWebInformer

Tailscale has 11 flaws without a fix; a compromised device moves through the network

An independent audit listed eleven flaws in Tailscale, a private networking tool between servers. The most severe: a single compromised device can obtain administrator access on other servers in the same network. The fix has not been released yet.

The risk starts from a compromised device already authorized on the network. Those who use Tailscale only with their own devices have lower exposure, according to analysts. Tailscale says a fix is in preparation.

Sources: Tailscale, @IntCyberDigest, @The_Cyber_News, @cocktailpeanut, @TheHackersNews, Cyberdione Labs

Closed Solana contract is reverse engineered and reveals a critical flaw

A researcher reconstructed the code of a cryptocurrency contract on the Solana network without access to the source, in a byte-for-byte identical version. In the process, he found a critical flaw in the production program. There are no technical details or announced fix.

Closed code failed to prevent the audit. Any program published on a blockchain can be reconstructed and analyzed by anyone, including attackers. Details of the flaw and the fix have not been disclosed yet.

Takeaway: Treating closed code as protection no longer works; testing needs to come before the attacker.

Sources: @shawmakesmagic

Electrum fixes flaw that hid bitcoin theft behind a higher fee

The Electrum wallet fixed a critical flaw that allowed a malicious server to swap a recently sent transaction and trick the user. The scam hid the theft of the coins behind an apparent fee increase.

The scam looked like a fee increase. By accepting the new value, the user unknowingly signed the transfer of their own bitcoins. Version 4.8.3 fixes it; everyone should update.

Sources: spesmilo/electrum, @ElectrumWallet, Bitcoin.com News, The Defiant

Keystone confirms leak of hardware wallet buyers' addresses

Wallet maker Keystone confirmed a leak of customer shipping data: names, contacts, addresses and order details, after unauthorized access to the official site on October 20. Cards and private keys were not exposed.

It is the fourth wallet maker leaked in 2026. Ledger, Trezor and SafePal had similar episodes this year. With name and address in hand, scammers pose as support to extract the recovery phrase and steal the funds.

Sources: @KeystoneWallet, @coinbureau, @Cointelegraph