Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Tue, Oct 27.
Back to the latest brief

Apple extended patches for an actively exploited flaw to older devices, while CISA confirmed exploitation of two PHP2Shell vulnerabilities.

Cybersecurity6 items

Australia also reported disrupting a criminal's access to 180,000 Amadey-infected computers.

New5

Vulnerabilities

Apple extends exploited CoreGraphics fix to older iPhones and iPads

Apple backported fixes for CVE-2026-86950, an actively exploited CoreGraphics vulnerability rated 8.8, to older iPhones and iPads. Processing a maliciously crafted file could trigger arbitrary code execution; Apple's October update release addressed 304 vulnerabilities overall.

Why it matters: Older devices now have patches available for a flaw already used in attacks, making update coverage an immediate priority.

Breaches & attacks

Australia cuts Amadey operator's access to 180,000 infected computers

The Australian Signals Directorate said its operators accessed a criminal's Amadey backend and disconnected its controller from 180,000 infected computers worldwide. The disruption prevented that criminal from accessing or stealing data from those machines.

Why it matters: The operation interrupts access at substantial scale, though the report does not establish that the infected computers were cleaned.

Threat research

Ongoing campaign uses external Teams chats for rapid malware delivery

A wide-scale, ongoing social engineering campaign combines mail bombing with external Teams chats to deliver malware in 15 minutes. The activity might be tied to the Black Basta ransomware gang.

Why it matters: The campaign makes external collaboration channels a relevant exposure for defenders investigating email floods and suspicious support approaches.

Threat research

Aokigahara stealer targets developer keyrings and AI assistants

The Aokigahara information stealer targets developer keyrings and AI assistants. Its focus on AI tools can expose AI sessions, sensitive business data and developer infrastructure from a single compromised endpoint.

Why it matters: AI assistant sessions expand the sensitive material attackers can collect from compromised developer machines.

Threat research

Google compares BigSleep and Fuzzilli vulnerability discovery in V8

Project Zero compared Google's LLM-based BigSleep system with the Fuzzilli JavaScript engine fuzzer. Over six months, BigSleep found 45 vulnerabilities versus Fuzzilli's 37, with a reported 25% overlap in the specific bugs found.

Why it matters: The limited overlap suggests AI-based discovery and conventional fuzzing can provide complementary coverage rather than replace one another.

Follow-ups1

VulnerabilitiesFollows up on Fri, Oct 23:PHP2Shell exploitation begins as researchers examine exposure and patching challenges

CISA confirms active exploitation of two PHP2Shell vulnerabilities

CISA added two recently patched PHP2Shell flaws to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Both vulnerabilities carry CVSS scores of 9.2 and enable unauthenticated remote code execution on affected deployments.

Why it matters: Official confirmation strengthens the case for prioritizing remediation of affected PHP deployments.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1