Daily Security Intelligence Briefing — October 22, 2026
Tier 1 — Priority Targets (Must-Read)
1. PHP2Shell Emergency Patches Issued for Critical Unauthenticated RCE Flaws Under Active Mass Exploitation
Source & Article Link: CSO Online
Technical Severity / Domain: Web Infrastructure / CVE-2026-109618, CVE-2026-109619 (CVSS 9.2-9.4 Critical)
Why You Must Read This: Two critical unauthenticated remote code execution vulnerabilities in the core PHP engine place up to 70% of the web at immediate risk. Exploitation attempts were observed in honeypots days prior to public disclosure due to a leaked embargo. The flaws allow arbitrary code execution before application logic even runs, enabling immediate server takeover. Active scanning and Mirai-style payload delivery are underway globally.
Recommended Immediate Action: Immediately update PHP runtime installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or deploy vendor WAF mitigations if emergency patching cannot be executed immediately.
2. China-State Hackers Use ARTEX Agentic AI to Attack 2,250+ M365 Tenants via ConnectWise Breach
Source & Article Link: Microsoft Security Blog
Technical Severity / Domain: Cloud Infrastructure / Supply Chain & Nation-State Attack (Mass Cloud Impact)
Why You Must Read This: Threat actor Storm-0940 compromised ConnectWise Cloud Backup application credentials and used the ARTEX agentic AI framework to automate attacks at scale. The campaign breached over 2,250 Microsoft 365 cloud tenants across global enterprise and critical sector environments. By pairing compromised supply-chain credentials with autonomous AI agents, attackers dramatically accelerated recon, privilege escalation, and lateral movement.
Recommended Immediate Action: Revoke and rotate all ConnectWise integration credentials, audit M365 authentication logs for anomalous automated activity, and enforce strict conditional access and MFA across all tenant admin accounts.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. GitLab Fixes Max-Severity Unauthenticated RCE Affecting 12 Years of Releases
Domain: DevSecOps & Software Supply Chain
Subject / Topic Summary: GitLab released urgent security patches for a maximum-severity Regular Expression Compiler vulnerability that allows remote, unauthenticated attackers to execute arbitrary code. The flaw impacts every version of self-managed GitLab dating back to version 7.0 released in 2014. Administrators who patched during the previous week's maintenance window must update again to address this newly identified vector.
Key Technical & Strategic Takeaways: Affects all self-managed GitLab instances running releases from 2014 through October 2026.; Requires no authentication to trigger remote code execution on vulnerable servers.
Essential Direct Quote: GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
Source: BleepingComputer
2. LiteLLM Supply Chain Attack Injects Credential Stealer and Backdoor into PyPI and Docker
Domain: AI Infrastructure & Package Security
Subject / Topic Summary: Popular AI gateway package LiteLLM suffered a supply chain breach after attackers compromised release credentials and published malicious version 1.107.0. The poisoned release contained malware designed to harvest browser, cloud, and AI API credentials, alongside a dormant remote access trojan. PyPI quarantined the package within hours, but organizations that automatically pulled recent updates face potential credential compromise.
Key Technical & Strategic Takeaways: Targeted developer credentials for cloud providers and AI model APIs.; Impacted both PyPI python wheel distribution and official Docker Hub registry images.
Essential Direct Quote: LiteLLM on Wednesday disclosed that threat actors compromised 'multiple independent security controls' to push a malicious version of the Python package containing a credential stealer and a backdoor.
Source: The Hacker News
3. Node.js Releases Security Patches for Brotli Decoder RCE Across All Supported Versions
Domain: Application Runtime Security
Subject / Topic Summary: Node.js released security updates across all active release lines (22.x, 24.x, and 26.x) addressing ten distinct security vulnerabilities. The most critical bug resides in the bundled Brotli decompression module, which can allow remote code execution when handling untrusted compressed inputs. Organizations running Node.js web services should prioritize upgrading runtime versions across build pipelines and production nodes.
Key Technical & Strategic Takeaways: Flaw in bundled Brotli library enables arbitrary code execution via malformed compressed data.; Patches released for Node.js 22.x, 24.x, and 26.x supported release branches.
Essential Direct Quote: The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution.
Source: The Hacker News
4. Critical Signal RingRTC Flaw Allows Continued Audio/Video Streaming After Hangup
Domain: Secure Communications & Endpoint Privacy
Subject / Topic Summary: A critical flaw in Signal's underlying RingRTC library (CVE-2026-113380, CVSS 9.3) can allow a remote peer to continue receiving audio and video feeds after a call is terminated. The issue affects all RingRTC versions prior to 2.72.0 across mobile and desktop applications. Users and enterprise deployments must ensure messaging clients are updated immediately to prevent inadvertent eavesdropping.
Key Technical & Strategic Takeaways: Vulnerability prevents WebRTC media session teardown upon user call termination.; Fixed in RingRTC version 2.72.0 incorporated into current Signal client updates.
Essential Direct Quote: A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up.
Source: Help Net Security
5. 300+ Tor Exit Nodes Hijacked to Intercept Unencrypted SSH and Email Traffic
Domain: Network & Anonymity Security
Subject / Topic Summary: Attackers hijacked over 300 Tor exit nodes after obtaining reused administrative credentials for a Tor management server in late August. The compromised nodes were modified to manipulate network traffic, forcing plaintext email downgrades and redirecting SSH sessions through attacker-controlled servers. The campaign highlights lingering risks surrounding infrastructure credential reuse and unencrypted protocol fallback.
Key Technical & Strategic Takeaways: Attacker gained access via credential reuse on a Tor management server.; Manipulated exit node traffic to downgrade protocol encryption and intercept plaintext credentials.
Essential Direct Quote: Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled.
Source: Ars Technica