Today on CISO Series…
In todays cybersecurity news…
Hundreds of websites taken offline due to PHP vulnerabilities
Continuing our coverage of the PHP vulnerabilities story, “the European Union, U.S., Japan, Australia, and several European countries have all released warnings locally about the two critical PHP2Shell vulnerabilities, rated 9.2 and 10 and which support up to 70 percent of all websites globally. Some government agencies have taken websites offline in advance of the patch being released, as have some large companies including
Nintendo
.
Sophos
official Don Smith said “the immediate challenge is not just installing a patch but finding and managing every instance where PHP is running,” adding, “security teams should prioritize internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and applying the updates without delay…any vulnerable system that cannot be patched should be isolated from the internet until it can be secured.” In addition, researchers at
Amazon
Threat Intelligence have stated that “attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.”
(The Record and BleepingComputer
ConnectWise breach let Chinese AI spies move in on cloud tenants
Following up on a story we covered on Monday,
Microsoft
says that “China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants.” Now being attributed to the group Storm-0940, the attack “used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments. In some cases, they went from picking a target to gaining privileged cloud access in less than three hours.”
Law enforcement disrupts nearly 11,000 cybercrime networks in Africa
INTERPOL
, working with authorities from 21 countries and with private partners including
Kaspersky
,
Group-IB
, and
Fortinet
, took the reins down in Africa away from nearly 11,000 cybercriminal networks. Named Operation Serengeti III, the takedown targeted business email compromise, ransomware, and online scams and resulted in the arrest of 1,400 people and the recovery of more than $105 million in illegal funds. The groups taken down included two transnational fraud rings in Uganda, illegal cryptocurrency mining centers in Angola, and a large-scale phishing and business email compromise operation in Nigeria.
Railway says intruder may have accessed customer secrets
Platform-as-a-Service (PaaS) provider
Railway
is alerting customers to “anomalous activity” related to systems that contain customer environment variables. The company says that “an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents.” They added that the incident is “likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers.” Customers are now being urged to rotate environment variables, and review service logs for unusual activity.
Big thanks to our sponsor,
ThreatLocker
GitLab warns of new maximum severity code execution vulnerability
GitLab
has released security patches for a CVE-numbered (CVE-2026-110264) maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. GitLab has fixed the vulnerability in GitLab Community Edition (CE) and numerous Enterprise Edition (EE) versions and urges users to patch their instances immediately.
Splunk, SolarWinds release fresh security updates
On Wednesday,
Splunk
delivered security updates for Splunk Enterprise and SOAR “to resolve dozens of security defects, including multiple flaws in third-party packages.” These provided fixes for 16 CVEs in the product’s code. “The update also resolves high-severity information disclosure, improper neutralization, improper resource control, and protection defects.”
SolarWinds
meanwhile, has released fixes for a high-severity bug in Observability.
Lazarus hackers use post-quantum cryptography for malware delivery
Researchers at
Kaspersky
are warning that North Korean hackers are “using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.” Their campaign currently targets South Korean organizations through a complex infection chain that the researchers have named FlashHole. Analysis of the malware showed that the threat actors “used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery.” ML-KEM is a “NIST-approved standard present in multiple software projects including Google Chrome as a way to protect data from ‘hack now decrypt later’ attacks.”
South Carolina officials offer assistance after state capital hit with cyberattack
The city of Columbia, South Carolina is responding to a cyberattack that has shut down several government systems, including the MyColaSC platform used to pay utility bills, report non-emergency issues and access other city services. The attack also knocked out Geographic Information Systems and systems underpinning animal services. No hacking group has taken credit for the incident as of Wednesday, and no mention of ransomware has been made.
Subscribe to Cybersecurity Headlines podcast
Subscribe to Cybersecurity Headlines and all our shows at cisoseries.com/subscribe.
Click Here For The Original Source.
——————————————————–
