Today's cybersecurity landscape highlights significant risks across various platforms, with active exploitation of critical vulnerabilities in PHP and the Brotli compression library demanding immediate attention. Simultaneously, sophisticated social engineering tactics and supply chain attacks continue to pose serious threats to online businesses and developer ecosystems.
Critical PHP2Shell Vulnerabilities Actively ExploitedVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two critical PHP vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are being actively exploited. These flaws, rated 9.2 on the CVSS scale, allow unauthenticated remote code execution, enabling attackers to take full control of affected systems. Multiple industrial vendors are also checking their products for exposure.
Why it matters: If your website or applications run on PHP, it is crucial to apply the latest security updates immediately to prevent attackers from gaining unauthorized access and compromising your systems.
Read more at The Hacker News ↗
Widespread Exploitation of Brotli Compression Flaw (Node2Shell/HTTP2Shell)Vulnerability
A critical flaw in the Brotli compression library, dubbed 'Node2Shell' or 'HTTP2Shell', is triggering emergency patches across multiple platforms including PHP, Node.js, .NET, PowerShell, and Python. This vulnerability allows attackers to corrupt memory and potentially execute arbitrary code, with researchers indicating that 90% of the cloud could be exposed. Microsoft has released urgent .NET updates, and PHP issued a second Windows security update in five days to address this issue.
Why it matters: Since many cloud services and development frameworks use Brotli, ensure all your software dependencies, operating systems, and website components are updated to mitigate the risk of remote code execution.
Read more at BleepingComputer ↗
Over 950 Online Stores Infected with Evasive JavaScript MalwareThreat
A long-running campaign, active since July 2025, has compromised 953 online stores, predominantly those built on Magento. Threat actors inject a small, scanner-evading JavaScript code into CMS blocks, which then serves malicious JavaScript to unsuspecting visitors. This allows for data theft and other malicious activities without immediate detection.
Why it matters: Regularly audit your e-commerce platform's code and installed extensions for unauthorized modifications, especially if using Magento, to protect your customers' data and maintain trust.
Read more at The Hacker News ↗
Microsoft 365 Token-Replay Attacks Compromise 79 OrganizationsThreat
Cybersecurity researchers have uncovered a campaign using adversary-in-the-middle (AiTM) techniques to capture and replay stolen Microsoft 365 sign-in tokens. This enabled attackers to compromise 97 accounts across 79 organizations, gaining access to email accounts and other sensitive data by bypassing multi-factor authentication.
Why it matters: Implement robust endpoint detection and response, and consider passwordless authentication or FIDO2 security keys to defend against token-replay attacks that bypass traditional MFA.
Read more at The Hacker News ↗
IT Support Scams via Microsoft Teams Lead to Malware and RansomwareThreat
Threat actors are exploiting Microsoft Teams' external chat feature to conduct social engineering scams, impersonating IT support staff to deliver malware and ransomware. This recurring pattern involves using consistent throwaway tenants and 'IT support' personas to trick users into installing malicious software.
Why it matters: Educate your employees about phishing and social engineering tactics, especially those leveraging communication platforms like Microsoft Teams, and establish clear protocols for IT support contact and software installation.
Read more at The Hacker News ↗
Gheist Campaign Steals Cloud Secrets via Stolen GitHub TokensThreat
An automated supply chain attack, known as 'Gheist', is utilizing stolen GitHub tokens to inject malicious workflows into repositories. These workflows are designed to print private repository secrets into GitHub Actions logs, which the attackers then download before deleting their traces, impacting private repositories and GitHub Enterprise environments.
Why it matters: Regularly rotate your GitHub tokens and implement strict access controls. Monitor GitHub Actions logs for suspicious activity and educate developers on secure coding practices to prevent token compromise.
Read more at The Hacker News ↗
University of Copenhagen Suffers Data Breach Affecting 525,000Breach
The University of Copenhagen in Denmark has confirmed a data breach where hackers accessed a test environment containing personal data belonging to 525,000 individuals. While the full extent of the compromised data is still being assessed, this incident highlights the risks associated with securing non-production environments.
Why it matters: Ensure that test and development environments are as securely configured as your production systems, isolating them from sensitive data and applying the same robust security measures.
Read more at BleepingComputer ↗
Two Critical Wasmtime Flaws Allow Sandbox EscapesVulnerability
Two critical vulnerabilities in Wasmtime, a WebAssembly runtime, could permit malicious WebAssembly modules to bypass their intended sandbox protections. These flaws require an attacker to compile a controlled module on a vulnerable Wasmtime build, with one specifically impacting ARM64 systems. Patched versions have since been released.
Why it matters: If your applications or services utilize WebAssembly and Wasmtime, update to the latest patched versions immediately to prevent malicious code from breaking out of its isolated environment.
Read more at The Hacker News ↗
AI Agent Tricked into Installing Malware via Local Instruction FileThreat
In a novel attack, a malicious instruction file placed in a developer's Downloads folder attempted to trick an AI coding agent into installing a known-malicious npm package. This incident demonstrates how AI agents' trust in local files can be exploited to facilitate malware installation, blurring the lines between benign text and executable commands.
Why it matters: Exercise extreme caution when using AI coding assistants and ensure they operate in sandboxed environments. Regularly scan and clean your local development directories, especially 'Downloads', to prevent AI agents from executing unintended malicious instructions.
Read more at The Hacker News ↗
Ransomware Disrupts School Districts and Hospital OperationsRansomware
Ransomware attacks have significantly impacted school districts in Richmond and Oneonta, forcing teachers to use paper assignments and causing two-day school closures. Separately, a major New Mexico hospital, the University of New Mexico Health System, was forced to divert patients and close over 30 clinics due to a cybersecurity incident, highlighting the severe operational disruption caused by such attacks.
Why it matters: Small businesses and organizations, especially those in critical sectors like education and healthcare, must implement robust backup and recovery strategies, alongside strong network segmentation, to minimize downtime and data loss from ransomware attacks.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.