PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP requests. Cloudflare researchers observed tens of thousands of exploit attempts within 45 minutes of public disclosure, hundreds of thousands within two hours, and millions by October 22. Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now. — Matthew Prince (@eastdakota) October 22, 2026 As of October 23, Censys counts over 34.4 million PHP services still running vulnerable versions. Governments, hospitals, and schools across Asia, Europe, and North America have preemptively taken services offline rather than wait. Below is an image showing the hosts potentially vulnerable to CVE-2026-109618 and/or CVE-2026-109619. Source Censys Security firms using honeypots report the same pattern: attackers are scanning many servers and trying to exploit the PHP flaws, but no successful remote code execution has been confirmed in real-world attacks. Sophos says this suggests that attackers are also struggling to exploit the vulnerabilities. Even its own security team needed more effort than expected, despite using AI, to develop a working exploit. However, the risk is growing. VulnCheck researchers have developed an exploit that bypasses ASLR, a security feature that randomizes where code is stored in memory. By combining both vulnerabilities, they can use a memory leak to bypass this protection and run code on the target system. The exploit works, even though there is no evidence of widespread use yet. The attempts that have been caught so far are mostly scanning, fingerprinting, and botnet delivery attempts. Cowrai’s analysis of PHP2Shell traffic in the wild found connections to a Mirai variant called Potassium, which contacts a C2 server, checks for an HTTP 200 response, then downloads a Linux executable as a follow-on payload. “The payload, a likely Mirai botnet variant known as Potassium, was not delivered since the exploitation attempt was unsuccessful due to being blocked by Sophos countermeasures.” states the report published by Sophos. “However, analysis of the sample revealed that is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026.” The malware can download additional files and disrupt networks. It contacts a hard-coded command-and-control server, checks that the server responds successfully, and downloads a file designed to run on Linux. If normal address lookup fails, it can use public DNS servers such as Google DNS and Cloudflare DNS. Like other Mirai malware, it can also launch distributed denial-of-service (DDoS) attacks. Arctic Wolf found that both malware samples had Ethereum Name Service (ENS) resolution disabled, meaning the feature was available but not active. “ENS resolution was disabled in both samples, indicating that the capability was present but inactive.” states Arctic Wolf. “If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses.” The botnet’s developers have already added the ability to use ENS to find command-and-control (C2) servers. This could help them keep their infrastructure online and make it harder for authorities to take down their domains, but the feature has not yet been enabled. Sophos blocked the attempted Potassium delivery before it succeeded. But analysis of the sample itself showed it’s a significantly expanded version of the Mirai variant spotted earlier in 2026, with added DDoS capabilities and fallback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup. PHP2Shell is being compared to Log4Shell because it affects a huge number of systems. The flaw is in PHP itself, so it can affect websites, content management systems and shared hosting services. Even a basic WordPress site with no extra plugins is at risk if it uses a vulnerable PHP version. Fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions, including 7.4, 8.0 and 8.1, need fixes provided by their software distributors or an upgrade to a supported version. Cisco Talos notes that scanning for flaws and using public exploit code is easier than building attacks into custom tools. Advanced attackers may still be developing those tools, so administrators should use this time to patch vulnerable systems. “The true impact of this vulnerability will take time to evaluate.” concludes Talos. “These types of vulnerabilities that impact core technologies tend to cascade into other platforms and applications as they evaluate impact and provide associated patching, harkening back to the waves of exploitation that we saw after Log4J.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PHP2Shell)
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement agencies from 21 countries between June 29 and August 31, 2026, targeting online fraud, ransomware, business email compromise (BEC), scams and digital extortion. “One of Africa’s largest cybercrime enforcement operations saw law enforcement agencies from 21 countries arrest 1,462 suspects, disrupt 10,909 malicious networks and recover more than USD 105 million in illicit funds.” reads the agency’s announcement. “Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today’s digital threats. Financial investigations linked criminal activity to losses exceeding USD 385 million. ” The scale of the operation is striking. Investigators identified 65,929 victims, while financial investigations linked the criminal activity to losses exceeding $385 million. The figures highlight how cybercrime continues to generate substantial profits by combining technical capabilities with familiar forms of deception. The results also show why tackling these operations requires more than taking down websites or blocking malicious IP addresses. Investigators need to identify the people behind the infrastructure, follow the money and connect evidence collected across jurisdictions. Uganda saw one of the largest actions in the operation. Authorities broke up two international fraud networks and arrested 365 foreign nationals suspected of running online investment and pension scams targeting people across Asia. Investigators found call centres where staff followed prepared scripts to convince victims to invest through fake trading platforms and websites. The scams targeted people who believed they were making legitimate investments, including pensioners. These cases show how criminal groups combine technology with organized social engineering to deceive victims and steal their money. Source: Interpol – Suspected Scam Call centre in Uganda. In Angola, authorities shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized over 2,000 mining devices and six illegal power stations. The electrical equipment was worth more than $1 million. In Nigeria, investigators arrested a suspect linked to phishing and business email compromise (BEC), which involved stealing software credentials and collecting about 2.1 million email addresses. They also recovered a luxury car suspected of being bought with criminal money. A separate Nigerian investigation traced over $2.4 million linked to an investment scam promoted through messaging apps, with much of the money laundered through cryptocurrency. Authorities also targeted loan app fraud in Tanzania, vehicle import scams in Gabon and arrested 30 suspects in the Republic of Congo. Operation Serengeti III relied on intelligence provided before the enforcement phase. Investigators from 20 African countries and the United States received information about suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity. Private-sector cybersecurity companies also supported the operation, providing threat intelligence, technical analysis and investigative expertise. INTERPOL listed Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta among the participating partners, alongside other organizations. This cooperation matters because criminal infrastructure rarely respects national boundaries. A phishing domain, a compromised account, a fraudulent investment platform and the bank accounts used to move stolen funds may all involve different countries and service providers. Investigators need to connect those elements quickly enough to identify suspects and preserve evidence. INTERPOL’s 2026 African Cyber Threat Assessment Report highlights the growing role of AI in cybercrime as financial losses rise. Criminals can use AI to create convincing messages, improve social engineering and target more victims. While AI does not replace the need for criminal infrastructure or ways to move stolen money, it can make scams easier to repeat and harder for victims to recognize. INTERPOL said several investigations remain active. Authorities are continuing to identify suspects, trace illicit proceeds and analyze digital evidence recovered during the operation. That qualification is important. Arrests and infrastructure disruptions are meaningful enforcement results, but they don’t automatically establish how many criminal organizations have been dismantled permanently, how much of the stolen money will reach victims, or whether other operators will rebuild the disrupted services. “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.” INTERPOL Director of Cybercrime Neal Jetton said. “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Operation Serengeti)
Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials. “Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says. “Environment variables may contain secrets such as API keys or database and registry credentials,” the company clarifies. Railway is a cloud platform for developers to deploy and run applications, APIs, databases, and various backend services. It has around 4.8 million users and hosts more than 16 million services.
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login. Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also exposed. For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them. In an alert today, the gaming company says that passwords for all other registered members have not been exposed and that credit card information remained unaffected. Capcom is a Japanese video game developer and publisher known for franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company has 4,000 employees and an annual revenue of $1.24 billion.
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after they believe the conversation has ended. The flaw affects versions before 2.72.0 of the library RingRTC, which the messaging app uses to provide voice and video calling. It highlights a security problem that deserves attention beyond a single messaging application: ending a call should be an immediate control action, not something that can be delayed by traffic coming from the other participant. According to the technical report published on GitHub, the vulnerability stems from how RingRTC handles events in the finite-state machine (FSM) that manages a call. The application places events in a queue for processing, but a malicious peer can flood that queue with events and prevent the local hang-up operation from being handled in a timely manner. “A local hang-up is not a kill switch: it is just one more event placed at the back of the call’s finite-state-machine event queue. The remote peer is trusted with that queue — there is no rate limit on peer-originated events and no priority lane for hang-up.” reads the technical report published on GitHub, “Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down.” People expect that pressing the hang-up button ends the call and turns off the microphone and camera. But if the system is too busy processing other events, it may delay the command to end the call, leaving the audio or video active longer than expected. The report explains that someone taking part in a call could exploit this weakness by sending enough events to overload the system’s queue. This could stop the other person from ending the call properly, potentially keeping the microphone active and possibly the camera too. The underlying problem is not that Signal’s end-to-end encryption has been broken. Rather, it concerns the handling of call state and the reliable termination of a session. Encryption cannot protect users from every flaw in the software that controls when a communication session begins or ends. The vulnerability concerns RingRTC versions earlier than 2.72.0 and can affect Signal clients that embed a vulnerable build of the library. According to the CSIRT Toscana advisory, the affected application versions are Signal for Android before 8.27.0, Signal for iOS before 8.30.0, and Signal Desktop before 8.29.0. The official RingRTC fix and the comparison between versions 2.71.0 and 2.72.0 document the software changes. Users should install the latest available Signal release for their device rather than relying on the library version alone. The technical report also includes a conceptual Python proof of concept. It models the difference between a queue in which a flood can bury a hang-up event and one in which critical events receive priority. The demonstration is synthetic and offline, with no network activity or real calls, so it illustrates the underlying logic rather than providing a working exploit. This is an important distinction. The fact that the vulnerability has been made public does not mean attackers are already exploiting it. However, because it could expose private conversations, updating Signal promptly is a sensible precaution, especially for people who use it to discuss sensitive matters. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, mobile)
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. Coordinated by Interpol, the operation involved authorities from 21 countries and private partners like Team Cymru, Kaspersky, Group-IB, and Fortinet, in a major crackdown on cybercrime across Africa. The action unrolled between June 29 and August 31 and led to the recovery of more than $105 million in illegal funds. In a press release today, Interpol says that Operation Serengeti III has resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks. The investigation identified 65,929 victims and estimated financial losses at more than $385 million.
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia. “Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.” SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026. SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access. “The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products” Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue. Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive. Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended. “Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “ Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work. The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts. The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems. Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them. CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them. The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ransomware)
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network,
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection. Chrome is also adding a new "suspicious site" warning for pages that show deceptive patterns but haven't reached the confidence level required for its existing full-page red warning. "Suspicious site warnings notify users when a page exhibits deceptive patterns commonly associated with known malicious sites," the company explained. "By tailoring the warning UI in this way, we are able to safely expand our coverage to display a higher volume of protective warnings."
Confirm this action.
Leaving now will discard your changes.