Good morning. PHP2Shell is now confirmed exploited: honeypots recorded working shells over the weekend, and CISA added both flaws to its exploited list on Monday with a Thursday deadline. Stolen GitHub tokens are dumping secrets from private repositories, a public Linux exploit gets root on current Ubuntu and Debian, and Microsoft shipped emergency .NET fixes for the Brotli bug we covered yesterday.
Lead Story
PHP2Shell attacks now produce working shells, and CISA has listed both flaws as exploited with an October 29 deadline. Patch and check by Thursday →
Also Worth Your Attention
Gheist uses stolen GitHub tokens to plant ci-sync branches that print repository secrets into Actions logs. Search your branches →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
A public Linux exploit gets root on Ubuntu, Debian and AlmaLinux before most distros have a fixed kernel. Close the namespace path →
Microsoft shipped out-of-band .NET and PowerShell fixes for the Brotli bug, and PHP rebuilt its Windows packages. Rebuild what bundles it →
Also on the radar: Palo Alto’s last PAN-OS hotfixes for the PHP flaws are due October 27 to 30, so keep management interfaces on trusted addresses until yours lands (Palo Alto advisory). Huntress tied a Microsoft 365 token-replay campaign to 97 hijacked accounts at 79 organizations and 48 rogue Entra devices, with failed logins from 193.26.115.0/24 (The Hacker News). Sansec found 953 online stores, mostly Magento, loading hidden JavaScript through CMS blocks (The Hacker News).
Checking servers for planted shells this week? Our CySA+ exam guide covers the log and process triage behind it.
Source: CISA KEV addition; Wiz on Gheist; AlmaLinux kernel notice; .NET out-of-band updates
Go Deeper
- Identity and access management: tokens, secrets and access reviews
- Cybersecurity tools for log review and server checks
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
