• 27 Oct 2026
  One giant patch day macOS / iOS

  Apple ships 27.2 updates fixing 329 flaws across iPhone, iPad and Mac

  Apple's October 26 releases — iOS 27.2, macOS 27.2 and matching updates for Watch, TV and Vision Pro — patch at least 329 distinct vulnerabilities, while older lines get 26.7.2 and 18.7.11 so aging devices are covered too. The batch carries one warning worth acting on: Apple says a CoreGraphics flaw, CVE-2026-86950, may have been used in a highly sophisticated attack against specific people on iOS versions before 27. Apple reporting.

• 27 Oct 2026
  Federal deadline: Oct 29

  CISA adds PHP2Shell flaws to KEV — federal agencies must patch by Oct 29

  CISA confirmed active exploitation of the two PHP2Shell remote-code flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2, and ordered federal civilian agencies to fix them by October 29 and check for prior compromise. The move follows honeypot evidence of working remote code execution on October 24, and with more than 32 million PHP services still on affected versions, the warning reaches well beyond government networks. The Hacker News reporting.

• 27 Oct 2026
  Hospitals diverted

  Cyber incident forces New Mexico's largest hospital system to divert patients

  The University of New Mexico Health System told patients to stay away from its main Albuquerque hospital on Monday and cancelled appointments at more than 30 clinics, leaving the state without its only Level 1 trauma center as ambulances were sent elsewhere. Staff reported messages appearing on their computers claiming data had been stolen, the FBI is assisting, and operations only began resuming in phases later in the day. SecurityWeek reporting.

• 27 Oct 2026
  The patch that keeps spreading

  Brotli flaw reaches PHP Windows builds — and a first exploitation attempt is spotted

  PHP rebuilt its Windows packages on October 26 to bundle the fixed Brotli 1.2.1 decoder, because the compression flaw behind Node2Shell can be reached through PHP's cURL extension when automatic response decompression is switched on. The same day, threat researchers reported spotting an exploitation attempt against Node.js built from public proof-of-concept code — a reminder to hunt for every bundled copy of the decoder, not just the headline product. Tenable reporting.

• 26 Oct 2026
  Confirmed, not just probed

  PHP2Shell exploitation confirmed in the wild

  Honeypot evidence now shows the PHP2Shell flaws being used for real remote code execution, not just crashes or probes: a decoded cookie dump and a follow-up shell command landed about 1.6 milliseconds apart on an Apache mod_php host. Until now every observed attempt had failed, which is why this confirmation changes the urgency for anyone still unpatched. BleepingComputer reporting.

• 26 Oct 2026
  One device is enough

  Unpatched Tailscale SSH flaws let one hacked device reach root across the tailnet

  A researcher's Tailworm report describes 11 unpatched flaws in Tailscale SSH: with port forwarding on, an attacker holding one permitted device can abuse root-run socket forwarding to reach root on other servers, hop by hop, and even mint an enrolment key on networks without Tailnet Lock. No CVE, bulletin, or fixed release exists yet, and Tailscale says it is working on fixes. The Hacker News reporting.

• 26 Oct 2026
  The logs gave it away

  Gheist campaign steals private repo secrets with stolen GitHub tokens

  Wiz tracked an automated campaign that feeds stolen GitHub tokens into a tool planting a sync-check workflow on ci-sync- branches, dumping every reachable secret into Actions logs in base32 to slip past masking, then downloading the logs and deleting the run. More than 13,500 branches across 850-plus accounts were recovered, and private repositories and GitHub Enterprise Server are the exposed ones — GitHub's approval gate only covers public repos. The Hacker News reporting.

• 26 Oct 2026
  MFA passed, session stolen

  Stolen Microsoft 365 session tokens replayed into 97 accounts at 79 organizations

  Huntress traced a token-spraying campaign that never guessed a password: adversary-in-the-middle relays captured the post-MFA session token, then replayed it from rented hosting, producing 497 successful sign-ins against 200,000-plus failed attempts between July and September. Attackers registered 48 rogue Entra devices and planted hidden inbox rules, so a password reset alone does not clean it up. The Hacker News reporting.

• 26 Oct 2026
  One setting holds the line

  PHP's third flaw is unpatched — but one config line stops it

  PHP disclosed a third remote code execution vector, CVE-2026-115560, that the October 21 PHP2Shell patches do not fix — but it only bites when an app switches its session serializer at runtime and leaves upload progress enabled. Until the next regular release ships a fix, PHP says setting session.upload_progress.enabled=0 fully protects against it, and anyone who applied that mitigation last week needs no further action. Infosecurity Magazine reporting.

Live feed holds the current week only — older stories roll off as each new week begins.