Cipher Security News @CipherSecurityN

5. Eight eMudhra intermediate CA certs revoked after their private keys proved trivially recoverable. bleepingcomputer.com/news/security/… 6. CISA added the Plex2Shell chain, Siemens Software Center and SiteGuard to KEV. First deadlines: today. cisa.gov/news-events/al…

3. Microsoft tied the ConnectWise Cloud Backup compromise to Storm-0940 and its agentic AI tool ARTEX. microsoft.com/en-us/security… 4. SafePay is past 600 victims, per joint advisory AA26-293A. Way in: stolen creds, phishing, edge bugs. cisa.gov/news-events/cy…

The week in exploited bugs and breaches. Short version: attackers kept going for edge devices and software supply chains, and more than one exploit showed up before or alongside the fix. Six stories worth your Friday, with sources in the thread.

If you deploy on Railway, don't wait for the "you were affected" email. Rotate every secret in your env vars now: API keys, DB creds, private registry tokens. Then check those services' own logs for use of the old keys. That's where abuse shows up first.

BleepingComputer @BleepinComputer

23 hours ago

Railway warns devs to rotate secrets after potential breach bleepingcomputer.com/news/security/… bleepingcomputer.com/news/security/…

5 3 19 8K 1

Third exploited VeloCloud Orchestrator flaw since July, and the first that needs a login. Even Enterprise Read Only will do. CVE-2026-114625 (CVSS 9.9) makes it superuser. On-prem fix: 5.2.3.18/6.1.3.10/6.4.2.12. Block 74.82.197[.]86 and 38.54.50[.]151. arista.com/en/support/adv…

Update: today, Oct 23, is the federal KEV deadline for SiteGuard Server Edition CVE-2026-106931 and Plex Media Server CVE-2026-96654/-96656. Plex fixed the chain in 1.43.3. NAS package feeds can lag behind, so check the installed version yourself. forums.plex.tv/t/important-se…

CISA adds 6 exploited flaws to KEV: the four Plex Media Server bugs chained as "Plex2Shell" (CVE-2026-96652, -96654, -96655, -96656), Siemens Software Center CVE-2026-110936 and SiteGuard CVE-2026-106931. First federal deadline: Oct 23. #KEV cisa.gov/news-events/al…

LiteLLM supply-chain compromise: litellm 1.107.0 on PyPI and the v1.107.0/latest Docker images shipped a credential stealer plus an RCE loader (Oct 21). If you pulled it, isolate and rebuild the host, rotate cloud, AI and CI secrets, and pin 1.106.2. github.com/BerriAI/litell…

#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack. welivesecurity.com/en/eset-resear… 1/6

Microsoft ties the ConnectWise Cloud Backup supply-chain compromise to China-aligned Storm-0940, which used the agentic AI pentest framework ARTEX to attempt sign-ins to 2,250+ tenants at 2,900 attempts/min. Review service principal sign-ins. microsoft.com/en-us/security…

🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi

Mass exploitation attempts are hitting PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (CVSSv4 9.2, unauthenticated RCE). Amazon saw a first attempt Oct 17, four days before patches. Update to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. #PHP2Shell securityweek.com/php2shell-expl…