CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

thehackernews.com Oct 27, 2026

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

Curated by Shubham · TechCapsules · Oct 27, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency confirmed that two recently patched PHP2Shell vulnerabilities, each rated 9.2 on CVSS, are actively exploited, adding them to its Known Exploited Vulnerabilities catalog. Detection lead Adel Karimi reported successful remote code execution on honeypots on October 24, 2026, producing an 800 KiB cookie dump and a function address used in the payload. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were patched on October 21, 2026, with federal agencies given until October 29 to update. The flaws affect over 32.5 million PHP services worldwide, prompting advisories from vendors and governments.

💡 Why It Matters

· The confirmed exploitation underscores the urgency for immediate patching across the vast PHP ecosystem, where millions of sites remain vulnerable.
· Rapid response is critical to prevent widespread compromise and data loss.

Capsules Cybersecurity

Read full article on thehackernews.com

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server’s TLS implementation failed to enforce certificate revocation when using the OpenSSL backend with mutual‑TLS. Although a revocation list could be loaded, the server never enabled checking, allowing revoked client certificates to authenticate successfully. The flaw affects builds that require client certificates, a trusted CA bundle, issuer checking, and a configured revocation list; Mbed TLS builds are unaffected. GoAhead 6.1.1, released to manufacturers on August 2 2026 and publicly on October 12, patches the issue. Discovered by Sébastien Féry of FoxIO, the vulnerability is tracked as CVE‑2026‑115881 with a vendor‑assigned severity of 9.1. Fix deployment depends on each device maker updating firmware, and no exploitation has been reported. Routers, printers and controllers could remain exposed until updates arrive firmware.

💡 Hundreds of millions of network‑critical devices could stay insecure for months, giving attackers a stealthy path to hijack management interfaces.

thequantuminsider.com · Oct 27

Guest Post: The Next Threat to Encryption May Not Need a Quantum…

Researchers warn that advances in artificial intelligence could make previously theoretical attacks on public‑key cryptography practical, threatening online payment systems. OpenAI announced on 26 October 2026 that its AI disproved the Exponential Time Hypothesis, a long‑standing conjecture about the inherent difficulty of certain computational problems, suggesting new algorithms may avoid exponential growth. While the breakthrough does not instantly break encryption, it shows that mathematical methods, not only quantum computers, might weaken asymmetric schemes. Earlier in July 2026, Anthropic‑assisted researchers demonstrated a faster attack on the signature scheme HAWK, recovering a secret key in a test version after about 60 hours of AI compute. The episode underscores concerns that AI‑driven research could accelerate the discovery of vulnerabilities in both classical and post‑quantum cryptographic protocols.

💡 If AI can routinely uncover shortcuts in hard mathematical problems, the timeline for breaking today’s encryption could shrink dramatically, forcing a rapid shift to newer, AI‑resistant schemes.

thehackernews.com · Oct 27

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth…

Ukraine’s CERT-UA warned that attackers exploited Dahua IP cameras by brute‑forcing predictable serial numbers and leveraging weak passwords or firmware flaws (CVE‑2021‑33044/45). The attacks used the Easy4IP P2P platform, allowing remote access to video streams, device configuration, and creation of third‑party accounts. Over 14,500 cameras were compromised, with nearly 2,000 infected devices receiving a persistent backdoor account that survives password changes and factory resets. The incident mirrors broader campaigns targeting Ukrainian and European surveillance equipment.

💡 The breach exposes a widespread vulnerability in consumer‑grade security cameras, enabling covert surveillance and data exfiltration on a national scale. It underscores the urgent need for manufacturers to secure default credentials and update firmware to protect critical infrastructure.

gamesradar.com · Oct 27

Sony reportedly investigating as PS5 users report hackers posing as children being…

Sony is investigating a security flaw affecting PlayStation 5 users, where hackers add unauthorized “child” accounts to PlayStation Network profiles. The exploit bypasses passwords and two‑factor authentication, allowing attackers to view personal data and make purchases with linked payment methods. Affected users report difficulty removing these child accounts, as Sony’s family‑management system only permits removal of adult members. The issue has been reported mainly in Japan but is not limited to that region. Sony urges users to review family settings and enable two‑factor authentication.

💡 The breach exposes a critical gap in Sony’s account protection, enabling unauthorized financial activity and data access. It underscores the need for robust family‑account controls to prevent similar exploits.

thehackernews.com · Oct 26

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers report a widespread social‑engineering campaign that exploits Microsoft Teams’ external chat feature to impersonate IT support and deliver malware. Attackers create throwaway Microsoft 365 tenants, often using the .onmicrosoft.com domain or paid .top TLDs, and display names that mimic legitimate help desks. Victims receive mass email “newsletter” spam, then a Teams message offering urgent assistance, leading to remote‑access tools such as Quick Assist or TeamViewer. The remote session installs backdoors, harvests Active Directory data, and deploys Chaos ransomware.

💡 The attacks reveal how attackers turn a trusted collaboration platform into a low‑effort initial‑access vector, bypassing traditional security controls and forcing organizations to scrutinize external Teams connections.

thehackernews.com · Oct 26

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

An unknown threat actor has infected 953 online stores, predominantly Magento, with malicious JavaScript loaders that evade security scanners. The campaign, active since July 2025, injects code into CMS blocks, delivering payloads only to real shoppers while filtering out bots. Five domains, including deepveindrilling[.]com, host the loaders, which store code in localStorage for repeated execution. Infections stem from PolyShell (CVE‑2026‑48356) and SessionReaper (CVE‑2025‑54236) exploits, with some sites adding rogue admin accounts. Store owners are urged to audit CMS tables, update patches, and enforce strong passwords.

💡 The attack demonstrates how sophisticated malware can bypass automated defenses, exposing millions of shoppers to hidden threats. It underscores the urgency for e‑commerce platforms to harden CMS integrity and patch critical vulnerabilities.