Attackers used stolen Microsoft 365 sign-in tokens to compromise 97 accounts at 79 organizations, bypassing repeat MFA checks, according to Huntress. They also registered rogue devices and replaced victims’ MFA methods to keep access after the initial phishing attack.
The PHP2Shell flaws put backend servers, rather than phones, at risk: Palo Alto Networks confirmed affected management interfaces, while NowSecure found 426 mobile apps connecting to servers reporting potentially vulnerable PHP versions.
Those version reports do not establish whether the servers are exploitable or patched; Palo Alto reported no known exploitation against its products and scheduled its first hotfixes for October 26.
Shared software and network infrastructure account for several other major fixes: HTTP2Shell reaches beyond web traffic into .NET, FFmpeg, ClickHouse and Apache Arrow, while HPE and Cisco patched flaws that allow device takeover or root command execution.
The connection is where access leads: a stolen session can keep an attacker inside an account, and a flaw in a backend or network device can expose systems beyond a single app.
NowSecure identified 426 Android and iOS apps connecting to servers reporting PHP versions potentially affected by PHP2Shell flaws. Patched on October 21, CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution on affected backend servers, not users’ phones. Reported versions do not confirm exploitability or patch status; 170 apps contacted servers reporting end-of-life PHP versions.
Attackers replayed stolen Microsoft 365 sign-in tokens to compromise 97 accounts at 79 organizations between July 14 and September 22, 2026, according to Huntress. The campaign used adversary-in-the-middle phishing to capture authenticated sessions and avoid repeat MFA checks. Attackers also registered 48 rogue Entra devices and replaced victims’ MFA methods in at least 19 organizations to maintain access.
The HTTP2Shell Brotli decoder flaw, CVE-2026-111497, affects .NET, FFmpeg, ClickHouse and Apache Arrow, extending beyond Node.js and web traffic. JFrog researchers triggered crashes in .NET and FFmpeg, stopped a ClickHouse server with a crafted 23 MB request, and caused an endless decoding loop in Arrow with 534 bytes. Microsoft began rolling out fixes; ClickHouse and Arrow lacked patched releases at publication.
Microsoft patched an Authenticator for Android flaw that let malicious apps with no declared permissions steal tokens on devices with a signed-in work account. CVE-2026-80097, rated CVSS 8.6, allowed apps to impersonate trusted Microsoft clients and obtain tokens without user approval, potentially exposing mail, files and calendars. Microsoft fixed the flaw in version 6.2606.4246, released in July 2026.
Researcher Erica Windisch reported Tailscale SSH flaws that let a compromised device gain root access on other servers in lab tests involving Tailscale 1.104.2 and headscale 0.29.5. The Tailworm report described 11 findings, including Unix socket forwarding that used root privileges. Tailscale had not confirmed the findings or published a security bulletin, CVE or fixed version as of October 25.
Microsoft plans to add AI phishing detection to Teams that analyzes conversation context, mainly in first-contact chats with external users, to identify scams without malicious links or attachments. Targeted Release is scheduled for November 2026, followed by worldwide general availability in December. Detection may initially run silently while Microsoft validates its accuracy before displaying warnings.
Two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affect management interfaces in PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 on Palo Alto Networks firewalls and Panorama systems. The company reports no known exploitation against its products and plans the first hotfixes for October 26. Cortex XCORE SaaS and WildFire Cloud received fixes October 21 and 22, respectively.
The FCC blocked a wireless video transmitter and a dashboard camera from the U.S. market because they contain surveillance chips made by Huawei subsidiary HiSilicon. The bans are the first under rules that took effect October 13 barring devices with smart components from companies on the agency’s national security covered list.
The New York Knicks organization tested employees with a phishing email in late September that promised free championship rings and asked them to click a link to choose between two designs. Madison Square Garden employees who clicked the link had to attend a mandatory cybersecurity class, The New York Times reported, citing team sources.
Okta disclosed a critical flaw in Access Gateway versions before 2026.10.2 that lets authenticated administrators execute system commands through crafted configuration values in the Admin Console. Tracked as CVE-2026-115547 and rated CVSS 9.1, the flaw runs commands under the OAG service account, not confirmed root access. Okta fixed the issue in version 2026.10.2 and reported no active exploitation.
HPE patched vulnerabilities in Aruba Networking AOS-8 and AOS-10 software affecting Mobility Conductors, Controllers, Gateways and access points, including flaws that allow device takeover without authentication. Eight CVE entries received CVSS scores of 10.0; CVE-2026-79850 allows unauthenticated attackers to execute commands as root on AOS-8. HPE reported no known public discussion or exploit code when it released the October 22 advisory.
Cisco patched CVE-2026-76466, a critical flaw in clustered Expressway-C and Expressway-E devices running X15.5.3 or earlier that allows remote attackers to execute operating system commands as root. Exploitation requires specific persistent cookies and network access to the device’s database service. X15.5.20 is the first fixed release; Cisco reported no known malicious use at publication.