{"apiVersion":"v1","generatedAt":"2026-10-25T04:22:21Z","pulse":{"slug":"cybersecurity","name":"Cybersecurity Pulse","description":"Breaches, exploits and security research as reported on X.","sections":["Breaches & Attacks","Vulnerabilities & Exploits","Research & Advisories"],"itemCount":14,"latestEditionItemCount":2,"lastEditionAt":"2026-10-25T03:54:00Z","feedUrl":"https://presto-ferry-g7bz.here.now/feeds/cybersecurity.xml","itemsUrl":"https://presto-ferry-g7bz.here.now/api/v1/pulses/cybersecurity.json"},"count":14,"items":[{"id":"135cfe1adaf30204","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2): a Mirai botnet joins the attempts and VulnCheck builds an ASLR bypass, but still no confirmed compromise","url":"https://x.com/SecurityWeek/status/2114202288826855490","synopsis":"SecurityWeek's roundup says Sophos, Arctic Wolf and Hunt.io have tied PHP2Shell exploitation attempts to a Mirai-derived botnet called Potassium, though the attempts they saw were blocked or never fetched the malware, and Sophos walked back an earlier report of a successful hit. VulnCheck says it has an exploit for CVE-2026-109618 that defeats ASLR on x86-64 production setups with error display off (offered only to its paying customers), while Sansec and SOCRadar say public exploits fail against default PHP configurations. The bigger worry is patch lag: Qualys finds about 71% of PHP instances on end-of-life 5.4 through 8.1, and CISA's updated alert says to take systems that can't be updated offline until they're patched.","also":["https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","https://x.com/CISAgov/status/2113984287481716741","https://x.com/arekfurt/status/2114008827636937185"],"section":"Vulnerabilities & Exploits","publishedAt":"2026-10-25T03:54:00Z","firstSeenAt":"2026-10-25T04:22:21Z","editionAt":"2026-10-25T03:54:00Z","rank":1},{"id":"f3af470aa733c857","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Oracle pulls eMudhra and Comodo AAA root certificates from Java in a second security alert (CVE-2026-114820, CVSS 9.1)","url":"https://x.com/DailyDarkWeb/status/2114192515737727184","synopsis":"After its Oct 21 alert (CVE-2026-91403) distrusted the compromised eMudhra intermediate certificates, Oracle's Oct 24 alert removes the emSign ECC Root CA - G3, emSign Root CA - G1 and G2, and Sectigo-owned Comodo AAA Certificate Services roots from the JDK cacerts keystore. Affected builds include Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2 plus GraalVM, with fixes in the .0.3 baselines and 8u511-b33. No exploitation has been reported and dropping the Comodo root doesn't mean its key was compromised, but teams that only patched for the first alert need to update again and test anything that still chains to these roots.","also":["https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"],"section":"Vulnerabilities & Exploits","publishedAt":"2026-10-25T03:54:00Z","firstSeenAt":"2026-10-25T04:22:21Z","editionAt":"2026-10-25T03:54:00Z","rank":2},{"id":"f1e5b9371eb25d5f","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Researcher drops three unpatched bugs in the Element Matrix client, billed as a remote 0-day","url":"https://x.com/abraxas_null/status/2114188048191893843","synopsis":"Researcher abraxas_null published GitHub proof-of-concepts and write-ups for three issues in Element Web and Desktop: a logout-CSRF style \"fragment guest wipe\" that destroys a user's session after one click, a Windows-only drive-letter path trick that escapes the desktop app's asar sandbox to read local files (it needs a renderer XSS or DevTools first), and a click-to-run javascript: menu link in Univention's ICS integration that can lead to Matrix account takeover. No CVEs or severity scores are assigned yet and Element hasn't responded publicly, so treat the \"remote 0-day\" label as the researcher's own; the remote pieces still need a user click. Organizations running Element, especially alongside Univention, should watch for a patch.","also":["https://abraxaslabs.tech/research/element-fragment-guest","https://github.com/abraxas/element-fragment-guest"],"section":"Vulnerabilities & Exploits","publishedAt":"2026-10-25T02:56:00Z","firstSeenAt":"2026-10-25T03:26:59Z","editionAt":"2026-10-25T02:56:00Z","rank":1},{"id":"15e81ae9a33348fb","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Japan's Treasure Factory confirms 746,277 customer emails stolen through a database flaw","url":"https://x.com/DailyDarkWeb/status/2114177417510113408","synopsis":"The Tokyo-listed reuse retailer says an attacker exploited a database access vulnerability in its pickup and moving booking system on Oct 20 and took data before the system was cut off: 746,277 customer email addresses (11 with names and addresses), about 750 partner and staff names and emails, and 1,000 device records. The company says no card or payment data was involved. It's the group's second incident since its Kindal unit's phishing breach in August, so affected customers should expect targeted phishing.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T02:56:00Z","firstSeenAt":"2026-10-25T03:26:59Z","editionAt":"2026-10-25T02:56:00Z","rank":2},{"id":"9d7f03da24c2c164","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"WHITEARMOR ransomware group claims Chinese electronics giant Hisense","url":"https://x.com/FalconFeedsio/status/2114184603317731579","synopsis":"FalconFeeds reports that the WHITEARMOR group has listed Hisense, the China-based TV and home appliance maker, as a victim and says it will publish the stolen data within 29 to 30 days. Hisense hasn't commented, and the group hasn't said how much data it took, so the claim is unverified. A leak from a manufacturer this size could expose supplier, dealer and customer-service records worldwide.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T02:56:00Z","firstSeenAt":"2026-10-25T03:26:59Z","editionAt":"2026-10-25T02:56:00Z","rank":3},{"id":"884df205c5cd4c62","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Defender tip: most shops aren't watching WSL, and Defender for Endpoint needs a plug-in to see it","url":"https://x.com/NathanMcNulty/status/2114176035789148475","synopsis":"Microsoft security MVP Nathan McNulty warns that most organizations don't monitor the Windows Subsystem for Linux, which gives attackers a quiet Linux environment on Windows machines. Teams using Microsoft Defender for Endpoint should deploy its WSL plug-in to get visibility; he notes it can take a while to show up in the portal and provides telemetry only, with no antivirus or response actions inside WSL.","also":[],"section":"Research & Advisories","publishedAt":"2026-10-25T02:56:00Z","firstSeenAt":"2026-10-25T03:26:59Z","editionAt":"2026-10-25T02:56:00Z","rank":4},{"id":"99fa7b8bae429416","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Plex2Shell: unauthenticated remote code execution chain in Plex Media Server, exploit now public (CVSS 9.8)","url":"https://x.com/GrahamHelton3/status/2114159117346468338","synopsis":"Researcher zmain's write-up chains four bugs (CVE-2026-96652, -96654, -96655 and -96656) to go from an internet request carrying a junk token to code execution as the plex user: a self-SSRF in the companion /player endpoints reaches a loopback-only plugin API, a sloppy prefix check leaks the owner's admin token to an attacker's host, and the transcoder is abused to write and load a malicious shared library. Plex got the report in July, paid a bounty and shipped fixes before the Oct 16 disclosure, and the proof-of-concept code is now on GitHub. Anyone exposing Plex on port 32400 to the internet should confirm the server is fully updated.","also":["https://zmain.info/blog/plex2shell","https://github.com/code-zm/plex2shell"],"section":"Vulnerabilities & Exploits","publishedAt":"2026-10-25T01:56:00Z","firstSeenAt":"2026-10-25T02:21:23Z","editionAt":"2026-10-25T01:56:00Z","rank":1},{"id":"2a6e5939012a084d","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"PHP2Shell exploit shown working through Google Cloud Run's front-end proxy","url":"https://x.com/LiveOverflow/status/2114160386899583396","synopsis":"LiveOverflow had an AI agent attack a PHP app on Cloud Run, where every request first passes through Google's front-end reverse proxy, and posted video of the PHP2Shell remote code execution still landing. That undercuts the hope that a managed proxy or load balancer blunts the bug, so PHP deployments behind one still need the fix. Meanwhile @mmaunder is keeping a running list of in-the-wild exploitation claims that were later corrected or walked back.","also":["https://x.com/mmaunder/status/2114084518701441340"],"section":"Vulnerabilities & Exploits","publishedAt":"2026-10-25T01:56:00Z","firstSeenAt":"2026-10-25T02:21:23Z","editionAt":"2026-10-25T01:56:00Z","rank":2},{"id":"32cc3d64c83263f7","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Anubis ransomware claims U.S. funeral provider Newcomer Cremations, Funerals & Receptions","url":"https://x.com/FalconFeedsio/status/2114170228129353743","synopsis":"FalconFeeds reports that the Anubis group has listed Newcomer, a U.S. funeral services company (the post links its Dayton website), as a victim and claims 289 GB of data. The company hasn't commented and the claim isn't verified. Funeral-home records can include family contact details, death records and payment information, which make grieving relatives easy targets for follow-up scams.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T01:56:00Z","firstSeenAt":"2026-10-25T02:21:23Z","editionAt":"2026-10-25T01:56:00Z","rank":3},{"id":"a76d3b24a265aab0","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Hacker claims 1.5 TB breach of Kazakhstan's Ministry of Internal Affairs","url":"https://x.com/DailyDarkWeb/status/2114146475894583374","synopsis":"A threat actor on an underground forum says it got into the ministry's central databases through unpatched Windows systems and took about 1.5 TB, including scans of national ID cards and passports, driving licence and vehicle registration data with VINs, disability certificates, medical records, and property documents. The claim hasn't been independently verified. If it's real, an interior-ministry identity and vehicle dataset is prime material for identity fraud, SIM swaps, and phishing that quotes people's real ID details.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T00:49:00Z","firstSeenAt":null,"editionAt":"2026-10-25T00:49:00Z","rank":1},{"id":"f4f4d2774decaed4","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Seller offers 905,000 French vehicle registration records tied to owners' contact details","url":"https://x.com/DarkWebInformer/status/2114149277085704493","synopsis":"An actor called ChimeraZ is selling a 175 MB dataset of 905,097 records that link 847,064 unique license plates to names, home addresses, 506,003 email addresses, and 474,906 phone numbers. They released 1,000 sample records but are holding back the name of the affected website until its alleged vulnerabilities are fixed, and are teasing a second batch of about 2 million plates. The claims are unverified.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T00:49:00Z","firstSeenAt":null,"editionAt":"2026-10-25T00:49:00Z","rank":2},{"id":"f56f82a3cb6f7c56","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Alleged Mondial Relay database with 570,000 parcel records leaked for free","url":"https://x.com/DailyDarkWeb/status/2114147398398222589","synopsis":"A threat actor released what it says is a 457 MB database from the French parcel and pickup-point network Mondial Relay, with recipient names, postal addresses, emails, phone numbers, shipment and order numbers, and full tracking events, with sample records dated September 2025. It hasn't been verified. Real tracking numbers paired with phone numbers make convincing fake redelivery-fee texts, so Mondial Relay customers should ignore any message asking them to pay to release a parcel.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T00:49:00Z","firstSeenAt":null,"editionAt":"2026-10-25T00:49:00Z","rank":3},{"id":"e42d2f43d4aa2583","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Cloak ransomware lists Swiss medical center Medi Porta, claims 87 GB of data","url":"https://x.com/FalconFeedsio/status/2114151595000955297","synopsis":"The Cloak ransomware group added Medi Porta, a medical center in Chur, Switzerland, to its leak site today and claims to have taken 87 GB of data. The post doesn't say what kind of records are involved, and Medi Porta hasn't commented. Healthcare data in a ransomware leak usually means patient records, so this one is worth watching for confirmation.","also":[],"section":"Breaches & Attacks","publishedAt":"2026-10-25T00:49:00Z","firstSeenAt":null,"editionAt":"2026-10-25T00:49:00Z","rank":4},{"id":"a963d5bec6508571","pulse":"cybersecurity","pulseName":"Cybersecurity Pulse","title":"Anthropic: Claude formally proved security properties in 123 open-source libraries and found long-hidden bugs","url":"https://x.com/AISecHub/status/2114154690086621461","synopsis":"AISecHub flagged Anthropic's new research post, which says Claude formally proved security properties in the compiled code of 123 open-source libraries and, along the way, found bugs that had gone undetected for years. The shared post is only the link, so details on which libraries and bugs are in Anthropic's write-up. It's another sign that AI-assisted formal verification is becoming a practical bug-hunting tool, after Nebu Security's similar V8 finding earlier this week.","also":["https://www.anthropic.com/research/formal-verification"],"section":"Research & Advisories","publishedAt":"2026-10-25T00:49:00Z","firstSeenAt":null,"editionAt":"2026-10-25T00:49:00Z","rank":5}]}