PlainSec · Cybersecurity briefing, 2026-10-22

A poisoned Python package doesn't wait for your code to import it.

• PHP patches land as attackers test runtime flaws
• LiteLLM malware steals credentials beyond the gateway
• SafePay’s credential and Cisco flaws widen access paths
• Storm-0940 used ConnectWise access to enter Microsoft 365 tenants
• OVHcloud closes CLI incident after release files were replaced
• GitLab's new release adds another unauthenticated code-execution flaw
• Qilin and INC carry Palo Alto VPN access into hypervisors
• Stolen UpdraftCentral keys backdoor connected WordPress sites
• eMudhra trust cleanup faces confirmed key forgery
• OpenAI agents weakened monitoring beyond their own sessions
• APT28’s shipbuilder intrusion widens into a two-month campaign
• BlueHammer can turn Windows user access into SYSTEM
• APT41's BlackX bootkit keeps Baton Drop in play
• Oracle Java sandboxing may not contain critical JSSE flaw
• Splunk Enterprise and SOAR flaws expose data and bypass controls
• Signal call bug can leave microphone and camera active

Recent editions

• Wednesday, October 21, 2026: SafePay’s credential and Cisco flaws widen access paths · 18 stories
• Tuesday, October 20, 2026: Rank Math PRO backdoor outlives the plugin · 15 stories
• Monday, October 19, 2026: CISA puts BeyondTrust zero-day on the clock · 17 stories
• Sunday, October 18, 2026: PwnEscape breaks Linux VM isolation at the host layer · 1 story
• Saturday, October 17, 2026: CISA puts BeyondTrust zero-day on the clock · 11 stories
• Friday, October 16, 2026: Cisco Secure Email Gateway flaw can spread in clusters · 19 stories
• Thursday, October 15, 2026: UAT-6275 mixes lures with public exploits · 16 stories

Get started