Wednesday 21 Oct 2026

Reported exploited, not on CISA's list yet

• CVE-2026-109618 PHP: RCE via OOM corruptionPHP Group PHP · Critical 9.2 · Fixed in 8.2.35 · Zero-day reported by 25 outlets, first by Aikido · WAF rule: Cloudflare WAF
• CVE-2026-109619 PHP: RCE via stale global statePHP Group PHP · Critical 9.2 · Fixed in 8.2.35 · Zero-day reported by 23 outlets, first by Aikido · WAF rule: Cloudflare WAF

Supply chain compromises

• Compromised service ConnectWise Cloud Backup apps abused to reach Microsoft 365 tenantsConnectWise Cloud Backup
• Malicious release moveworks-capi-starter 0.0.0, 0.2.0 on PyPI was a malicious releasemoveworks-capi-starter 0.0.0, 0.2.0
• Malicious release journey-test-helloshell 0.2.0 on PyPI was a malicious releasejourney-test-helloshell 0.2.0
• Malicious release zzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6 on RubyGems was a malicious releasezzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6, 0.2.0, 0.1.7, 0.2.1, 0.1.8
• Malicious release @sudobility/indexer_client 0.0.146 on npm was a malicious release@sudobility/indexer_client 0.0.146
• Malicious release @sudobility/shaperouter_client 0.0.14 on npm was a malicious release@sudobility/shaperouter_client 0.0.14
• Malicious release @sudobility/testomniac_client 0.0.131 on npm was a malicious release@sudobility/testomniac_client 0.0.131
• Malicious release @sudobility/wildduck_client 2.3.102 on npm was a malicious release@sudobility/wildduck_client 2.3.102
• Malicious release iterquarry 2.1.1, 2.1.2, 2.1.3 on PyPI was a malicious releaseiterquarry 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1
• Malicious release libseal 1.1.0, 1.1.1, 1.1.2 on PyPI was a malicious releaselibseal 1.1.0, 1.1.1, 1.1.2, 1.1.3
• Malicious release journey-test-hellospy 0.1.1 on PyPI was a malicious releasejourney-test-hellospy 0.1.1
• Malicious release aurenatts 0.1.0 on PyPI was a malicious releaseaurenatts 0.1.0
• Malicious release batchspar 0.1.0 on PyPI was a malicious releasebatchspar 0.1.0
• Malicious release brummatts 0.1.0 on PyPI was a malicious releasebrummatts 0.1.0
• Malicious release codecraze 0.1.0 on PyPI was a malicious releasecodecraze 0.1.0
• Malicious release crenelatts 0.1.0 on PyPI was a malicious releasecrenelatts 0.1.0
• Malicious release dictanovaasr 0.1.0 on PyPI was a malicious releasedictanovaasr 0.1.0
• Malicious release grommatts 0.1.0 on PyPI was a malicious releasegrommatts 0.1.0
• Malicious release melcuratts 0.1.0 on PyPI was a malicious releasemelcuratts 0.1.0
• Malicious release orchestril 0.1.0 on PyPI was a malicious releaseorchestril 0.1.0
• Malicious release phonoviatts 0.1.0 on PyPI was a malicious releasephonoviatts 0.1.0
• Malicious release prosodinetts 0.1.0 on PyPI was a malicious releaseprosodinetts 0.1.0
• Malicious release quillonatts 0.1.0 on PyPI was a malicious releasequillonatts 0.1.0
• Malicious release shellgrip 0.1.0 on PyPI was a malicious releaseshellgrip 0.1.0
• Malicious release solivoxtts 0.1.0 on PyPI was a malicious releasesolivoxtts 0.1.0
• Malicious release tessivatts 0.1.0 on PyPI was a malicious releasetessivatts 0.1.0
• Malicious release vellutts 0.1.0 on PyPI was a malicious releasevellutts 0.1.0
• Malicious release voxilaratts 0.1.0 on PyPI was a malicious releasevoxilaratts 0.1.0
• Malicious release zennittts 0.1.0 on PyPI was a malicious releasezennittts 0.1.0
• Malicious release data-pipeline-testmetest 2.0.1 on npm was a malicious releasedata-pipeline-testmetest 2.0.1
• Malicious release event-emitter-testmetest 1.0.6, 1.0.7, 4.1.0 on npm was a malicious releaseevent-emitter-testmetest 1.0.6, 1.0.7, 4.1.0, 5.0.0
• Malicious release log-sink-testmetest 1.0.1 on npm was a malicious releaselog-sink-testmetest 1.0.1
• Malicious release pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3 on npm was a malicious releasepixel-map-testmetest 0.0.1, 0.0.2, 0.0.3
• Malicious release test-brotli-testmetest 1.0.0 on npm was a malicious releasetest-brotli-testmetest 1.0.0
• Malicious release test-brotli2-testmetest 1.0.0 on npm was a malicious releasetest-brotli2-testmetest 1.0.0

Critical flaws in products attackers have targeted

• CVE-2026-89035 MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication BypassMikroTik RouterOS · Critical 9.1

10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON