IT Security News Roundup: 2026-10-27 Overnight

IT Security News: Overnight roundup, 2026-10-27

Summary

The overnight window was dominated by the PHP2Shell fallout: two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, drew explainers and were added to CISA's Known Exploited Vulnerabilities catalog, which signals active exploitation and urgent patching. Around them sat a cluster of vulnerability and patch news, including Apple's large October update, Apache Camel fixes, a tempered debate over the Brotli defect, and several flaws in AWS-related MCP tooling. Attackers kept abusing trust, whether through hijacked browser sessions, legitimate signed software used for DLL side-loading, or revived Secure Boot bypass techniques. Meanwhile, real-world impact showed in a New Mexico hospital disruption and a Copenhagen data breach, a reminder that patching speed and basic hygiene still decide outcomes.

1. ESET's WeLiveSecurity gives a short explainer on the two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, and what website owners and IT teams should do to stay safe. It matters because these bugs are now widely discussed and exploited.
2. A newly found Windows remote access trojan called DarkCore is advertised with a browser that reuses stolen Gmail, WhatsApp and other sessions through the victim's own IP address. This could make account takeover look like normal, trusted activity.
3. Apache Camel released fixes for several flaws, including high-severity XXE bugs that could expose local files or reach internal systems. Other issues range from remote code execution to credential theft and failed access checks, so affected users should update.
4. The SANS Internet Storm Center published its daily Stormcast podcast episode for Tuesday, October 27. The source provides no text summary, so the details are only in the audio episode.
5. Three malware campaigns in Brazil and Portugal use fake legal notices, financial documents and invoice pages as lures. They load malicious DLLs through legitimate VLC Media Player and VMware components, so trusted software helps the malware avoid suspicion.
6. Researchers documented a JavaScript loader that waits for a signed-in WordPress administrator to visit a compromised page. It then uses that browser session to install a hidden PHP backdoor, which makes keeping the dashboard open alongside everyday browsing risky.
7. A new bootkit called BlackX revives BlackLotus techniques to bypass Windows Secure Boot. It was used against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026, and investigators link it to APT41 with medium confidence.
8. The University of New Mexico Health System told people not to come to its main Albuquerque hospital and canceled appointments at more than 30 clinics because of a cybersecurity issue. The case shows how quickly an attack can disrupt patient care.
9. A Japanese virtual desktop cloud used for foreign exchange trading was badly breached, and its CEO admitted it had holes the company was slow to fix. The service has reportedly asked to be banned, which shows how costly slow remediation can be.
10. Dark Reading notes that AI model security benchmarks now form a patchwork, each measuring different variables. None gives the whole picture, so organizations still need to test models against their own code and workflows.
11. CyberScoop reports that experts are tempering emergency-level alarm over a critical defect in the widely distributed Brotli open-source library. The flaw prompted an emergency response, but no exploitation has been observed in the wild.
12. A new vulnerability, CVE-2026-85788, was published for the awslabs mysql-mcp-server. The listing offers no further detail, but it adds to a run of flaws in AWS-related MCP server tooling.
13. Apple shipped its October 2026 security updates, fixing 304 vulnerabilities, about a month after its previous release. The count is in line with earlier updates, and users should install the patches promptly.
14. CrowdStrike and Anthropic announced an effort to give critical infrastructure defenders an AI advantage. The source offers no text preview, so the specifics are only in the original post.
15. Europol's Acting Executive Director Jürgen Ebner and Irish Garda Commissioner Justin Kelly opened a gathering of EU law enforcement chiefs. Ebner stressed that organized crime is now digital by default and called for strong national and shared European capabilities.
16. CISA added CVE-2026-109618 (PHP memory corruption) and CVE-2026-109619 (PHP stale internal request-state) to its KEV catalog and updated its PHP alert. Federal agencies must prioritize fixes under BOD 26-04, and CISA urges all organizations to do the same.
17. CVE-2026-87912 and CVE-2026-87913 describe missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and its MCP Server. The listing gives few details, but such gaps could point to buckets the user doesn't control.
18. The University of Copenhagen confirmed that hackers accessed one of its test environments holding personal data of 525,000 people. It shows that non-production systems can still hold sensitive data and need production-grade protection.
19. CVE-2026-85787 covers an incomplete list of disallowed inputs in the SQL validation component of the awslabs postgres-mcp-server. This could let attackers modify data beyond the intended read-only scope.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. PHP2Shell: What to know about two critical PHP flaws
2. New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses
3. Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s
4. ISC Stormcast For Tuesday, October 27th, 2026 https://isc.sans.edu/podcastdetail/10152, (Tue, Oct 27th)
5. Hackers Use VLC Media Player and VMware Tools to Load Malware Through DLL Side-Loading
6. Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors
7. Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware
8. Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
9. Japanese virtual desktop cloud hacked so hard it asks to be banned
10. So Many AI Security Benchmarks, But None Tell the Whole Story
11. Experts temper emergency-level alarms over critical Brotli defect
12. CVE-2026-85788 – Issue with awslabs mysql-mcp-server
13. Apple Patches for October 2026, (Mon, Oct 26th)
14. CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage
15. EU law enforcement chiefs gather to discuss new challenges in EU security
16. CISA Adds Two Known Exploited Vulnerabilities to Catalog
17. CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
18. University of Copenhagen data breach exposes data of 525,000 people
19. CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope