Cybersecurity briefing, 2026-10-22

A poisoned Python package doesn't wait for your code to import it.

• PHP patches land as attackers test runtime flaws
• BlueHammer can turn Windows user access into SYSTEM
• Storm-0940 used ConnectWise access to enter Microsoft 365 tenants
• LiteLLM malware steals credentials beyond the gateway
• OVHcloud closes CLI incident after release files were replaced
• Stolen UpdraftCentral keys backdoor connected WordPress sites
• Qilin and INC carry Palo Alto VPN access into hypervisors
• eMudhra trust cleanup faces confirmed key forgery
• GitLab CI/CD regex bug opens self-managed servers
• DHS ban reaches DeepSeek hidden in agency AI gateways
• APT28’s shipbuilder intrusion widens into a two-month campaign
• SafePay’s credential and Cisco flaws widen access paths
• Microsoft Project Perception security update
• Cyber Partisans hid Vasilek in VMware Tools for two years

Recent editions

• Wednesday, October 21, 2026: SafePay’s credential and Cisco flaws widen access paths · 18 stories
• Tuesday, October 20, 2026: Rank Math PRO backdoor outlives the plugin · 15 stories
• Monday, October 19, 2026: CISA puts BeyondTrust zero-day on the clock · 17 stories
• Sunday, October 18, 2026: PwnEscape breaks Linux VM isolation at the host layer · 1 story
• Saturday, October 17, 2026: CISA puts BeyondTrust zero-day on the clock · 11 stories
• Friday, October 16, 2026: Cisco Secure Email Gateway flaw can spread in clusters · 19 stories
• Thursday, October 15, 2026: UAT-6275 mixes lures with public exploits · 16 stories