Cybersecurity briefing, 2026-10-27

For an AI coding agent, the trust boundary isn't the repository.

• PHP's two RCE flaws move to confirmed exploitation
• Magento loaders evade scans on previously infected stores
• Android Authenticator flaw exposed work accounts to rogue apps
• Worm evades GitHub search and steals cPanel credentials
• Downloads files can persist in Codex and expose Claude tokens
• Dahua Easy4IP leaves cameras reachable behind firewalls
• Arista VeloCloud flaw grants low-privilege users operator access
• Gheist carries GitHub secret theft into private repos and AWS
• Stolen Microsoft 365 tokens opened accounts across 79 organizations
• Apple's October update closes exploited CoreGraphics flaw on iOS 18
• Wasmtime flaws let WebAssembly escape sandboxing
• Microsoft .NET fixes leave bundled apps exposed
• OpenAI compaction flaw moved reasoning between models
• Time4Popcorn updater put millions at risk of elevated code execution

Recent editions

• Monday, October 26, 2026: Downloads files can persist in Codex and expose Claude tokens · 18 stories
• Sunday, October 25, 2026: Collabora backdoors target credential stores as VCO flaws recur · 7 stories
• Saturday, October 24, 2026: EvilTokens uses AI to turn inbox access toward payment fraud · 16 stories
• Friday, October 23, 2026: Ruby regex bugs expose applications beyond GitLab · 19 stories
• Thursday, October 22, 2026: PHP2Shell moves from probes to confirmed shell execution · 18 stories
• Wednesday, October 21, 2026: Cisco's eMudhra review leaves product exposure unresolved · 16 stories
• Tuesday, October 20, 2026: Siemens signed launcher hides a trojanized installer · 15 stories