Infosec bits for 2026 week 43

Heloise Meyer | Oct. 23, 2026, 2:22 p.m.

Cybersecurity News:

Security patches need patches now that attackers have AI [Jessica Lyons, The Register]

FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024 [Jonathan Greig, The Record]

Threats Hidden in Replies: Threat Actors Deliver Malware and Credential Phishing in Email Threads [Kahng An, Cofense]

Authorities disrupt nearly 11,000 cybercrime networks in Africa [Bill Toulas, BleepingComputer]

Vulnerabilities and Patches:

litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader [Sai Likhith, StepSecurity]

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes [Swati Khandelwal, The Hacker News]

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU [Eduard Kovacs, SecurityWeek]

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases [Swati Khandelwal, The Hacker News]

PHP releases emergency fixes for 2 critical vulnerabilities [Greg Otto, Cyberscoop]

Cyberattacks and Breaches:

Decades-Old Windows Utility Powers Modern ClickFix Attack [Elizabeth Montalbano, DarkReading]

Millions of Exploit Attempts Logged Against PHP Servers [Mathew J. Schwartz, Bank Info Security]

Capcom confirms data breach affecting 11.7 million accounts [Bill Toulas, BleepingComputer]

Malware:

StealC Is Back, and This Time It's a RAT [Varonis Threat Labs, Varonis]

Tooling:

New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 [Mirko Zorz, Help Net Security]