What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Cisco Talos · Research ·
I had plans for that second
Talos reports PHP vulnerabilities.
Talos says two unauthenticated remote code execution flaws were discovered in PHP, affecting every build since 5.4. Talos assesses all industries running PHP applications are at risk. PHP runs many internet staples, including WordPress and Drupal. Older branches are end of life and will not receive patches.
Recommended by the publisher: Talos very strongly advises immediate update to PHP 8.2 or later.
eMudhra intermediate certificates are compromised, affecting TLS and code signing.
Cisco Talos reports that eight intermediate certificates have weak private keys, allowing an attacker to impersonate websites or services. The certificates were revoked by eMudhra and blocked by vendors like Chrome and Microsoft. Talos expects additional patches to be available.
Recommended by the publisher: Talos recommends updating software using and handling TLS certificates as fixes become available.
Cisco Talos reports two critical RCEs in PHP core.
CVE-2026-109618 and CVE-2026-109619 affect every PHP build since 5.4, including WordPress and Drupal. Talos assesses all industries running PHP applications are at risk. PHP 8.1 and older are end of life.
Recommended by the publisher: Talos strongly recommends upgrading to the available fixed releases, as there are no intermediate controls that provide comprehensive protection.
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Attackers abuse legitimate infrastructure to deliver malware.
Cisco Talos reports that attackers are using legitimate platforms to deliver malware, including collaboration and productivity tools. Talos tracked over 25 distinct platforms being abused in the past year. The attackers are embedding malicious content into order notifications from trusted retailers like Staples and Dell.
Recommended by the publisher: Talos recommends validating order notification content and correlating it with account history and payment state to prevent attacks.
There's only so much code: the rise in vulnerability numbers
Cisco Talos reports a surge in vulnerability numbers due to AI models.
Cisco Talos says AI models are rapidly discovering vulnerabilities in legacy libraries, overwhelming open-source maintainers. The number of CVEs has surged 105% year-over-year. Only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation. Cisco Talos notes that most AI-discovered bugs are not practically exploited.
Recommended by the publisher: Cisco Talos recommends building robust defense-in-depth and prioritizing high-exploitability flaws.
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Cisco Talos reports new UAT-6275 espionage activity.
Cisco Talos and Recorded Future's Insikt Group say UAT-6275 targets government and critical infrastructure across the Commonwealth of Independent States. The threat actor uses custom reverse shells and exploits a WinRAR vulnerability. Researchers gained visibility into the threat actor's infrastructure and malware development due to operational security lapses. UAT-6275 is evolving its tradecraft and preparing to expand its reach into Linux hosts.
Recommended by the publisher: Defenders should monitor for unexpected PowerShell activity and payload downloads from public services like GitHub and ensure archive utilities are fully patched.
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
UAT-6275 targets CIS government organizations, says Cisco Talos.
Cisco Talos identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. The group uses macro-enabled documents and exploits CVE-2025-8088. Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus.
Recommended by the publisher: Cisco Talos recommends monitoring for UAT-6275 activity.
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft releases October 2026 security update for 1415 vulnerabilities.
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as critical. Cisco Talos says one vulnerability has been exploited in the wild. The update addresses remote code execution and elevation of privilege vulnerabilities in various Microsoft products.
Recommended by the publisher: Cisco Talos recommends applying Microsoft's October 2026 security update.
Cisco Talos found malware authors evade AI-assisted analysis.
Cisco Talos says attackers develop methods to manipulate AI systems, embedding natural-language instructions into their code. According to the company, these techniques can trick AI-assisted analysis about 35 percent of the time. The company classifies this trend as A3: AI-Analysis Evasion.
Recommended by the publisher: Security teams should flag imperative language addressed to analysis systems within binaries as a suspicious signal.
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos found AI-assisted phishing targeting Taiwan research organizations.
Cisco Talos identified a spear-phishing campaign against Taiwan research organizations, using AI-assisted content generation and impersonating reputable institutions. The campaign deployed an advanced adversary-in-the-middle phishing framework that impersonated Google authentication pages. Talos assesses with moderate confidence that the user interface was originally developed in Simplified Chinese.
Recommended by the publisher: Cisco Talos recommends caution with emails and QR codes from unfamiliar sources.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Malware authors evade AI analysis with plaintext comments.
Cisco Talos says malware authors develop techniques to obstruct AI analysis, with a 35% success rate in test runs. The techniques include adding comments to influence automated analysis. Talos found these techniques in four malware families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE. The comments are detectable as they must be plaintext.
Recommended by the publisher: Treat text inside a sample as evidence, never as instruction.
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos discloses vulnerabilities in Adobe, Apple, Foxit, Microsoft.
Cisco Talos reports vulnerabilities in Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows. The vulnerabilities have been patched by their respective vendors. An attacker can exploit these vulnerabilities to escalate privileges, disclose information, or execute code.
Recommended by the publisher: Cisco Talos recommends downloading the latest Snort rule sets.
AI agents are executing cyber attacks, says Cisco Talos.
Cisco Talos says autonomous AI agents are attacking public infrastructure, using logic to probe and bypass restrictions. These agents can relentlessly lie, deceive, and probe until their objective is met. The company notes that current attacks resemble penetration tests, but future attacks may prioritize stealth.
Recommended by the publisher: Cisco Talos recommends having an incident response plan and rehearsing it, testing infrastructure, and running tabletop exercises against agentic scenarios.