Mirai botnet operators target PHP2Shell.

Summary

By the N2K CyberWire staff

Mirai botnet operators target PHP2Shell.

Mirai botnet operators have joined a host of threat actors targeting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), though researchers have not yet observed evidence of successful compromises, SecurityWeek reports. Arctic Wolf, Hunt.io, and Sophos say attackers are targeting the flaws to deploy an “updated and significantly expanded version” of the Mirai variant “Potassium,” but the attempts have so far been unsuccessful.

See attack paths across AWS, Okta, GitHub, and more.

BloodHound Enterprise extends attack path management across your hybrid environment, mapping how identities, permissions, and trust connect across AWS, cloud, and identity providers so teams can find and break the paths that reach critical assets. Try BloodHound Enterprise today.

HPE patches eight maximum-severity flaws in ArubaOS.

HPE has issued fixes for eight maximum-severity vulnerabilities in the Aruba Operating System (ArubaOS) used on its enterprise wireless infrastructure, BleepingComputer reports. Unprivileged threat actors can exploit the flaws remotely in low-complexity attacks that don't require user interaction.

No exploits or public discussion of the flaws have been observed in the wild, but HPE says customers are “strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.”

Where cyber leaders come together to turn challenges into action.

The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.

Quest Diagnostics discloses a breach.

US lab testing giant Quest Diagnostics has disclosed a disruptive cyberattack that likely resulted in data theft, the Record reports. The company stated, “We have identified an incident involving unauthorized access to our Quanum Lab Services Manager (LSM) system, which certain clients use to place test orders, receive and look-up results. Upon discovery of the incident, we paused access to the system, and we are continuing to investigate the incident. Our core business operations are not impacted and remain up and running.”

Quest believes the exposed data included patient medical information and PII, but the company is still working to determine the scope of the attack. Quest noted that the breach did not involve the recently disclosed PHP vulnerabilities.

Attacks, Threats, and Vulnerabilities

AISLE Found Compromised LiteLLM Package 3 Minutes After Release (AISLE) AISLE’s dependency firewall caught a credential stealer with persistence in the wheels of LiteLLM, the popular Python package, just 3 minutes and 14 seconds after it was released.

Capcom Confirms Data Breach Exposed Users’ Personal Information (Infosecurity Magazine) Japanese video games giant Capcom confirmed unauthorized access to its online account system

Developer platform Railway urges 'all users' to revoke secret keys after cyberattack (TechCrunch) The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.

Trends

Chris Krebs on AI discovering cyber vulnerabilities: It'll get worse before it gets better (CNBC) Chris Krebs, The Krebs Group founder and former CISA director, joins 'Squawk Box' to discuss concerns around vulnerabilities in servers that host sites coded in PHP, the world’s most popular server programming language.

Marketplace

eMudhra to Exit global SSL/TLS Certificate Business (eMudhra) eMudhra Limited (BSE: 543533 | NSE: EMUDHRA), a global digital trust company, today announced that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business.

Technologies, Techniques, and Standards

php Observation Footprint (BitSight) Bitsight's Groma scanning engine maintains a continuous global survey of the public-facing Internet.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Cyber Innovation Conference (Washington, DC, USA, Oct 26 - 27, 2026) The Cyber Innovation Conference brings together 600+ cybersecurity leaders, founders, investors, and operators shaping what comes next in cyber for two days of high-signal programming, executive roundtables, an Innovation Expo, and curated networking.

[un]prompted II (Virtual and San Francisco, California, USA, Oct 27 - 29, 2026) [un]prompted is back for the second time, this October, in SF. Whether you’re a CISO Excel jockey or a researcher sniffing for the scent of bits, we see you as part of our wider AI security practitioner community. [un]prompted is an intimate, raw, and fun gathering for the professionals actually doing the work, from offense to threat hunting to program building to national policy. No fluff. No filler. Just sharp talks, real demos, and conversations that matter.

CyberSat 2026 Unclassified Program (Reston, Virginia, USA, Nov 2 - 3, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

CyberSat 2026 Classified Program (Chantilly, Virginia, USA, Nov 4 - 5, 2026) Space systems now form the backbone of critical infrastructure – from energy grids to autonomous transportation. CyberSat is the only forum where the operators, officials, and engineers actively defending those systems meet for four days a year.

CyberMarketingCon 2026 (Austin, Texas, USA, Nov 15 - 18, 2026) A conference for cybersecurity GTM leaders and doers. Cybersecurity marketing is specific, often technical, and constantly changing. Stay up-to-date with the latest in marketing in the cybersecurity industry while networking with your peers.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 10.23.26

Top stories.

Mirai botnet operators target PHP2Shell.

HPE patches eight maximum-severity flaws in ArubaOS.

Quest Diagnostics discloses a breach.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Technologies, Techniques, and Standards

Events