Top 10 Cybersecurity News (October 26, 2026):Compromised eMudhra CA Keys Trigger Emergency Blocks, LiteLLM Release Pipeline Hijacked to Steal Secrets, and More

WEEKLY TOP TEN: October 26, 2026, 16:00 GMT

1. PHP2Shell Flaws Force UK Government Services Offline
   
   Dozens of UK government services were taken offline after attackers exploited the PHP2Shell vulnerabilities, a set of flaws in widely deployed PHP components that allow remote code execution on affected web servers. Public bodies pulled affected systems from service while they assessed exposure and applied fixes. The incident shows how quickly a flaw in a common web stack can interrupt citizen-facing services and why government and critical infrastructure operators need current inventories of PHP-based applications. Security teams should identify internet-facing PHP workloads, apply vendor patches or mitigations, review web server logs for webshell activity, and rehearse fallback procedures for essential public services.
2. LiteLLM Release Pipeline Hijacked to Steal Secrets
   
   Attackers compromised the release pipeline for LiteLLM, the popular open-source gateway for large language model APIs, and published a malicious version 1.107.0 on October 21 designed to harvest passwords and secrets from systems that installed it. Maintainers identified version 1.106.2 as the last safe release. Because LiteLLM often sits between applications and AI provider keys, stolen credentials could expose cloud accounts and model API spending. Teams that pulled the bad release should roll back, rotate every API key, token and credential available to the host, audit build systems for unexpected installs, and pin dependencies to verified hashes.
3. GitLab Patches Another Max-Severity Code Execution Flaw
   
   GitLab released fixes for CVE-2026-110264, a maximum-severity vulnerability that can allow code execution on self-managed instances, marking another critical flaw in the platform within a short period. Source code platforms hold proprietary code, CI/CD secrets and deployment credentials, which makes them attractive targets and a stepping stone into production environments. Administrators of self-managed GitLab should upgrade to the patched releases without delay, limit exposure of instances to the internet where possible, review runner and service account privileges, and check logs for suspicious pipeline activity. GitLab-hosted customers do not need to take action beyond normal hygiene.
4. Compromised eMudhra CA Keys Trigger Emergency Blocks
   
   Mozilla, Google and Apple moved to block certificates issued by India-based certificate authority eMudhra after its CA keys were found to be compromised, a serious trust failure because stolen keys allow attackers to mint certificates that browsers would otherwise accept. The issue also surfaced in the Go language ecosystem as CVE-2026-111943. Organizations should check whether any internal systems, devices or partners rely on eMudhra-issued certificates, plan replacements from another authority, update Go toolchains and trust stores as fixes ship, and monitor certificate transparency logs for unexpected issuance affecting their domains.
5. HPE Fixes Eight Maximum-Severity ArubaOS Flaws
   
   Hewlett Packard Enterprise released patches for 72 vulnerabilities in ArubaOS, including eight rated maximum severity, tracked as CVE-2026-79844 through CVE-2026-79851. The critical issues include remote code execution and authentication bypass in the operating system that runs Aruba wireless controllers and gateways. These devices are common across enterprises, hospitals, campuses and government networks, and network edge flaws are frequently targeted soon after disclosure. Administrators should inventory ArubaOS deployments, schedule updates on an emergency basis, restrict management plane access to dedicated networks, and review authentication logs for anomalies while patches are staged.
6. FBI and CISA Warn of SafePay Ransomware Attacks
   
   The FBI and CISA issued a joint advisory, AA26-293A, warning that the SafePay ransomware group has attacked more than 600 organizations. The advisory describes the group’s tactics, techniques and indicators so defenders can detect and block intrusions, and it urges organizations in healthcare, manufacturing and other sectors to reduce exposure. Recommended actions typically include enforcing phishing-resistant multifactor authentication, patching internet-facing systems, segmenting networks, maintaining offline backups and monitoring for data exfiltration. Security teams should map the published indicators into detection tools, validate that backups can be restored, and brief executives on the extortion risk this group poses.
7. Siemens Software Center Flaw Exploited in ClickFix Attacks
   
   Attackers are exploiting CVE-2026-110936, a vulnerability in Siemens Software Center, as part of ClickFix campaigns that trick users into running malicious commands. Siemens software is widespread in industrial and engineering environments, so compromised engineering workstations can open a route toward operational technology networks. Industrial organizations should apply Siemens’ update, restrict who can install or run engineering tools, train staff to recognize ClickFix prompts that ask them to paste commands, and monitor for unexpected script execution on engineering systems. Separating IT and OT networks limits the damage if a workstation is compromised.
8. Sandworm Wipes Ukrainian Logistics Firm via Mesh Backdoor
   
   ESET researchers attributed an attack on a Ukrainian logistics company to the Russia-linked Sandworm group, tracked as UAC-0099, which used a new mesh-style backdoor called MythicRatatoskr before deploying destructive wiper malware. Logistics firms are valuable targets because disruption affects supply chains and wartime support. Defenders in logistics, transport and critical infrastructure should review ESET’s published indicators, watch for unusual peer-to-peer or tunneling traffic, protect and test offline backups against wiper scenarios, and tighten administrative access. The campaign continues a long pattern of Russian state-linked destructive operations aimed at Ukrainian organizations.
9. k0t Campaign Exposes 70,000 Edge Device Credentials
   
   Researchers at Group-IB and NyxLab detailed the k0t campaign, in which attackers breached enterprise firewalls and other edge devices and exposed credentials for roughly 70,000 of them. Stolen edge credentials let attackers log in as legitimate administrators or VPN users, bypassing many defenses. Organizations should audit firewall and VPN accounts, rotate administrator and service credentials, enforce multifactor authentication on all remote access, restrict management interfaces from the internet, and review logs for unfamiliar logins. Vendors and security teams should also check published indicator lists to determine whether their devices appear among those affected.
10. BlackX Bootkit Bypasses Secure Boot on Windows
    
    Kaspersky disclosed BlackX, a UEFI bootkit that bypasses Secure Boot on Windows systems and is suspected to be linked to the APT41 threat group. A bootkit loads before the operating system, which lets it evade endpoint security tools and survive reinstallation of Windows. Organizations should apply Microsoft and firmware vendor updates, keep revocation lists current, enable firmware integrity monitoring where available, and restrict physical and administrative access to endpoints. Security teams should review Kaspersky’s indicators, hunt for unexpected changes to the EFI system partition, and consider reflashing firmware on any device suspected of compromise.