Readers followed active exploit chains and emergency vulnerability advisories this week. Cloud outages, platform takedowns, blocked certificates, and election influence warnings also appeared among the most-read stories.
Vulnerabilities & Patches
Attackers exploit four Plex flaws to deploy miner and proxy malware. Attackers exploited four Plex Media Server vulnerabilities – collectively Plex2Shell – to install XMRig miner and myawesomeproxy malware on unpatched systems since Oct. 17, 2026. The chain enables unauthenticated remote code execution with the same privileges as the Plex service.
Threat actors exploit Plex2Shell within one day of PoC release. SecurityWeek reported that threat actors began exploiting Plex2Shell roughly one day after its public disclosure on Oct. 16, 2026, deploying XMRig-based miners and myawesomeproxy on Oct. 17. Researcher Zach Main published the proof-of-concept that day.
CERT-EU warns of critical PHP flaws CVE-2026-109618 and CVE-2026-109619. CERT-EU warned in an Oct. 20 emergency advisory of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that could allow remote code execution. PHP rated both 9.2 under CVSS v4.0 and scheduled fixes for Oct. 21 at 14:00 UTC.
PHP warns of unpatched RCE two days after emergency PHP2Shell patches. PHP warned on Oct. 23 of an unpatched remote code execution flaw, CVE-2026-115560, two days after emergency patches for PHP2Shell. PHP said exploitation is unlikely because the flaw affects only unusually configured applications and recommended turning off session upload progress.
Threat Actors
Democratic lawmakers warn of Russian influence campaign targeting Party ahead of midterms. Democratic lawmakers warned that Russia is actively seeking to undermine the Democratic Party and erode voter confidence ahead of the 2026 midterm elections, while U.S. intelligence agencies reported no evidence of foreign attempts to directly hack election infrastructure or tamper with votes.
Tech Industry
Google Cloud outage paralyzes Revolut, Lloyds and HSBC banking. A Google Cloud power event outage in the europe-west2 London region on Oct. 20, 2026, disrupted services including Compute Engine and Cloud Storage. Revolut said 28 of its services were disrupted globally, and the region hosts services for Lloyds Banking Group and HSBC.
Cybercrime
Bullhorn took its staffing platform offline to contain a cyber attack. Bullhorn took its staffing platform offline after users reported job-posting problems on Friday, containing a cyber attack that caused a system-wide outage. The company said it isolated the problem and eliminated the immediate danger while working with CrowdStrike experts.
Critical Infrastructure
Browser makers block eight compromised eMudhra intermediate certificates. Browser makers including Google, Mozilla, Apple and Microsoft blocked eight compromised eMudhra intermediate TLS certificates between Oct. 17 and Oct. 20, 2026. Researcher Wayne reported the compromise and demonstrated control of all eight intermediate CA private keys.
Join the discussion