70% of the Web at Risk: The PHP Crisis, ShinyHunters' Unraveling, and More
Friday, October 23, 2026 · 5-minute read
Russian state-sponsored hackers from Sandworm partnered with another group called UAC-0099 to destroy data at a Ukrainian logistics company. The second group quietly broke in via a booby-trapped email in July 2025, spent over two months lurking undetected, then handed the keys to Sandworm — who wiped everything on September 17. What makes this stand out is that the attackers used a brand-new backdoor called MythicRatatoskr, which hid its communications inside an obscure peer-to-peer network called Yggdrasil, making it very hard to spot.
↗ The Hacker News / ESETLaw enforcement agencies across Africa wrapped up Operation Serengeti III, disrupting nearly 11,000 cybercriminal networks and arresting more than 1,400 people. The operation targeted business email compromise, ransomware, and online scams. It's one of the largest coordinated cybercrime takedowns the continent has ever seen.
↗ BleepingComputerA hacker known as k0t has been systematically breaking into enterprise firewalls and VPNs made by Fortinet and Palo Alto Networks, stealing over 70,000 sets of login credentials from organizations around the world. Researchers at Group-IB and NyxLab say k0t has likely been selling access to these breached networks to ransomware groups including Qilin and The Gentlemen. The campaign has been running since at least October 2025.
↗ The Hacker NewsTwo critical flaws in PHP — the code that runs roughly 70% of all websites — let attackers take complete control of a web server without needing a password. Amazon researchers confirmed attackers started hitting these bugs four days before any fix was available. Government websites in Europe went offline after the flaws became public. The bugs, dubbed PHP2Shell, affect popular platforms like WordPress, Joomla, and Drupal. Emergency patches were released on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. OpenAI, which helped with the research, called it "one of the most impactful security issues in recent memory."
Now there's a third related issue: CVE-2026-115560 affects sites with an unusual configuration. PHP isn't issuing an emergency fix for this one, but recommends turning off a feature called "session upload progress" until the next routine release.
Japanese game maker Capcom — behind Resident Evil, Street Fighter, and Devil May Cry — confirmed that hackers broke into its CAPCOM ID membership service and stole data on 11.7 million customers. Exposed information includes email addresses and associated account details. If you've ever made an account to play or register a Capcom game online, your email is likely in this breach.
These two flaws let anyone — no account required — run their own commands on a web server running an unpatched version of PHP. That means a hacker could read your database, steal user data, install malware, or take the site down entirely. Around 70% of the web runs PHP, making this extraordinarily widespread. Exploitation in the wild was confirmed by Amazon and Cloudflare.
Status: Patches available — update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 immediately.
Pillow is the image-handling library used in almost every Python web app — think profile photo uploads, thumbnail generators, and document converters. A flaw in how it opens EPS image files means a crafted image filename can trick the system into running attacker-supplied commands on the server. The library is downloaded 436 million times a month, so the exposure is enormous.
Status: Fixed in Pillow 13.0.0, released October 16. If your app handles image uploads, this is urgent.
Node.js has a flaw in its built-in Brotli data decoder. Security researchers at Imperva demonstrated "Node2Shell" — a working proof-of-concept that feeds crafted compressed data to Node.js and gets code execution on the server in return. Their test worked on the official Node.js 24.22.0 build with no special setup. Applications that accept and decompress untrusted data from users are most at risk.
Status: Fixed in Node.js 24.22.1, released October 21. The fix correctly rejects the malicious data.
Hewlett Packard Enterprise patched 72 vulnerabilities in ArubaOS — the software that runs Aruba network switches and wireless gear used in offices and campuses. Eight of those bugs are rated maximum severity, allowing an attacker to bypass login entirely or run code on the device. If your office uses Aruba networking equipment, your IT team needs to apply these patches.
Status: Security updates released by HPE on October 23. Apply immediately.
Google is rolling out new scam-detection features in Chrome that use its Gemini AI to analyze websites in real time and warn you when something looks fraudulent. One specific protection targets ClickFix attacks — a nasty scam where a fake error page tells you to copy and run a command on your computer, which secretly installs malware. Chrome will now flag suspicious commands before you can paste them. This is a meaningful upgrade for everyday users who may not recognize these tricks on their own.
The North Korean state hacking group Lazarus has started wrapping its malware in post-quantum cryptography when delivering it to targets. This is significant because it shows nation-state hackers are already adapting to a future where quantum computers could crack standard encryption — and it makes their malware harder to inspect and block. Security teams may need to update detection tools to handle this newer type of encrypted traffic.
In late September, hackers broke into the FBI's own recruitment website — fbijobs.gov — and threatened to publish the deeply personal files of federal agents, including home addresses, Social Security numbers, and psychological records. The group behind it: ShinyHunters, which the FBI says has extorted more than $70 million from victims just this year. What followed set off one of the most dramatic cybercrime investigations in recent memory.
ShinyHunters started in France around 2019, racking up dozens of major breaches. As the original members were arrested one by one, a teenager from Amman, Jordan — known online as Rey — took over the operation. Everything started to unravel in September when Dutch police, using flash-bang grenades, arrested a key suspect named Pepijn van der Stap in the Netherlands. Crucially, they caught him while he was actively logged into his Signal account. That gave investigators access to his recent messages — and those messages opened a door nobody expected.
The chats revealed something alarming: Van der Stap had been in regular contact with ransomware negotiators — people whose entire job is to help companies deal with hackers — in Canada and the United States. One of them, a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky, had recently published a book advising companies to always engage with hackers during a breach. According to investigators, Dubrovsky not only knew the details of ShinyHunters victims before those victims did — he also allegedly knew that ShinyHunters had stolen sensitive FBI data and never told the bureau. He has since been arrested and charged. The Signal messages also allegedly revealed that Van der Stap had ordered two murders abroad, though investigators say there's no indication those orders were carried out.
The full picture is still emerging. Federal investigators believe at least one executive at a large, unnamed U.S. consulting firm actively helped run ShinyHunters' extortion website. That firm hasn't been named yet, and no charges have been filed there. This case is a sharp reminder that the line between the people who defend organizations from hackers and the hackers themselves can be blurrier than anyone wants to admit. Watch for more arrests and charges in the weeks ahead.