The Negotiator Was Working for the Hackers — Plus PHP2Shell Is Everywhere
Wednesday, October 28, 2026 · 5-minute read
A suspected Chinese state-sponsored group used a pair of vulnerabilities — one in PHP, one in the Linux kernel — to take over 25 servers, including three connected to a U.S. government-affiliated network. The attackers then went after Active Directory, pulling out credentials and mapping the network. Security firm Dream spotted the activity on October 25 and notified the affected organization.
↗ The Hacker NewsNearly 70% of all websites run PHP, the programming language behind WordPress, Drupal, Joomla, and Magento — and two critical bugs in it are now being actively exploited. PHP pushed an emergency patch, but not before government websites in Europe went dark. Cloudflare started blocking attack traffic at 3:02 am UTC. OpenAI, which helped with the research, called it "one of the most impactful security issues in recent memory."
↗ Krebs on SecurityJapanese internet giant GMO Group warned customers of its Onamae Desktop Cloud service to disconnect from the internet and power down their computers after a hacker who breached the service threatened to launch a ransomware attack. The unusual public warning reflects how serious GMO considers the threat. No attack has been confirmed yet, but the situation is still developing.
↗ BleepingComputerThe PHP2Shell vulnerabilities are being actively used to break into firewalls, VPNs, and network appliances — the very devices meant to keep attackers out. Once inside, hackers are combining PHP2Shell with a separate privilege escalation flaw to gain full root access, then targeting Active Directory to steal credentials. CISA flagged these flaws as critical on October 21 and has been pushing organizations to patch immediately. The attacks are fast — researchers observed exploitation happening within hours of systems being exposed.
Chinese state-sponsored group Volt Typhoon is running zero-day attacks against high-value targets using a clever disguise system called "Silent Train." Instead of using their own servers — which could be tracked — they route attacks through a rotating chain of ordinary home routers, cameras, and small-business devices they've quietly compromised. From the outside, the attack looks like it's coming from your neighbor's internet connection, not China. This makes it extremely hard to detect and block.
This flaw lets an attacker who isn't even logged in send a specially crafted request to Oracle's E-Business Suite software and gain full remote control of the server. It's an SQL injection bug that chains into remote code execution — no username, no password required. Oracle patched it last week, but attackers started scanning for unpatched systems the very next day, on October 27.
Status: Patch available — apply Oracle's Critical Patch Update immediately if your organization uses Oracle E-Business Suite.
This 16-year-old bug sits in the UEFI firmware used by most servers and PCs. An attacker on the same network can send a crafted message during the brief window when a machine boots over the network, potentially running their own code before the operating system — and all its security — even loads. That means they can get in before antivirus, before login screens, before anything. The attack only works during network boot, which limits exposure but is common in data centers.
Status: Patch available — TianoCore published a fix; Red Hat and SUSE have issued updates. Server administrators should apply patches promptly.
CISA confirmed on Tuesday that attackers are now actively exploiting this critical vulnerability, also called Broccoli2Shell and HTTP2Shell. It sits in Brotli, a compression library used by a huge number of web servers and Node.js applications — essentially a piece of plumbing built into much of the internet. Successful exploitation lets an attacker run code on the affected server. Emergency patches have been issued.
Status: Emergency patches available — if your organization runs Node.js-based applications or web servers using Brotli compression, treat this as urgent.
Microsoft is again urging organizations using its Entra ID identity platform to move users away from SMS-based two-factor authentication and over to passkeys. The deadline is real: Microsoft retires SMS and voice call authentication in February 2027. SMS codes can be intercepted or stolen through phishing, while passkeys are tied to your physical device and can't be reused by attackers even if they trick you. Organizations that don't migrate in time may see users locked out of their accounts. It's a significant push toward a genuinely more secure login experience for millions of enterprise users.
Here's a story that sounds like fiction: a cybersecurity executive who wrote a book about handling ransomware was secretly, allegedly, helping the hackers do the ransoming. According to investigative reporter Brian Krebs, federal investigators believe at least one — possibly two — executives at ransomware negotiation firms had unusually close ties to the ShinyHunters hacking group, which has extorted more than $70 million from victims this year alone.
The unraveling started with a dramatic arrest in the Netherlands. On September 15, Dutch police used flash-bang grenades to arrest ShinyHunters suspect Pepijn van der Stap while he was actively logged into his accounts — including Signal. That live access gave investigators a window into his recent messages. What they allegedly found was damning: frequent conversations with Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, who reportedly knew the details of new ShinyHunters victims before those victims even knew they'd been breached. Dubrovsky was arrested on October 9. According to Krebs, investigators also believe he knew ShinyHunters had stolen data from FBI servers and never warned the bureau.
The alleged scheme points to a troubling conflict of interest hiding inside the ransomware response industry. When a company gets hit with ransomware, they often hire specialized negotiators to deal with the attackers and hopefully reduce the ransom. If some of those negotiators were feeding victim information back to the hackers — or actively helping operate extortion websites — victims were paying for help that was working against them. Investigators also believe a separate, unnamed U.S. consulting firm with over 1,000 employees had an executive involved in running ShinyHunters' victim-shaming website, where stolen data was threatened for publication.
Nobody outside the investigation has been charged beyond Dubrovsky yet, and the unnamed firm has not been publicly identified. But this case is likely to trigger serious scrutiny of the ransomware negotiation industry as a whole. If you're an executive at a company that has used external ransomware negotiators in the past few years, it's worth asking your legal team whether your negotiator has ever been vetted for conflicts of interest. Watch this space — more charges are expected.