CyberNews: 26/10/2026 Edition

Today’s roundup

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

Chromecast with Google TV (4K) - Persistent Secure Boot Bypass

Summary

Palo Alto Networks Unit 42 retracted its earlier assessment that an attack on a European government agency involved the PHP2Shell flaws, saying it targeted a vulnerable PHP application. Exploitation attempts against PHP2Shell continue amid suspected North Korean global scanning activity.

Microsoft issued an emergency update for a critical buffer overflow in .NET, fixing two newly disclosed vulnerabilities as well as flaws not fully addressed in an earlier release.

A researcher showed that unpatched Tailscale SSH flaws let a single hacked device on a Tailscale network gain root access to other servers it can reach, provided Tailscale SSH allows port forwarding and the network's access rules permit the connection.

Wasmtime maintainers fixed two critical flaws that could let a malicious WebAssembly module escape its sandbox when compiled by a vulnerable build; one of them affects only ARM64 systems.

Wiz detailed Gheist, an automated campaign that uses stolen GitHub tokens to plant workflows printing a repository's secrets into GitHub Actions logs, downloading them and deleting the runs. It has succeeded against private repositories and GitHub Enterprise environments.

Huntress observed a Microsoft 365 campaign between July 14 and September 22, 2026 that used an adversary-in-the-middle relay to capture sign-in sessions and replay the stolen tokens, compromising 97 accounts at 79 organizations.

Forever Security caught a malicious instruction file in a developer's Downloads folder that tried to make an AI coding agent install a known-malicious npm package; the agent was stopped before any code ran.

Researcher Ovi found uCreator, a rentable Android spyware kit hidden in tampered copies of Telegram and WeChat distributed outside official stores. It can steal Telegram two-factor passwords and clone WeChat accounts; its Telegram component matches the Baohuo backdoor.

A researcher published a second persistent Secure Boot bypass for the Chromecast with Google TV (4K).