{"contract_version":"ichi-briefs-v1","generated_at":"2026-10-26T19:10:04.631Z","episodes":[{"slug":"ichi-brief-2026-10-25","title":"ICHI Weekly Brief — 25 October 2026","date":"2026-10-25","description":"Akari's week-in-review for the week ending October 25, 2026, updated Monday morning: Black October — the critical PHP flaws, AI agents doing the attacking, the LiteLLM supply-chain compromise, new CISA exploited vulnerabilities, the Denmark breach — plus today's patch deadline, PHP2Shell's wider spread, the Tailscale Tailworm flaw, Cloudflare's Brotli rules, and AI news from OpenAI, Moonshot, and Anthropic.","url":"https://ichi.global/briefs/ichi-brief-2026-10-25","audio_url":"https://ichi.global/briefs/ichi-brief-2026-10-25/audio.mp3?v=f58636c6e842","audio_bytes":5880997,"duration_s":735,"first_published_at":"2026-10-26T15:16:41.597Z","updated_at":"2026-10-26T15:16:41.597Z","sources":[{"title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619)","url":"https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/"},{"title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619)","url":"https://dev.to/cortexflow_tech/php2shell-two-critical-php-rces-cvss-92-leaked-a-day-early-check-your-version-and-patch-today-5dfm"},{"title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619)","url":"https://en.wikipedia.org/wiki/PHP2Shell"},{"title":"PHP2Shell (CVE-2026-109618, CVE-2026-109619)","url":"https://scrutex.ai/blogs/black-october-2026-cyber-incidents-explained"},{"title":"Cairn/ARTEX AI-agent intrusions and ConnectWise / Storm-0940","url":"https://965wtou.com/2026/10/19/exclusive-how-one-hacker-used-ai-agents-and-a-few-thousand-dollars-to-break-into-scores-of-sites/"},{"title":"Cairn/ARTEX AI-agent intrusions and ConnectWise / Storm-0940","url":"https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/"},{"title":"Cairn/ARTEX AI-agent intrusions and ConnectWise / Storm-0940","url":"https://cybernoz.com/microsoft-links-connectwise-breach-to-china-linked-group-using-ai-pentesting-tool-artex/"},{"title":"LiteLLM supply-chain compromise (1.107.0)","url":"https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html"},{"title":"LiteLLM supply-chain compromise (1.107.0)","url":"https://docs.litellm.ai/blog/security-incident-oct-21-2026?utm_source=chatgpt.com"},{"title":"Railway and Zeabur","url":"https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/"},{"title":"Railway and Zeabur","url":"https://dev.to/rbonweb/zeaburs-unrotated-administrator-credentials-triggered-the-breach-that-shut-the-company-down-494c"},{"title":"CISA KEV: Arista VeloCloud and Collabora Online; SafePay advisory; PAN-OS GlobalProtect exploitation","url":"https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html"},{"title":"CISA KEV: Arista VeloCloud and Collabora Online; SafePay advisory; PAN-OS GlobalProtect exploitation","url":"https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/"},{"title":"CISA KEV: Arista VeloCloud and Collabora Online; SafePay advisory; PAN-OS GlobalProtect exploitation","url":"https://readus247.com/cve-2026-0257-pan-os-ransomware/"},{"title":"Denmark CPR breach","url":"https://trendintech.com/denmark-123456-password-breach-8-8-million-2026/"},{"title":"Denmark CPR breach","url":"https://idm.net.au/article/0015831-123456-doesn-t-add-password-security"},{"title":"Denmark CPR breach","url":"https://neotechcloudsolutions.com/en/123456-password-denmark-cpr-breach-smb/"},{"title":"State Bank of India dark-web records","url":"https://indianpsu.com/sbi-customer-data-breach-dark-web-2026/"},{"title":"Nikkei breach","url":"https://securityaffairs.com/201369/data-breach/nikkei-data-breach-affected-over-1-8-million-records.html"},{"title":"Nikkei breach","url":"https://www.securityweek.com/hackers-steal-1-8-million-records-from-nikkei/"},{"title":"City of Columbia SC ransomware","url":"https://safeguard.sh/resources/blog/city-of-columbia-sc-ransomware-attack-october-2026"},{"title":"Keystone wallet breach","url":"https://cryptocompass.com/articles/keystone-data-breach-exposes-customer-addresses-and-purchase-details"},{"title":"Keystone wallet breach","url":"https://www.abijita.com/keystone-wallet-data-breach-exposes-customer-names-and-shipping-addresses/"},{"title":"eMudhra root removal","url":"https://www.tanium.com/blog/emudhra-ca-compromise-find-and-fix-your-exposure-with-tanium"},{"title":"eMudhra root removal","url":"https://www.rescana.com/post/emudhra-intermediate-ca-key-compromise-october-2026"},{"title":"eMudhra root removal","url":"https://www.infoworld.com/article/4239637/ca-shutdown-puts-java-containers-and-appliances-in-the-certificate-crosshairs.html"},{"title":"eMudhra root removal","url":"https://kielltampubolon.medium.com/the-emudhra-fallout-part-2-i-scanned-30-docker-images-10-still-trust-the-root-chrome-is-dropping-805b7508e17f"},{"title":"DHS DeepSeek exclusion/removal order","url":"https://siliconangle.com/2026/10/19/trump-administration-orders-ban-on-deepseek-in-federal-agencies/"},{"title":"DHS DeepSeek exclusion/removal order","url":"https://thehackernews.com/2026/10/us-orders-deepseek-removed-from-federal.html"},{"title":"DHS DeepSeek exclusion/removal order","url":"https://www.aiaffairs.com/government/dhs-orders-deepseek-removed-civilian-agencies/"},{"title":"Monday update: CISA KEV deadline Oct 26","url":"https://www.kargin-utkin.com/news/cisa-adds-two-exploited-critical-flaws-to-kev-list-collabora-online-and-arista-velocloud"},{"title":"Monday update: CISA KEV deadline Oct 26","url":"https://www.isec.news/2026/10/25/cisa-collabora-nextcloud-flaw-active-exploitation/"},{"title":"Monday update: CISA KEV deadline Oct 26","url":"https://www.remio.ai/post/cisa-collabora-kev-listing-sets-october-26-remediation-deadline"},{"title":"Monday update: CISA KEV deadline Oct 26","url":"https://rodtrent.substack.com/p/security-check-in-quick-hits-cisa-ace"},{"title":"Monday update: PHP2Shell wider spread","url":"https://cybersecasia.net/news/fallout-from-two-critical-php-vulnerabilities-now-tagged-as-black-october/"},{"title":"Monday update: PHP2Shell wider spread","url":"https://www.linkedin.com/pulse/php2shell-longer-just-website-problem-peplink-routers-barbara-haratyk-uorwe"},{"title":"Monday update: PHP2Shell wider spread","url":"https://kbyteitservices.medium.com/php-vulnerability-october-2026-fixes-and-hosting-checks-86b8fb6d39f0"},{"title":"Monday update: Tailscale Tailworm","url":"https://www.thaicert.or.th/en/2026/10/26/tailscale-ssh-vulnerability-could-allow-privilege-escalation-and-root-access-to-servers/"},{"title":"Monday update: Cloudflare Brotli WAF","url":"https://gbhackers.com/cloudflare-adds-new-waf-rules-to-detect-attacks/"},{"title":"Monday update: Cloudflare Brotli WAF","url":"https://wisevoter.com/world/2026/10/26/cloudflare-updates-firewall-block-brotli-exploit"},{"title":"Monday update: OpenAI math breakthrough","url":"https://medium.com/@hs5492349/openais-math-breakthrough-when-nearly-400-open-problems-fell-in-a-single-release-81f49bd1cef2"},{"title":"Monday update: OpenAI math breakthrough","url":"https://hypestreet.net/openais-ai-math-breakthrough-sparks-boycott-crypto-wallet-fears/"},{"title":"Monday update: Moonshot Kimi K3.1 Pro","url":"https://www.mt.co.kr/en/tech/2026/10/26/2026102613571459761"},{"title":"Monday update: Moonshot Kimi K3.1 Pro","url":"https://business.theantlersamerican.com/theantlersamerican/article/bizwire-2026-10-26-open-source-ai-models-are-catching-up-to-closed-ones-on-accounting-work-dualentry-benchmark-finds"},{"title":"Monday update: Claude machine-checked proofs","url":"https://www.linkedin.com/pulse/daily-horizon-010-what-would-count-proof-annette-partida-wjddc"}]}]}