ICHI Weekly Brief — 25 October 2026

Akari: The weekly cyber rundown, brought to you by ICHI.global. I am Akari, and this is the week in review for the week ending October twenty-fifth, twenty twenty-six. If you only have ten minutes for cybersecurity this week, this is the one to hear, because the internet just had one of its roughest weeks in years, and people are already calling it Black October. The through line is artificial intelligence. A I helped find the flaws, A I helped exploit them, and in between, a whole cluster of disclosures landed within about seventy-two hours. Let us walk through what actually happened, what is confirmed, and what still is not.

Akari: We start with the biggest story of the week. On October twenty-first, two critical flaws in PHP were disclosed, tracked as C V E twenty twenty-six one zero nine six one eight and C V E twenty twenty-six one zero nine six one nine, both rated nine point two out of ten in severity. PHP powers roughly seventy percent of websites worldwide, including WordPress, Drupal, and Joomla, so the blast radius was enormous. Under certain configurations, the flaws could allow an attacker to read memory and run code on a server without logging in. Emergency patches shipped the same day, but the disclosure itself went sideways. The C V E numbers leaked a day early, and a proof of concept video appeared before defenders were ready. Here is the honest caveat. Researchers reported exploitation attempts, but as of October twenty-first, confirmed real world compromises from actual exploitation had not been established. Attempts are not the same as breaches, and that distinction matters. What is also striking is how the flaws were found. Researchers working with A I assistance, including through Open A I's Patch the Planet initiative and with Google's Gemini, helped surface them, and coordinated disclosure meant patches were ready at announcement. A I is now finding serious flaws in critical infrastructure faster than ever. The question for defenders is whether patching can keep up.

Akari: That brings us to the second theme of the week, which is A I agents doing the attacking. Early in the week, researchers described an open source platform called Cairn, an autonomous A I pentesting system that a Chinese speaking operator used to break into the websites of more than one hundred companies, including Deere, SharkNinja, and Cummins. A related system, called ARTEX, was tied to breaches at about twenty Japanese enterprises and to intrusions at South Korean financial institutions. Then, on October twenty-second, Microsoft said a China aligned group it calls Storm zero nine four zero stole application credentials from ConnectWise's cloud backup service and used ARTEX to attempt sign ins at a rate of about two thousand nine hundred per minute against roughly two thousand two hundred and fifty organizations. Microsoft said some targets went from initial targeting to privileged cloud access in under three hours. The pattern is clear. The attacker no longer needs a large team to move fast. An autonomous agent can probe thousands of targets, and the window between first contact and full access is shrinking to hours, not weeks.

Akari: The third theme is the supply chain, where one compromised component poisons everyone downstream. On October twenty-first, a malicious version of LiteLLM, version one point one zero seven point zero, appeared on PyPI and in Docker images for about two hours. It carried a credential stealer and a remote access backdoor that ran when Python started up. Attackers used stolen GitHub command line OAuth tokens from three engineers to push it through a lookalike fork. It targeted cloud credentials, A I provider keys, S S H keys, and browser credentials. If you installed that version, you should assume credentials were exposed and rotate them. The same week, Railway reported that an unauthorized party may have accessed encrypted environment variables and recovered some of their decrypted contents, and advised customers to rotate secrets. And Zeabur, a cloud platform, announced it is shutting down entirely by December thirty-first after its second breach in two months. Attackers used leaked plaintext admin tokens that were created in January twenty twenty-four and never rotated after the August breach, and stole more than three point two million environment variable records across three hundred twenty-one thousand eight hundred and ten accounts. Unrotated credentials are not a minor hygiene issue. They are the breach.

Akari: Fourth, the actively exploited list kept growing, and this is the part that should drive your patching queue. On October twenty-fourth, CISA added a critical Arista VeloCloud Orchestrator SQL injection flaw, C V E twenty twenty-six one one four six two five, rated nine point nine, to its Known Exploited Vulnerabilities catalog, with federal agencies told to patch by October twenty-sixth. Even an Enterprise Read Only account was enough to escalate to a superuser operator, which means full control over an enterprise software defined wide area network. CISA also added a Collabora Online built in CODE Server command injection flaw, C V E twenty twenty-six one one zero four four seven, rated nine point two, affecting Nextcloud deployments. The fix is to upgrade or remove the app, because disabling it is not sufficient. And a joint advisory from CISA, the F B I, the Secret Service, and partners in Germany and the United Kingdom warned that SafePay ransomware has breached more than six hundred critical infrastructure organizations since August twenty twenty-four, using credential exposure, brute force, V P N abuse, and edge device flaws. Separately, Qilin and INC ransomware groups are actively exploiting a Palo Alto GlobalProtect authentication bypass, C V E twenty twenty-six zero two five seven, that was patched in May and has been in the exploited catalog since May thirteenth.

Akari: Fifth, the human cost showed up in breaches and ransomware around the world. In Denmark, roughly eight point eight million records from the Central Person Register were exposed through a small vendor, Pays ApS, after attackers ran about fourteen million automated searches over ten days in September. A person claiming responsibility told a Danish newspaper that at least three company accounts, including an administrator account, used the password one two three four five six. In India, the State Bank of India told stock exchanges on October twenty-first that a dark web dump of about three hundred seventy-five thousand records included three thousand eight hundred and ninety-seven customer records with personal details, though the source system has not been confirmed and the actor's wider claims are unverified. In Japan, Nikkei disclosed that about one point eight three million records were exposed after stolen credentials were used to access a development cloud service. And in the United States, the city of Columbia, South Carolina, confirmed a ransomware incident involving sensitive data on the city network. The Keystone hardware wallet company also disclosed a breach of customer names, contact information, shipping addresses, and purchase records, while stressing that payment cards, bank information, recovery phrases, and private keys were not exposed.

Akari: Finally, trust itself took a hit. Google Chrome is removing the eMudhra eSign E C C Root C A dash G three from its root store on Tuesday, October twenty-seventh, after researchers recovered dangerously weak private keys, including one that was literally the number four. About thirty thousand eight hundred unexpired certificates chain to it, and a scan of thirty Docker images found ten still trusting that root. If you run Java containers or appliances, check now, because legitimate certificates chaining to that root will stop working. And in Washington, the Department of Homeland Security published an exclusion and removal order requiring civilian federal agencies to remove DeepSeek products, including third party products built on DeepSeek implementations, and banning new procurement.

Akari: So what do you actually do on Monday morning? Five things, in order. First, patch PHP now if you have not, and restart your workers, because there is no workaround. Second, patch VeloCloud, Collabora, and GlobalProtect if you run them, and check the exploited catalog, not just your vendor advisories. Third, rotate any secret that touched LiteLLM version one point one zero seven point zero, Railway, or Zeabur, and hunt for unrotated admin tokens everywhere else. Fourth, audit privileged and vendor accounts for weak passwords and stale credentials, because Denmark just showed what one two three four five six can cost. And fifth, check whether anything you run still trusts the eMudhra root before Chrome drops it on Tuesday. That is the week that was. I am Akari, and this has been the weekly cyber rundown, brought to you by ICHI.global. We will see you next Sunday.

Akari: And now a quick Monday morning update, with what has landed since last night's episode.

Akari: First, today is the deadline. Federal agencies must patch the VeloCloud and Collabora flaws today, October twenty-sixth. Attackers hitting Collabora installed web shells on Nextcloud servers and hunted for credentials, password manager artifacts, and crypto wallets. The fix is version twenty-six point four point three zero three.

Akari: Second, PHP2Shell is spreading beyond websites. A Peplink router advisory, government outages in Britain, Finland, Japan, and Nepal, and banking disruption in Bangladesh. And patching alone does not remove a web shell or stolen credentials already left behind.

Akari: Third, a new Tailscale SSH flaw, dubbed Tailworm, disclosed this morning. Researchers say an attacker controlling one permitted device could abuse SSH port forwarding to reach system sockets and gain root on other servers. Tailscale has acknowledged the report and is investigating. No patched version announced yet, and no C V E number yet either.

Akari: Fourth, Cloudflare shipped emergency firewall rules yesterday to detect traffic declaring Brotli encoding against the Next.js image optimization endpoint. The rules start in log mode, and a match alone does not confirm exploitation.

Akari: And on the A I side, three items. OpenAI released more than seven hundred manuscripts claiming progress on close to four hundred open math problems, including the Riemann hypothesis and the Hodge conjecture. Mathematicians are split between excitement and skepticism. Moonshot's Kimi K three point one Pro is a two point eight trillion parameter model with a one million token context, scoring fifty-five point one on the Artificial Analysis intelligence index, above OpenAI's GPT-six Astra at fifty-three. And Anthropic and Theorem published machine checked security proofs for two hundred thirty-nine test entry points across one hundred twenty-three open source libraries, for compiled RISC-V programs under stated assumptions. A proof about one modeled environment is not a guarantee about a whole live service.

Akari: That is the updated week. I am Akari, and this has been the weekly cyber rundown, brought to you by ICHI.global. We will see you next Sunday.