@2Workly

Helping SOC, detection, and CTI teams stay ahead with cybersecurity news, CTI reporting, and IOC coverage they can act on.

2workly.com
Joined August 2026
  • Tweets967
  • Following0
  • Followers2
Atlassian patched 75 third-party vulnerabilities across Data Center and Server products, including six critical flaws in Tomcat, Netty, and Bouncy Castle. Update Confluence and Jira instances. Details securityweek.com/atlassian-p… 2workly.com

Atlassian Patches 75 Third-Party Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.

securityweek.com
Researchers proved Node2Shell RCE via the Node.js Brotli decoder (CVE-2026-111497). It triggers via Express 5 bodies or outbound fetch() calls. WAFs miss outbound responses; patch runtimes to 24.22.1 thehackernews.com/2026/10/re… 2workly.com

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.

thehackernews.com
8
Attackers are targeting PHP2Shell (CVE-2026-109618/CVE-2026-109619) to deploy the Potassium Mirai botnet. Block C2 134.199.154[.]64 and patch PHP to supported branches now. Intel: 2workly.com Source: thehackernews.com/2026/10/ph… #2workly #CTI

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
2
Iran's Prince of Persia (Infy) deployed a Tornado C2 on US shared hosting—its first US node since 2016—while using Telegram bots for exfil. Audit Telegram API egress and shared hosting traffic: Enforce securityweek.com/irans-princ… 2workly.com

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

securityweek.com
eMudhra exits global SSL/TLS after 8 intermediate CA private keys were found to be < 256. Chrome and Mozilla distrust emSign ECC Root CA - G3, impacting ~30k certs. Inventory your PKI and replace affected thehackernews.com/2026/10/em… 2workly.com

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra plans to exit global SSL/TLS certificates after eight weak CA keys were recovered, as Chrome and Firefox withdraw trust in its ECC root.

thehackernews.com
2
CVE-2026-114625 hits Arista VeloCloud Orchestrator in active attacks. Low-privilege accounts escalate to superuser via SQLi. Block observed IPs 74.82.197[.]86 and 38.54.50[.]151 now. Details: Intel desk thehackernews.com/2026/10/ar… 2workly.com

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Attackers are exploiting CVE-2026-114625 in VeloCloud Orchestrator, allowing logged-in users to gain full operator privileges.

thehackernews.com
eMudhra lost 8 intermediate CA private keys due to weak randomness in keygen, allowing threat actors to forge TLS certs and run MitM attacks. Update trust stores and enforce CRL/OCSP checks now. Report unit42.paloaltonetworks.com/… 2workly.com

EMudhra Intermediate CA Certificates Compromised

Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide.

unit42.paloaltonetworks.com
4
eMudhra exits the SSL/TLS business after 8 intermediate CA keys were found to be trivial numbers, allowing arbitrary cert forgery. Audit embedded CA stores and containers that ignore OCSP/CRL checks. Source therecord.media/indian-tech-… 2workly.com

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

therecord.media
5
Two CVSS 9.0 RCE flaws in Linux KSMBD are public without upstream patches. ZDI-CAN-33774 allows pre-auth RCE over port 445. Audit running systems with lsmod | grep ksmbd and restrict SMB exposure now thehackernews.com/2026/10/tw… 2workly.com

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Two CVSS 9.0 flaws in Linux KSMBD could enable remote code execution; one needs no authentication, and neither has a mainline fix.

thehackernews.com
2
Laravel patched CVE-2026-114509 (CVSS 9.2), a TokenGuard API auth bypass on MySQL/MariaDB. Attackers pass non-string credentials to match arbitrary accounts without tokens. Patch to 13.29.0/12.68.0. Source thehackernews.com/2026/10/th… 2workly.com

ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21...

This ThreatsDay: Critical RCE flaws, stolen credentials, data breaches, phishing scams, AI security risks, and cyber threats you may have missed.

thehackernews.com
1
Amazon observed active in-the-wild exploitation of new critical PHP flaws four days before disclosure. Attackers gain direct server access without credentials. Patch or isolate vulnerable PHP runtimes now arstechnica.com/security/202… 2workly.com

Hackers got a four-day head start on epic PHP2Shell vulnerability

Hackers were already probing the bug before defenders were told it existed.

arstechnica.com
Microsoft tied ConnectWise breaches to Storm-0940 using the ARTEX framework. Bursts hit 2,900 auth attempts/min, yielding cloud access in under 3 hours. Triage cannot be manual. therecord.media/china-cyber-… 2workly.com #2workly

Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents

A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to...

therecord.media
1
Two critical PHP core RCEs (CVE-2026-109618, CVE-2026-109619) trigger before app code runs. PHP 8.1 and older receive no fix. Snort SIDs 67359 & 67360 provide perimeter detection. Source: blog.talosintelligence.com/t… Desk: 2workly.com #2workly

Two critical RCEs in PHP core

Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort...

blog.talosintelligence.com
Signal patched CVE-2026-113380 (CVSS 9.3) in RingRTC. Remote callers could flood the event queue to block hangup commands, keeping audio and video active. Update Signal clients to RingRTC 2.72.0+. securityweek.com/signal-vuln… 2workly.com #2workly

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

securityweek.com
QPACK flaws across HTTP/3 stacks enable DoS via 4,000x memory amplification. Fixes released for quic-go (CVE-2025-64702), quiche (CVE-2026-12523), and lsquic. Patch or disable exposed HTTP/3 endpoints thehackernews.com/2026/10/ne… 2workly.com

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

FoxIO disclosed QPACK flaws in seven HTTP/3 stacks that can cause denial of service through header expansion, with three stacks still unpatched.

thehackernews.com
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) enables unauthenticated RCE via a single POST request under Apache mod_php. Active exploitation began prior to release. Patch PHP runtimes or disable upload securityweek.com/tech-and-se… 2workly.com

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.

securityweek.com
OpenCode fixed an RCE flaw (v1.0.137-1.18.32) on Windows/WSL via malicious MCP servers. No CVE was issued, blinding vulnerability scanners. Audit versions directly and run opencode mcp list. thehackernews.com/2026/10/op… 2workly.com #2workly

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A patched OpenCode flaw could let malicious MCP servers execute code on Windows and WSL when developers initiated OAuth sign-in.

thehackernews.com
2
GitLab patched CVE-2026-110264 (CVSS 10.0), a pre-auth RCE bug affecting self-managed releases back to 2014. Deploy patches immediately and hunt logs using GitLab's new Sigma rules. Intel: 2workly.com Source: thehackernews.com/2026/10/cr… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
AWS detected PHP2Shell exploit attempts 4 days before patch release, routed through commercial proxy networks. Patch-to-exploit timelines are gone. Inspect perimeter PHP traffic now. Details: Enforce with wired.com/story/hackers-expl… 2workly.com

Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.

wired.com
Cisco fixed 34 flaws across Expressway, Snort 3, and UC systems. Critical CVE-2026-76466 allows root command execution on Expressway. Patch edge assets and update ASA/FTD firewalls. securityweek.com/cisco-patch… 2workly.com #2workly

Cisco Patches 34 Vulnerabilities Across Multiple Products

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.

securityweek.com
4
Load more