CyberSecurity.PH #049

CyberSecurity.PH is now supported by the PSA Intelligence Cyber Risks

Learn more

Recently Discovered PHP2Shell Vulnerability Affecting 70% of Websites Requires Immediate Update

On October 20, 2026, two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell, were detected in PHP instances. The flaws are tracked as Common Vulnerabilities and Exposures (CVE)-2026-109618 and CVE-2026-109619, following the widespread exposure of the bugs through a proof-of-concept (PoC) made publicly available online. As per the PHP Foundation, all PHP installation versions 5 through 8 are at risk.

PHP is a widely used, free, and open-source scripting language designed primarily for web development. According to web technology trackers, PHP powers nearly 70 to 75 percent of all websites on the internet. Popular internet platforms built on PHP include WordPress, Joomla, Drupal, Magento, Wikipedia, and Flickr.

Mitigation Strategy

PHP Foundation just recently released security updates and advises clients to immediately apply the patch, but noted that end-of-life versions, which include PHP 8.1 and below, will not receive any patch and advises anyone running these deprecated instances to immediately upgrade to PHP 8.2+ so the patch can be applied. If immediate update is not feasible, PHP Foundation has provided measures clients can follow to lessen exposure.

Both vulnerabilities carry a critical Common Vulnerability Scoring System (CVSS) score of 9.2.The two critical flaws allow unauthenticated actors to run code on servers without needing to properly log in. Furthermore, leakage of active memory that holds passwords and session tokens is possible. Because the flaws live within the PHP engine rather than in a website/application, a site may still be vulnerable even if the underlying code infrastructure is secure.

For full details, please refer to the PHP Foundation's Advisory and look for further updates on their blog site. For more information on the vulnerabilities, refer to the National Vulnerability Database (NVD) entries for CVE-2026-109618 and CVE-2026-109619.

eMudhra’s Certificate Misconfiguration Exposes Users to Website Impersonation and Data Theft

In October 2026, researchers discovered a cryptographic flaw affecting eight intermediate Certificate Authority (CA) certificates issued by eMudhra. Out of roughly 50 to 60 globally trusted CAs whose approvals browsers trust, eMudhra operates on a global scale. The vulnerability originated from an internal misconfiguration during an April 2025 key generation ceremony, which resulted in the creation of master keys entirely lacking mathematical randomness for nearly 18 months. Because the private keys were generated as simple integers smaller than 256 characters, researchers were able to calculate and recover them in under a second.

The broader problem with this exposure is that if a threat actor possesses one of these exposed keys, they gain the ability to forge a trusted digital certificate for any website globally. This exposure impacts enterprise infrastructure, including VPN gateways and network appliances, as well as developer environments such as Go, Node.js, and Python’s certifi. While the exact number of organizations directly relying on eMudhra certificates remains unconfirmed, virtually every website, application, and connected service globally depends on a CA's digital certificate signing to establish trust.

Furthermore, because this flaw stemmed from an internal process failure, it has sparked industry discussions regarding whether other CAs might harbor similar, undetected vulnerabilities in their key generation protocols.

Mitigation Strategy

While major technology providers (Google, Apple, Microsoft, Mozilla) have recently deployed automated updates to block these compromised keys, IT and network administrators are advised to check for and apply updates to vulnerable non-browser infrastructure (such as VPN gateways, IoT devices, and developer runtimes) that do not automatically verify certificate revocation.

Additionally, administrators can utilize the “eMudhra Intermediate CA Compromise” resource page published by security researcher, Dennis Jacksons to run client diagnostics, track unpatched software versions, and apply specific manual workarounds for systems awaiting updates.

For full details, please refer to eMudhra's recent statement on the certificate security incident. For more information on the vulnerabilities, refer to the National Vulnerability Database (NVD).

South Korea and Japan Face Increase in AI-Powered Cybersecurity Attacks

On October 7, 2026, US cybersecurity firm CrowdStrike attributed recent attacks on South Korean banks to a 26-year-old China-based threat actor. The suspected threat actor was identified as a likely member of a China–based Distributed Denial-of-Service (DDoS)-for-hire group.

The threat actor reportedly used the ARTEX tool recently developed in China, alongside Large Language Models (LLMs), and was observed using consistent Chinese-language prompts with Claude. Following the attack, ARTEX developer “Autumn-27” removed the tool from the code-hosting platform GitHub, citing misuse of the program by malicious threat actors. The threat actor reportedly asked Claude to provide information on Korean-language Telegram channels in data-selling groups selling stolen information. PSA Intelligence notes that no state-sponsored advanced persistent threat (APT) was attributed to the incident.

South Korea’s Financial Services Commission issued a consumer alert related to the incident, urging customers to be vigilant about potential loan scams and phishing attacks. Shinhan Bank and KB Kookmin Bank were reportedly affected by the attacks. South Korean President Lee Jae Myung publicly called for a stronger response and a thorough investigation into the incident.

PSA Intelligence is monitoring an increase in APTs using agentic AI-powered tools, while complementing traditional offensive capabilities to attack vulnerable institutions. Recent cybersecurity attacks in the region highlight threat actors orchestrating criminal and financially motivated cyberattacks to conduct multiple intrusions within a limited time span, while experimenting with AI tools in their operations.

Japanese companies such as Daiwa Securities, SoftBank Corp., Lawson, and JR East were among the companies recently compromised by ransomware or other cyberattacks. Notably, a ransomware attack targeted SoftBank-owned IDC Frontier, a domestic cloud infrastructure provider. Japan-based IT firm Macnica recorded approximately 23 AI-assisted cyberattacks targeting unauthorized access to credit card information at online shopping sites since July 2026.

Monitored ‘Traffic Violation’ SMS Scam Targeting Individuals based in Metro Manila

In Metro Manila, Philippines, a SMS phishing scam is targeting motorists luring would-be victims of pending traffic violations that need immediate attention and resolution through SMS messages. The proliferation of this phishing scam has prompted the Philippine National Police (PNP) and the Metropolitan Manila Development Authority (MMDA) to issue a public warning.

The public advisory follows the return of the No-Contact Apprehension Policy (NCAP) to five cities in Metro Manila, including Manila, Muntinlupa, Parañaque, San Juan, and Quezon City.

How NCAP SMS Phishing Scam Works

The phishing scam capitalizes on social engineering techniques by sending unsolicited messages, often structured with a sense of authority and urgency to mimic legitimate government or law enforcement communications.

The content of the SMS message emphasizes clicking an embedded link that directs victims to fake payment or inquiry portals designed to collect personally identifiable data, such as addresses, mobile phone numbers, and banking information.

Related to this latest phishing scam a similar scam was monitored by PSA Intelligence in February 2026, with the same social engineering techniques used, but with the perpetrators masking as the government agency  Land Transportation Office (LTO).

How to Verify the Legitimacy of a Traffic Violation in Metro Manila

PSA Intelligence reminds clients not to treat unsolicited text messages as valid notices of traffic violations in the Philippines. Instead, clients should verify such claims through official government and authorized channels.

Phishing Platform Impersonating AI Brands Using Browser-in-the-Browser Attack Method to Bypass Visual Cues that give away Phishing Attacks

Threat actors are using phishing platforms to impersonate artificial intelligence (AI) brands such as ChatGPT, Gemini, Claude, and Meta’s Muse to steal credentials and multi-factor authentication codes (MFA) using a method known as Browser-in-the-Browser (BITB). Cybersecurity researchers from Island recently exposed a campaign involving a website, museads[.]ai, which impersonated Meta’s Muse AI just eight days after launch, highlighting how threat actors rapidly exploit new trends.

PSA Intelligence notes that BITB attacks are particularly dangerous because it bypasses the most common defense against phishing which is verifying the uniform resource locator (URL). Instead of redirecting users to a fake login page, threat actors use web code (HTML, CSS, JavaScript) to “draw” a fake pop-up window directly inside the page you are already on. This fabricated pop-up window copies the look of a real login screen, including a fake URL bar with the exact web address of a trusted site.

The Lure and Trap

While a BITB attack is known for bypassing traditional visual defenses, threat actors always begin with a social engineering lure designed to direct the user to a malicious host platform. In this particular case, threat actors exploit the hype around AI, using fake invitation emails or poisoned search engine ads promoting tools like ChatGPT, Gemini, Claude, or Meta Muse. This specific campaign is given a customized “pitch” to appeal to specifically targeted professionals like advertising account managers and media buyers, promising valuable business services such as AI-driven campaign optimization.

Researchers note that these fake AI portals are also being used to impersonate non-AI brands, deploying tailored pitches for fake refund scams and bogus corporate recruitment sites for companies like Tesla and Nike.

Once the victim has clicked the link, they land on a professional looking, but entirely malicious website. Users are then prompted to link their accounts by clicking a “Connect” button, which triggers the fabricated BITB login pop-up to steal credentials. This pop-up is entirely controlled by the threat actor which can “see each submission and decide what the victim sees next”   and resulting in stolen credentials.

Mitigations

A BITB attack relies on social engineering as the entry point and visual manipulation for a successful attack, but it has three critical points of failure that users can identify:

• The Social Engineering lure: BITB attacks begin with a deceptive lure, usually a phishing email, fake invitation, or malicious ad. Fostering strong cybersecurity awareness, specifically training users to verify the sender and the intent of an email before interacting with links, stops the attack before the next phase can begin.
• The Parent URL: If a user does click through the malicious site, the next step is the browser’s actual web browser address. While threat actors can perfectly manipulate the fabricated pop-up to look legitimate, they cannot spoof the origin address bar.
• Fake Pop-ups Confined within the “view port” of the Browser: You can also verify a pop-up by attempting to drag it; because the malicious window is merely painted onto the webpage, it is bound within the view port and cannot be dragged beyond the edge of the main browser window, whereas a legitimate authentication pop-up will move freely anywhere on your screen.

More Reading: Behind the Connect Button: The Fake AI Ads Campaign | Ad Account Theft: The Digital Advertising Commodity Fueling Global Fraud

Analysis On the Recent Cybersecurity Incident Affecting Refrigeration Systems

A cybersecurity incident shut down the refrigeration system of several supermarkets in France, triggering the built-in automatic defrost cycles, and resulting in the spoilage of fresh and frozen food stocks with an estimated commercial loss amounting to tens of millions of euros. Reports indicate that between 250 to 350 supermarket locations across France belonging to major retail groups, including Intermarché, Coopérative U (Super U), E.Leclerc, Carrefour Market, and Monoprix were affected.

As of writing, no threat actors groups or individuals have claimed responsibility for the attack, as well as the exact vulnerability that was exploited. However, reports note that the impacted systems were running older, unpatched versions of the Danfoss control software, specifically targeting AKM controllers and the AK-SM 8xxA Series platforms used for managing refrigeration and Heating, Ventilation, and Airconditioning (HVAC) systems.

Researchers have highlighted two vulnerabilities that the United States (US) Cybersecurity and Infrastructure Security Agency (CISA)  flagged in 2025 -  an authentication bypass (CVE-2025-41450) and command injection (CVE-2025-41451) vulnerability.

Implications to Food and Medicine Storage

Shodan, which is a search engine for internet connected devices, currently identifies over 4,700 Danfoss devices exposed online globally, with some located in the APAC region. While there have been no reports of this specific incident affecting organizations operating in APAC, the threat remains active for organizations operating cold storage facilities across the region.

Based on the dataset there are currently 197 vulnerable Danfoss  systems across the APAC region. The majority of these exposures are concentrated in Japan (57) and China (42), followed closely by Australia (38), India (31), and Singapore (11).

PSA intelligence notes that any operational technology (OT) disruptions to cold chains accelerates spoilage, turning outages into severe commercial losses. In tropical climates, cold chain integrity is important. An attack on this infrastructure would greatly affect food security by spoiling perishable goods in retail. Furthermore, it also poses a threat to healthcare. Temperature sensitive medicines rely on precise refrigeration systems; compromised cold storage in hospitals or pharmaceutical hubs could greatly affect this.

This incident also highlights that aside from securing traditional information technology (IT) networks, organizations must also secure their OT systems, especially in industries relying heavily on internet-connected industrial devices. Threat actors have been observed scanning the internet for exposed OT devices and specifically targeting devices that can alter settings, change default passwords, and lock facility operators out of their own monitoring systems.

Microsoft’s Monthly Patch - October 2026: 1411 Vulnerabilities Fixed, Including 3 Zero-Days;  23H2 Reaches End of Life

Microsoft released its October 2026 update, which delivers fixes for 1,411 vulnerabilities and addresses three zero-day vulnerabilities. Additionally, Microsoft announced the release of cumulative updates for Windows 11 version 26H2 and issued a reminder regarding the impending end of support for Windows 11 version 23H2 on November 10, 2026.

The highlights of the patch include:

Addressing three zero days, including one actively exploited in attacks and two publicly disclosed. 

• The actively exploited vulnerability is Common Vulnerabilities and Exposures (CVE) 2026-96951 which is a Windows Shell vulnerability
• Two of the publicly disclosed zero-days vulnerabilities include CVE-2026-92707 which is a MessagePack-CSharp Denial of Service vulnerability and CVE-2026-108398 which  is a .NET Framework security feature bypass vulnerability.

Addressing 70 "Critical" vulnerabilities. These include 57 remote code execution (RCE) flaws, 11 elevation of privilege flaws, and 2 spoofing vulnerabilities. Overall, the 1,411 flaws consist of 677 elevation of privilege, 317 RCE, 254 information disclosure, 73 denial of service, 40 security feature bypass, and 28 spoofing vulnerabilities.

Several vendors, including Adobe, Atlassian, Cisco,Citrix, Dell, Docker, Fortinet,Gitlab, Ivanti, Kiteworks, Progress Software, SAP and SonicWall, have also released important security updates in October 2026.

Windows 11 Version 26H2 Release and 23H2 End of Support

Included alongside the security updates, Microsoft released cumulative updates (KB5127648 and KB5126653) for Windows 11 versions, including the newly supported 26H2. These updates bring security fixes, bug resolutions, and new features to versions 26H2, 25H2, 24H2, and 23H2.

Concurrently, Microsoft reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions are reaching their end of support and will stop receiving security updates on November 10, 2026.

Administrators are advised to prioritize applying patches to vulnerable instances and upgrading systems nearing end of support. The list of all vulnerabilities patched for the October 2026 update can be found here.