Skip to content
Friday, October 23, 2026 · Daily edition · Vol. 1, No. 32Practitioner edition

Vol. 1, No. 32Composed Oct 24 · 04:27 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

3 elevated5 stories on the wire

The situation

Ruby Fixes Onigmo Bugs

Ruby releases Onigmo fixes targeting four GitLab RCEs; review regex usage and hunt indicators.

Composed by SitRep’s AI editors from 5 sources — The Hacker News, Unit 42, SecurityWeek, SANS Internet Storm Center, Check Point Research

The Hacker News reports Ruby released 4.0.9, 3.4.12 and 3.3.13 to fix three Onigmo regex‑engine bugs that underpin four GitLab remote code execution flaws. The GitLab fixes map to CVE‑2026‑97229 and CVE‑2026‑110264, creating immediate patch priorities for applications that build Regexp from untrusted input.

Context

Regex construction from untrusted input (Regexp[.]new/union/compile or interpolation) is common in web apps and CI pipelines, increasing blast radius for any service that embeds Ruby regex building. Organizations that integrate with GitLab or run Ruby apps should assume potential remote code execution risk until fixes are applied and regress regex usage is instrumented.

“SitRep judges that defenders must treat platform‑level fixes and package provenance as equally urgent.”
From the analysis
The move

5 things to do today

  1. Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 where applicable and prioritize apps that construct Regexp from untrusted input (addresses CVE‑2026‑97229 and CVE‑2026‑110264).
  2. Apply PHP2Shell vendor patches for CVE‑2026‑109618 and CVE‑2026‑109619 immediately on internet‑exposed hosts; isolate or block PHP hosts that cannot be patched.
  3. Set session.upload_progress.enabled=0 on PHP hosts until the new fixes (including CVE‑2026‑115560) are confirmed applied and hunt for signs of session_upload_progress usage.
  4. Revoke and block LiteLLM v1.107.0 in package registries, scan environments for installations of v1.107.0, and hunt for outbound connections to litellm[.]dev and anomalous token exfiltration.
  5. Update Arista VCO to the vendor fixed releases addressing CVE‑2026‑114625 and restrict VCO access to management networks and IP allowlists while investigating for indicators tied to attacker IPs 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151.

On the wire

  • 0critical
  • 3elevated
  • 2moderate
  • 0low
P2Patch

Ruby Ships Onigmo Bug Fixes

CVE‑2026‑97229 · CVE‑2026‑110264 · Ruby 4.0.9, 3.4.12, 3.3.13

Ruby released updates addressing three Onigmo regex‑engine bugs that underlie four GitLab remote code execution issues. Applications that build Regexp from untrusted input are exposed to RCE when using Regexp[.]new, Regexp[.]union, Regexp[.]compile, or interpolation.

THE HACKER NEWS · Ruby Fixes Onigmo Bugs Causing Four GitLab RCE Flaws

Copy link to “Ruby Ships Onigmo Bug Fixes”

P1Exploit

Unit 42 Details Active PHP2SHELL Exploitation

CVE‑2026‑109618 · CVE‑2026‑109619 · post‑exploit agentic activity observed

Unit 42 reports active exploitation of PHP2Shell RCEs and identifies roughly 22.6 million exposed instances in at least one offline government case, with post‑exploit activity linked to agentic AI platforms.

UNIT 42 · Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploitation

Copy link to “Unit 42 Details Active PHP2SHELL Exploitation”

P1Mitigation

SANS Assesses PHP2SHELL Exploitability Constraints

Exploit PoCs require memory and single‑worker conditions · mitigation guidance available

SANS ISC analysis shows public PoCs rely on specific memory limits and single‑worker PHP deployments to leak heap and libphp[.]so addresses, making reliable exploitation harder in many real‑world setups; disabling session.upload_progress is an effective interim control.

SANS INTERNET STORM CENTER · Assessing php2shell Exploitability and Real-World Constraints in PHP

Copy link to “SANS Assesses PHP2SHELL Exploitability Constraints”

P2Infostealer

Aokigahara Targets AI Tools and Cloud Credentials

Targets AI session tokens, developer tools, and cloud credentials · browser and clipboard theft

Check Point Research describes Aokigahara, an infostealer that collects AI session tokens, browser data, wallets and cloud credentials, enabling potential unauthorized access to paid AI services and cloud resources.

CHECK POINT RESEARCH · Aokigahara Infostealer Targets AI Tools and Cloud Credentials

Copy link to “Aokigahara Targets AI Tools and Cloud Credentials”

Indicators named in this edition

KindValueNote
IP74[.]82[.]197[.]86Observed attacker IP targeting Arista VCO
IP38[.]54[.]50[.]151Observed attacker IP targeting Arista VCO
DOMAINlitellm[.]devExfiltration domain used by compromised LiteLLM packages

Elsewhere in the edition

Quest Diagnostics Reports Data Breach Exposing Patient Records

Quest Diagnostics disclosed unauthorized access to its Quanum LSM system, with some patient records potentially exposed. Access to Essential Insights and LabHQ paused; Quanum LSM halted, and customers were advised to use paper requisitions or Quanum eLabs. Incident learned Oct 21, 2026; Quest serves about one in three US adults, with 7,700 sites and 65,000 employees.

3 reports

Capcom Data Breach Impacts 11 Million Email Addresses

Capcom disclosed a data breach affecting CAPCOM ID, impacting 11,774,247 email addresses and limited personal data for 43 users. Passwords were reset for 196 accounts; no user passwords were compromised. Incident discovered Oct 19; services remain available as Capcom investigates and contacts affected customers, warning of phishing and impersonation emails.

3 reports

PHP Shares Mitigation for New Unpatched RCE Vulnerability

The PHP team provides mitigation for a new unpatched RCE flaw (CVE-2026-115560) affecting non-default configurations, alongside existing PHP2Shell CVEs (CVE-2026-109618/109619). Set session.upload_progress.enabled=0 to mitigate until patches arrive. Over 5.1 million PHP hosts exposed online, ~3.8 million with ports open. Patches for PHP2Shell released; details from Oct 23, 2026.

2 reports

Russian-Linked Hackers Use Mesh Backdoor in Ukraine Attack

ESET links Russian-aligned Sandworm and UAC-0099 (Earth Sirrush) to a 2025 Ukraine operation. Initial access via spearphishing led to MATCHWOK and then MythicRatatoskr backdoor communicating with a Yggdrasil-based C2. The backdoor, with a 10-minute startup delay, enables data exfiltration, command execution, and a SOCKS5 proxy, preceding a Sandworm data wipe using SDelete via AD GPO.

2 reports

Researchers Demonstrate Node2Shell RCE on Node.js Brotli Data

Imperva demonstrated Node2Shell, a proof-of-concept that executes attacker code on an official Node[.]js 24.22.0 Linux arm64 image via crafted Brotli data (CVE-2026-111497). Node[.]js fixed the flaw in 24.22.1 on Oct 21. The issue affects 22.x, 24.x, and 26.x lines; test coverage was limited to one build and Linux arm64.

2 reports

Also reported

End of today’s edition.

Colophon

SitRep · Vol. 1, No. 32

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.