1. An AI agent that hacked a government in two hours

Attackers used an agentic AI attack platform to go from exploiting the PHP2Shell bugs to holding a European government entity's password hashes and multi-factor authentication secrets in about two hours, according to Palo Alto Networks' Unit 42. In the same window they set up an NTLM relay tunnel into Active Directory and tried to escalate to Domain Admin. Unit 42 did not name the victim or say whether that last step worked.

The giveaway was in the commands: every batch was wrapped in section headers such as ==SHELLUSER== and ==PASSWD==, which Unit 42 says "produce machine-parseable output for an AI model to read". The tasks were short, spaced out one after another, and the attacker pivoted quickly whenever something failed — which Unit 42 calls "strong indicators of an agentic attacker". Put plainly, a model appeared to be reading each step's output and choosing the next one.

2. Collabora zero-day: patch by 26 October

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-110447 to its Known Exploited Vulnerabilities catalogue, warning that attackers are exploiting a critical command-injection flaw (rated CVSS 9.2) in Collabora Online's built-in CODE Server, used with Nextcloud's Development Edition. Reported attacks date back to September 2026, with attackers deploying PHP web shells and searching compromised systems for credentials and cryptocurrency wallets. CISA set 26 October 2026 as the deadline for US federal civilian agencies to remediate. The flaw does not affect standalone Collabora servers — administrators must check their exact deployment.

3. LiteLLM: breached 11 days before the malicious releases

Research from Socket found that the LiteLLM supply-chain attack was worse than the seven malicious Python wheels published on 21 October 2026. Attackers accessed the project's GitHub organisation at least 11 days earlier, running credential-stealing GitHub Actions workflows on 10 and 12 October disguised as routine maintenance ("ci: bump cache config") that harvested authentication tokens, cloud credentials and API keys from continuous-integration environments. Those stolen credentials then helped manipulate the release pipeline.

What to do now

Patch PHP to the fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) and check whether your setup changes the session serialise handler at runtime — PHP has also warned of a second, unpatched remote-code path tied to session upload progress in that narrow configuration. Patch Collabora CODE Server or isolate it, audit LiteLLM versions and containers, and rotate any credentials that could have been exposed in CI. If you run a website, patch first and investigate second: these attacks moved in hours, not weeks.

Sources: Palo Alto Networks Unit 42 via Cyberpresso; CISA KEV via Undercode News; Socket via Undercode News; CyberRecaps daily roundup, 24 October 2026.