The attackers did not get more creative this week. They just got more efficient at living off your perimeter and your “temporary” secrets, which somehow stayed temporary for two years.

Today's Top 5

1. 600+ SafePay victims documented: A new joint advisory puts real numbers behind a very boring truth: old edge CVEs and weak VPN auth still scale. The most interesting detail is where they keep showing up from. Source
2. 3.2M Zeabur env vars exposed: Zeabur says attackers reused leaked internal credentials to access shared clusters and read environment variables at massive scale. The story gets darker when you think about what tends to live inside env vars. Source
3. PHP2Shell unauth RCE patched: Two critical PHP use-after-free bugs just went from “leaked rumor” to emergency release, and everyone running old PHP is now playing patch roulette. The question is how fast exploit tooling commoditizes. Source
4. Nextcloud servers backdoored via Collabora: A critical command injection in the built-in CODE server app is being exploited to plant persistent access on Nextcloud. The kicker is that turning the app off is not the same as removing risk. Source
5. Bullhorn outages meet PHP panic: Bullhorn is trying to separate its earlier cyber incident from the PHP emergency, but the operational effect is the same for customers: forced downtime, rushed security steps, and a perfect window for impersonation scams. Source

Why today matters: Today’s biggest incidents are not “advanced.” They are high-throughput. Credential reuse into cloud control planes, edge-device footholds, and commodity web RCEs are converging into one outcome: attacker speed beats your change window. If you run internet-facing PHP, VPNs, or file-collab stacks, assume you are on someone’s spreadsheet already.

XERJ Corpus Hub: Working the PHP2Shell emergency (CVE-2026-109618/109619)? An AI agent loading ghsa-db can pull the linked GitHub advisories, extract affected version ranges, and auto-generate a precise “is this vulnerable” checklist for your fleet and container base images in minutes. Then grab another corpus at hub.xerj.org.

Alright, let’s get into the receipts.

Data Breaches

1. Zeabur discloses breach exposing 3.2M environment-variable records: Developer hosting platform Zeabur said an attacker used compromised internal credentials to access shared clusters and some dedicated servers, reading service environment variables and account/project data. Zeabur also said it plans to wind down operations by year end. Source: Zeabur
2. UltraMobile Imaging reports HHS breach affecting 75,000 people: A new HHS/OCR listing indicates a hacking/IT incident affecting roughly 75,000 individuals. Details are still thin publicly, but healthcare disclosures tend to get worse with time, not better. Source: Federman & Sherwood
3. Green Clinic confirms ransomware disrupted care in Louisiana: Green Clinic in Ruston, Louisiana said a ransomware attack detected Oct. 2 encrypted files and systems, taking EHR workflows offline and forcing degraded operations while recovery continued. Source: Dysruption Hub
4. Ahold Delhaize cyber incident: brands’ sites and apps taken offline: Ahold Delhaize said it detected malicious activity and proactively took systems offline, impacting websites and apps across Europe and the U.S. while stores stayed open. The company said it had no evidence at the time that sensitive customer, associate, or partner data was taken. Source: Ahold Delhaize
5. Law-firm leak-site claim: MVJ LLP listed with 1.66TB “Big Data”: Brain Cipher’s leak-site listing claims 1.66TB and over 500k files tied to a law firm domain, including references to court cases and client work. Treat as unverified until the victim confirms, but assume downstream clients will get extorted next. Source: Ransomnews

Security Research

1. Joint advisory: SafePay ransomware TTPs, IOCs, and mitigations: CISA, FBI, USSS and European partners published a detailed SafePay advisory, saying the group has impacted at least 600 organizations since Aug 2024. Initial access includes exposed credentials, brute force, phishing, and exploitation of edge and backup CVEs. Source: CISA
2. Akamai analysis: critical PHP RCE flaws and mitigations: Akamai published technical notes around the emergency PHP release and recommended rapid upgrades, with WAF coverage guidance for teams that cannot patch instantly. Source: Akamai
3. Rapid7 ETR on PHP2Shell (CVE-2026-109618/109619): Rapid7 summarized impact, exposure considerations, and operational guidance for vulnerability management programs reacting to the emergency PHP releases. Source: Rapid7
4. Nextcloud Collabora built-in CODE app RCE exploited for backdoors: Reporting indicates active exploitation of CVE-2026-110447 via a proxy endpoint to trigger OS command injection, leading to persistence on Nextcloud servers. If you run the built-in app, patching and validation matter more than “disabling.” Source: BleepingComputer
5. SonicWall SMA1000 pre-auth SSRF: exploitation attempts observed: Security reporting notes exploitation attempts consistent with CVE-2026-102255 shortly after disclosure. Edge appliances keep getting treated like “set and forget,” and attackers love that. Source: SecurityWeek
6. WordPress Bricksforge RCE: post-patch cleanup warning: Community guidance stresses that updating Bricksforge may not remove already-uploaded backdoors. This is the uncomfortable part of plugin exploitation: remediation includes forensics, not just version bumps. Source: Bricks Community Forum

Top CVEs

1. CVE-2026-109618: One of two critical PHP core vulnerabilities addressed in the emergency October 21 releases, enabling unauthenticated remote code execution under affected configurations. Inventory any bundled PHP inside appliances and containers, not just your web tier. Source
2. CVE-2026-109619: Companion PHP critical use-after-free/RCE issue tied to worker process state reuse and error handling. Treat internet-facing PHP as “likely scanned today,” not “maybe later.” Source
3. CVE-2026-110447: Command injection in Collabora Online built-in CODE server app for Nextcloud (richdocumentscode) that has been exploited to backdoor servers. If you run Nextcloud, confirm whether this optional app is deployed and at what version. Source
4. CVE-2026-102255: Pre-auth SSRF affecting SonicWall SMA 1000 series Work Place interface, widely tracked due to observed exploitation attempts after disclosure. Patch fast, then review logs for suspicious outbound requests from the appliance. Source
5. CVE-2026-76519: Cisco Secure Email Gateway arbitrary file write that can lead to root command execution, with Cisco noting active exploitation. Email security gateways have become initial access infrastructure, not just “mail plumbing.” Source

Podcasts & Talks

1. SANS Stormcast (Oct 21, 2026): PHP emergency release, FortiSIEM PoC, more: A tight daily listen that helps CISOs separate “Twitter panic” from what actually shipped and what’s likely to be exploited next. Listen: SANS Internet Storm Center

Final Words

The pattern today is speed and reuse. The same playbook keeps winning: get in through edge auth or an appliance, harvest secrets from env vars or configs, then turn those secrets into lateral movement and extortion. The uncomfortable implication most coverage misses is this: your patch program is only as strong as your asset inventory of things you forgot you owned.

This week, do three things:

• Patch PHP everywhere you run it to fixed versions for CVE-2026-109618 and CVE-2026-109619, including vendor appliances, Docker base images, and control panels, then validate externally that the old version is gone.
• Audit Nextcloud deployments for the Collabora built-in CODE server app and patch or remove it if present, then hunt for post-exploitation artifacts tied to CVE-2026-110447.
• Run an “edge triage” sprint against the SafePay advisory list, prioritizing VPN and backup products implicated in AA26-293A, and enforce MFA plus lock down exposed management interfaces.

Your turn: If SafePay hit you tomorrow through an old VPN edge hole, do you know which team owns that box, and can they patch it within 24 hours without a meeting? Hit reply to this email with your honest answer, or drop a comment on the web version. I read every reply.

Know someone still treating env vars like “not real data”? Forward them the Zeabur story, it costs 30 seconds and it might save them a quarter. If this was forwarded to you, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!