The fastest incident responders I know are not “doing more alerts”. They are collapsing time, from leak to notice to exploit chain, and deciding what to ignore on purpose.

Today's Top 5

1. Del Monte breach notice filed: Del Monte Foods Corporation II Inc. just filed a breach notice with the California AG, and the clock starts now for what else that access touched. Source
2. 25 PHP2Shell-popped servers: Researchers tied the PHP2Shell duo to a campaign that breached 25 servers, including government-linked environments, and the operator tooling hints at faster automation than last week. Source
3. Linux KEV turns foothold into root: CISA added a Linux kernel bug to KEV and explicitly calls out chaining it with PHP2Shell to land a webshell and then climb to root, which is the part defenders keep underestimating. Source
4. Cisco CVE exploited in the wild: Canada’s cyber centre published a Cisco advisory stating a specific CVE is being exploited, which is your cue to stop debating severity and start tracking exposure and logs. Source
5. Bangkok Bank NY branch notice: A breach notice for Bangkok Bank’s New York Branch hit the California AG list, and the writeup points at vendor-connected audit work as the pivot point. Source

Why today matters: You can feel the new attacker rhythm: initial access is cheap, and privilege escalation is now “a checkbox” once they have any code running. The defensive gap is not patch speed alone, it is whether your incident workflow treats web, kernel, and vendor access as one connected kill chain.

XERJ Corpus Hub: If CVE-2026-46300 is now on your KEV shortlist, an AI agent loading vuln-fix-commits can pull the relevant upstream fix patterns, spot backport commits for your kernel branches, and draft a “which fleets can actually take this update” rollout note in minutes. Grab another corpus at hub.xerj.org.

Alright, let’s get concrete.

Data Breaches

1. Del Monte Foods Corporation II Inc. breach notice (CA AG filing): Del Monte Foods Corporation II Inc. filed a sample breach notice with the California Attorney General. The filing lists a breach date of February 7, 2026, with the notice posted October 29, 2026, which is a long dwell window in plain sight. Source: California DOJ (AG breach portal)
2. Bangkok Bank PCL, New York Branch breach notice: Bangkok Bank’s New York Branch appears on the California AG portal (reported October 29, 2026). Reporting indicates the incident is tied to an audit vendor relationship, which is exactly where access reviews go to die. Source: CISONews.net
3. GMO Internet customers told to disconnect PCs after attack: Japanese internet giant GMO warned customers after disclosing a cyberattack involving malware in some customer environments, alongside a ransomware threat and data exposure concerns. The customer-facing guidance is unusually blunt, which suggests messy containment. Source: TechRadar

Security Research

1. PHP2Shell exploitation and the “25 servers” case study: Reporting links active exploitation of the PHP2Shell pair to compromises across 25 servers, including a government-affiliated environment, with hints that operator tooling and automation are accelerating. Treat this as evidence that exposure scanning plus rapid weaponization is the baseline now. Source: Tom’s Guide
2. CISA warning: Linux kernel KEV can be chained with PHP2Shell: CISA added CVE-2026-46300 to KEV and explicitly notes chaining with PHP2Shell to implant webshells and run commands as root. That is a defender hint: watch for “web bug first, kernel bug second” playbooks. Source: BleepingComputer
3. Another PHP issue: CVE-2026-115560 (session upload progress): A new PHP advisory covers CVE-2026-115560, and reporting notes it is not getting the same emergency patch posture as the original PHP2Shell pair. If you run PHP at scale, assume attackers will probe “the next weird edge” immediately after the headline bugs. Source: TechRadar
4. CISA urges patching after PHP exploits observed: CISA is pushing agencies (and everyone else) to patch after observing exploitation of the PHP2Shell CVEs. If your patch window is still “next sprint”, you are already late relative to attacker economics. Source: ITPro
5. Cisco advisory: exploited-in-the-wild signal: Canada’s alert-advisory pipeline posted a Cisco item stating a named CVE is exploited in the wild. It is a reminder that exploitation signals increasingly come from national CERT channels, not vendor marketing blogs. Source: Canadian Centre for Cyber Security

Top CVEs

1. CVE-2026-109618: One of the two “PHP2Shell” flaws, observed exploited in the wild, with active patch directives and real-world compromises. If PHP is on your internet edge, assume scanning started before your change ticket was opened. Source
2. CVE-2026-109619: The second PHP2Shell vulnerability, paired with CVE-2026-109618 in exploitation reporting and patch guidance. Treat these as “mass compromise enablers”, not as app-team backlog items. Source
3. CVE-2026-46300: Linux kernel flaw added to CISA KEV on October 28, 2026, with reporting that it can be chained with PHP2Shell to move from web execution to root. If you have shared hosting, containers, or noisy multi-tenant Linux, prioritize this higher than your gut wants to. Source
4. CVE-2026-76418: Cisco CVE flagged as exploited in the wild in an Oct 29, 2026 advisory. Even if you patch fast, plan on post-patch verification because exploiters love “already owned” devices. Source
5. CVE-2026-115560: A newly discussed PHP session upload progress bug. It is not “the same as PHP2Shell”, but it is the kind of adjacent PHP surface that gets hammered right after the big CVEs make headlines. Source

Podcasts & Talks

1. SANS Stormcast (Oct 27, 2026): Apple patches 304 vulns and Brotli fixes: A tight recap worth handing to an exec who wants “what matters” without the drama, including Apple’s big patch drop and how teams are responding to the Brotli issue. Listen: Apple Podcasts

Final Words

The uncomfortable pattern today is that breaches are becoming “slow paperwork” while exploitation is “fast physics”. The org that wins is the one that treats a web RCE, a kernel LPE, and a vendor audit account as one story, because attackers already do.

This week, do three things:

• Patch PHP for CVE-2026-109618 and CVE-2026-109619, then hunt for new unexpected child processes and outbound connections from php-fpm or Apache worker contexts.
• Prioritize Linux kernel remediation for CVE-2026-46300 on any host that also runs exposed PHP workloads, and validate you can actually deploy the fixed kernel versions in your maintenance window.
• Inventory and patch Cisco assets implicated by CVE-2026-76418, then review authentication logs and configuration changes for signs the device was already used as an initial access pivot.

Your turn: If a breach notice for one of your vendors landed today, could you answer, in one sentence, what that vendor account can access in prod, or would you need a week and three meetings? Hit reply with your take, or drop a comment on the web version. I read every reply.

Know someone who still thinks “patch PHP” is the whole PHP2Shell story? Forward them this issue, because the real risk is the chain to root. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!