Bare Metal Cyber Weekly Roll-Up — October 23, 2026
This partial-week edition covers a sharp collision between public-service disruption, trusted cloud access, and software supply-chain risk. Government agencies took vulnerable PHP services offline as attacks spread, showing how quickly an internet-facing runtime problem can become a citizen-service issue. A ConnectWise path then gave a China-aligned group high-speed access attempts against Microsoft 365 customers, with AI helping scale familiar identity abuse. Meanwhile, a poisoned LiteLLM release put cloud, developer, and AI credentials at risk across multiple operating systems. The issue also tracks ransomware pressure on critical organizations and a Railway incident that may expose secre…
This week's stories:
- Government services go dark as attacks spread across PHP servers
- Trusted ConnectWise access speeds AI-driven Microsoft 365 attacks
- Poisoned LiteLLM release puts cloud and developer secrets at risk
- SafePay ransomware reaches 600 critical infrastructure organizations
- Railway incident exposes secrets that unlock connected cloud services
- Internet-facing GitLab servers face urgent takeover risk
- Japan cloud shutdown disrupts workloads across nearly 27,000 servers
- Crime-tip breach exposes identities and forces Toronto service offline
- Weak certificate keys undermine trust across browsers and software
- Ransomware crews turn trusted VPN access into a stealthy foothold
- Stolen management keys put 400,000 WordPress sites at risk
- Capcom breach exposes account data for 11.7 million users
- Autonomous AI agents accelerate real-world intrusion campaigns
- Active Plex attacks turn home media servers into privileged footholds
- Active VeloCloud attacks threaten control of managed networks
More cybersecurity coverage at BareMetalCyber.com.
