Bare Metal Cyber

Bare Metal Cyber Magazine Weekly Roll-Up — Week ending 2026-10-23

Partial-week edition: based on 3 verified Daily issues dated 2026-10-21, 2026-10-22, 2026-10-23. Other weekdays are not covered.

This partial-week edition covers a sharp collision between public-service disruption, trusted cloud access, and software supply-chain risk. Government agencies took vulnerable PHP services offline as attacks spread, showing how quickly an internet-facing runtime problem can become a citizen-service issue. A ConnectWise path then gave a China-aligned group high-speed access attempts against Microsoft 365 customers, with AI helping scale familiar identity abuse. Meanwhile, a poisoned LiteLLM release put cloud, developer, and AI credentials at risk across multiple operating systems. The issue also tracks ransomware pressure on critical organizations and a Railway incident that may expose secrets used far beyond the original platform. Across these stories, the recurring challenge is trust: trusted software, trusted integrations, trusted credentials, and trusted recovery systems can all become attack paths. Direct story links are collected at the bottom of the article. Read the issue for practical actions your team can take now.

Government services go dark as attacks spread across PHP servers
Government services went offline as agencies disconnected vulnerable PHP systems during a surge in attack activity. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution. No central UK government compromise was confirmed. Other governments also disconnected sites while patches and mitigations were applied. The affected weaknesses can let unauthenticated attackers run code before application logic begins.
What this means: PHP has a vast internet-facing footprint, including many end-of-life installations that will not receive fixes. Even crude attempts can crash services, while successful attacks may expose systems and secrets. For leaders: controlled downtime may be safer than leaving an unpatched public service online. For defenders: watch web and server logs for unusual request patterns, crashes, and command execution around the disclosure window. Asset inventories should also reveal unsupported runtimes that normal application ownership misses. The larger lesson is that finding every exposed system can take longer than applying the patch.
Recommendation: Inventory every PHP system, patch supported releases, and disconnect exposed systems that cannot be secured.

Trusted ConnectWise access speeds AI-driven Microsoft 365 attacks
Customer access and service availability were disrupted after attackers used a ConnectWise supply-chain path to reach Microsoft 365 environments. The campaign targeted more than 2,250 tenants and generated up to 2,900 sign-in attempts per minute. A China-aligned group used the ARTEX agentic AI framework to speed scanning, password spraying, and OAuth abuse. Highly privileged third-party access gave the attackers a route into downstream customers. ConnectWise shut down services temporarily and began a phased restoration.
What this means: AI supplied speed, but trusted application credentials supplied reach. Successful authentication does not prove data access, and the number of compromised customers remains undisclosed. For leaders: this incident combines third-party outage risk with cloud identity risk. For defenders: review sign-in logs, OAuth applications, service-principal credentials, directory changes, groups, and privileged roles. Signals may appear as bursts of non-interactive sign-ins or unexpected application credential additions in Microsoft 365 audit records. The larger lesson is that trusted integrations can become high-speed attack routes across many organizations.
Recommendation: Keep affected connections disabled until cleared, then audit Microsoft 365 identities and applications before restoring trust.

Poisoned LiteLLM release puts cloud and developer secrets at risk
Developer systems and AI services may have exposed valuable credentials after running LiteLLM 1.107.0. Attackers compromised its release pipeline and inserted malware into Python packages and affected container images. The payload ran through Python startup hooks across Windows, Linux, and macOS. It stole browser data, cloud credentials, AI provider keys, SSH keys, and other secrets. The poisoned packages were removed, but affected machines may still contain persistence or stolen credentials.
What this means: Routine Python or pip activity could activate the malware, so ordinary investigation may increase exposure. Updating the package alone may leave startup files, loaders, or compromised secrets behind. For leaders: affected systems should be treated as compromised rather than merely outdated. For defenders: isolate and rebuild exposed systems, then rotate credentials from a clean environment. Signals may appear as unexpected Python startup files, outbound connections, or unauthorized use in cloud and developer audit logs. The larger lesson is that a brief package compromise can create durable access across several trust domains.
Recommendation: Identify every LiteLLM 1.107.0 installation, rebuild affected systems, and rotate all accessible secrets from a clean environment.

SafePay ransomware reaches 600 critical infrastructure organizations
At least 600 critical infrastructure organizations worldwide have been affected by SafePay ransomware since August 2024. The group enters through exposed credentials, password attacks, phishing, VPN access, and weaknesses in internet-facing edge devices. It steals data before encrypting systems. SafePay also pressures victims with leak threats and direct calls. Recovery can be disrupted by deleted shadow copies and reset network storage holding backups.
What this means: Victims span multiple critical sectors across North America, South America, Europe, and Australia. Double extortion means organizations must manage restoration and possible data exposure together. For leaders: recovery plans are unreliable when attackers can reach backup systems. For defenders: strengthen identity controls, restrict administration tools, patch edge systems, and protect offline immutable backups. Watch authentication logs for unusual VPN access and backup consoles for deletion or reset activity. The larger lesson is that ransomware still succeeds through familiar identity and access gaps.
Recommendation: Secure internet-facing access, enforce multifactor authentication, restrict administrative tools, and verify that production accounts cannot alter protected backups.

Railway incident exposes secrets that unlock connected cloud services
Customer applications may be exposed after suspicious activity reached Railway systems that store environment variables. An unauthorized third party may have accessed encrypted variables and obtained some decrypted values. Potentially affected data includes API keys, database passwords, private registry credentials, and cloud credentials. Railway paused deployments during the investigation and urged all users to rotate secrets. The number of affected accounts and the access method remain unknown.
What this means: Stolen environment variables could unlock databases, cloud accounts, source repositories, registries, and AI services beyond Railway. The deployment pause may also delay customers from applying replacement credentials. For leaders: one platform incident can spread into several connected business systems. For defenders: rotate every stored secret and review each connected service for unauthorized use. Signs may appear as unfamiliar API calls, logins, or token use in cloud, database, and source-control audit logs. The larger lesson is that centralized configuration stores can become concentrated maps of downstream access.
Recommendation: Rotate all Railway-stored credentials, invalidate active sessions where possible, and review connected service logs for misuse.

Internet-facing GitLab servers face urgent takeover risk
Source code and delivery workflows are at risk on unpatched self-managed GitLab servers. Under certain conditions, an unauthenticated user could execute arbitrary code through a specially crafted regular expression. The issue affects Community and Enterprise editions across a broad release range. GitLab.com and specified Dedicated environments were already protected. More than 2,700 Community Edition instances were visible online, although active exploitation was not reported in the supplied evidence.
What this means: A compromised GitLab server could expose source code, secrets, accounts, and software delivery workflows. The release also addresses account takeover, authorization, identity-flow, and information-exposure issues. For leaders: internet-facing development infrastructure deserves the same emergency priority as other production systems. For defenders: confirm the deployment type, apply the fixed release, and run the available detection checks. Watch application and system logs for unexpected processes, new accounts, or unusual repository access. The larger lesson is that development platforms are production-critical security infrastructure.
Recommendation: Upgrade every affected self-managed GitLab instance and run the published detection checks on exposed servers.

Japan cloud shutdown disrupts workloads across nearly 27,000 servers
Customer workloads stopped after Japan’s Onamae Desktop Cloud shut down systems across every service plan to contain an intrusion. Up to 26,739 servers were listed as potentially affected, not confirmed infected. An unauthorized party installed malicious programs in some customer environments. Data stored on affected systems may have been viewed, although theft was not confirmed. No restart date was provided in the supplied evidence.
What this means: Customers face both prolonged availability problems and uncertainty about credentials stored on hosted systems. Continuously running workloads may remain unavailable while containment and recovery continue. For leaders: a provider-wide security action can interrupt every dependent business process at once. For defenders: rotate stored credentials and inspect connected accounts before restoring workloads. Watch identity logs for unusual access and official service notices for verified restoration instructions. The larger lesson is that cloud concentration can turn necessary containment into a broad operational event.
Recommendation: Replace credentials stored or used on affected servers and verify connected accounts before restoring workloads.

Crime-tip breach exposes identities and forces Toronto service offline
Toronto residents lost an anonymous crime-reporting channel after the local service halted operations over exposed tip data. More than 1.5 million tips from Canadian chapters were involved, and about half contained personal information. The Toronto chapter identified 176,859 local tips and 14,973 names. It could not determine whether those names belonged to tipsters or suspects. Some records dated back as far as 25 years.
What this means: Broken anonymity can expose people to retaliation and discourage future reporting. The long retention period increases the possible human, legal, and trust consequences. For leaders: privacy promises must be supported by technical controls, limited retention, and vendor oversight. For defenders: suspend collection until anonymity is verified and map where identifying data is stored. Warning signs include tip records containing names and vendor systems retaining fields beyond the stated purpose. The larger lesson is that privacy failures can create direct safety risks, not merely compliance problems.
Recommendation: Suspend collection until anonymity is independently verified and reduce retained identifying data to the minimum required.

Weak certificate keys undermine trust across browsers and software
Trust across websites, software, and encrypted connections was weakened after eight eMudhra intermediate certificates were found to use extremely weak private keys. The keys could be reconstructed by testing only 256 possible values in under a second. Six certificates covered web encryption and two covered code signing. Major browsers and software ecosystems blocked the affected trust paths, and the certificates were revoked. No malicious use or related breach was confirmed.
What this means: Applications with separate, embedded, or stale trust stores may remain exposed after major browsers are protected. VPNs, proxies, containers, developer tools, and embedded devices may handle revocation differently. For leaders: this is a software-stack inventory problem as well as a certificate incident. For defenders: update operating systems, runtimes, containers, firmware, applications, and independent trust stores. Certificate validation errors may appear in application logs, while inventory scans can identify embedded or outdated trust paths. The larger lesson is that one key-generation failure can spread across an entire software ecosystem.
Recommendation: Inventory embedded certificate stores and update every client, runtime, container, and device that may still trust the affected chains.

Ransomware crews turn trusted VPN access into a stealthy foothold
Organizations may already have unauthorized VPN sessions that look like legitimate remote work. Ransomware operators were linked to exploitation of a patched GlobalProtect authentication bypass. Attackers used the access to bypass multifactor authentication and enter corporate networks. In one investigation, they moved toward virtualization infrastructure and extracted credentials from a domain controller’s virtual disk. Patching closes the weakness but does not remove sessions or access established earlier.
What this means: Trusted gateway traffic can hide an attacker among ordinary remote connections. Established sessions may survive after administrators install the update. For leaders: successful gateway connections should be treated as possible incidents, not only a patching problem. For defenders: terminate active sessions and investigate successful connections made before remediation. Signals include logins from unusual locations and later access to virtual infrastructure in VPN and identity logs. The larger lesson is that trusted remote access can become a quiet ransomware entry point.
Recommendation: Patch affected deployments, terminate active VPN sessions, and investigate successful connections made before remediation.

Stolen management keys put 400,000 WordPress sites at risk
WordPress sites were backdoored through valid UpdraftCentral management keys stolen after unauthorized access to vendor infrastructure. Attackers used the keys to install malicious plugins and create administrator access. Around 400,000 websites may have held an UpdraftCentral or Migrator key and therefore faced potential exposure. Current WordPress and plugin versions did not block commands signed with valid keys. Replacing vendor-side credentials does not clean sites already changed.
What this means: Central dashboard access can turn one vendor incident into risk across many websites. At least 99 malicious backdoor plugin names were recorded, and successful installation was found on two sites. For leaders: valid third-party credentials can bypass normal patch-based defenses. For defenders: delete old connection keys, inspect files and logs, and recover changed sites from clean backups. Signals include unfamiliar administrator accounts and newly installed plugins in WordPress dashboards and server logs. The larger lesson is that trusted management access requires independent monitoring and rapid revocation.
Recommendation: Update UpdraftPlus, delete existing connection keys, and investigate every connected site for unauthorized plugins or administrator accounts.

Capcom breach exposes account data for 11.7 million users
Account data tied to more than 11.7 million Capcom users was exposed. The information included email addresses, account creation dates, last-login times, login counts, and last-login IP addresses. Attackers changed passwords for 196 accounts. Smaller groups had additional profile details exposed. Payment card data and most passwords were not affected, and online services remained available.
What this means: The exposed details can support targeted phishing and convincing account-themed messages. Login history and account age can make fraudulent support requests appear more credible. For leaders: non-payment account data still carries meaningful fraud and trust risk. For defenders: strengthen account recovery controls and prepare users for impersonation attempts. Warning signs may appear as fake support messages in email gateways or unusual password resets in account logs. The larger lesson is that behavioral metadata can be as useful to social engineers as basic identity data.
Recommendation: Warn affected users, strengthen account recovery monitoring, and block messages that imitate Capcom support or request more information.

Autonomous AI agents accelerate real-world intrusion campaigns
Organizations in healthcare, government, software services, and data centers faced intrusion campaigns run with varying levels of AI autonomy. Four previously unreported actors used exposed frameworks that could choose actions and execute commands at machine speed. Some frameworks assigned work to several agents. Others gave one coding assistant broad control over an intrusion workflow. The evidence indicates that baseline offensive operations are becoming easier to automate.
What this means: AI use now extends beyond writing malicious code or producing phishing material. Automated decision-making can compress the time between initial access, discovery, and follow-on action. For leaders: response timelines built around human attacker speed may no longer be sufficient. For defenders: monitor identities, tools, and command execution rather than making assumptions about attacker skill. Signals may appear as rapid sequences of account changes, tool launches, and commands in endpoint and cloud logs. The larger lesson is that established attack methods become more dangerous when operational choices can be automated.
Recommendation: Build detections and response authority for rapid multi-stage activity that may unfold without continuous human control.

Active Plex attacks turn home media servers into privileged footholds
Internet-accessible Plex servers are being turned into elevated footholds through a chain of four weaknesses. Attackers can obtain administrator tokens and run code with elevated privileges. Exploitation reports began on October 17, and early honeypot activity deployed a cryptocurrency miner. Public technical details and proof-of-concept code may enable more attacks. Plex Media Server versions before 1.43.3.10861 are affected.
What this means: An exposed media server can give attackers access that extends beyond the application itself. Personal or lightly managed systems may still share networks, credentials, or devices with organizational resources. For leaders: familiar consumer software can create business exposure when ownership and patching are unclear. For defenders: locate exposed Plex servers, update them, and investigate previous activity. Signals include unexpected administrator tokens, mining processes, or unusual resource use in Plex and system logs. The larger lesson is that low-priority software can become a privileged entry point when exposed to the internet.
Recommendation: Update Plex Media Server to version 1.43.3.10861 or later and investigate every previously exposed system.

Active VeloCloud attacks threaten control of managed networks
Managed networks are at risk because attackers are targeting on-premises VeloCloud Orchestrator systems through a newly patched issue. A basic authenticated user with web-interface access could gain operator privileges. Successful exploitation could expose orchestrator data and internal management functions. It could also enable configuration changes that disrupt connected networks. Hosted deployments were patched, but on-premises customers must apply updates themselves.
What this means: A network-management portal provides a powerful position for changing configurations and affecting connectivity. The risk is concentrated in on-premises systems whose owners control patching and interface exposure. For leaders: management-plane compromise can create organization-wide operational disruption. For defenders: patch the orchestrator, restrict its web interface, and preserve logs before remediation when compromise is suspected. Watch web and administrator logs for new operator privileges, unusual logins, or unexpected configuration changes. The larger lesson is that basic account access can become broad control when management systems are exposed.
Recommendation: Patch on-premises VeloCloud Orchestrator, restrict its web interface, and review recent administrator activity for misuse.

That’s this week’s Bare Metal Cyber Magazine Weekly Roll-Up. If this helped you decide faster, pass it along to a teammate. For more newsletters, audio courses, videos, and merch, visit BareMetalCyber.com. See you next week.