Summary
Ransomware crews are slashing through critical infrastructure, with SafePay compromising more than 600 organizations worldwide by pairing file encryption with data theft and leveraging a string of vulnerabilities. Cyware.com covers how this campaign, flagged by CISA, the FBI, and the U.S. Secret Service, is forcing businesses and public agencies across the Americas and Europe to confront service outages and the threat of sensitive data exposure.
A poisoned Python package, litellm version 1.107.0, has turned routine dependency updates into a stealth credential heist, embedding a payload that targets SSH keys and cloud secrets while evading detection—even when not directly imported. JFrog Security Research traced the attack to specific files and IP addresses, raising the stakes for any team that built or deployed from the tainted release.
Millions of internet-facing servers are at risk as the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) open the door to remote code execution and full server takeover. Attackers are already exploiting these flaws at scale, with agencies across the U.S. and Europe warning that unpatched PHP installations could be hijacked for data theft or crypto mining.
State-backed threat actors are escalating their campaigns, with APT41 slipping the BlackX UEFI bootkit beneath Secure Boot to target diplomatic agencies in Central Asia, and Storm-0940 using AI-driven tools to breach over 2,250 Microsoft 365 tenants via ConnectWise integrations. Meanwhile, Sandworm and UAC-0099 have wiped out a Ukrainian grain logistics company, turning cyberattacks into real-world supply chain disruptions.
Top Malware Reported in the Last 24 Hours
SafePay ransomware hits 600 critical firms
SafePay is a ransomware operation that has compromised more than 600 entities worldwide, pairing file encryption with data-theft pressure to force payouts. It gets in by stealing or guessing passwords, phishing, and exploiting exposed systems, and it has been tied to attacks leveraging CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Once inside, it disables security and backup services, resets network storage devices, encrypts files, and threatens to publish stolen data if victims don’t pay. The activity prompted a joint advisory from CISA, the FBI, and the U.S. Secret Service, which also noted the group routes connections through Mullvad VPN to help mask operations. For businesses and critical infrastructure operators across the Americas and Europe, the real-world impact is service disruption and the risk of sensitive data exposure; the advisory also points organizations to CISA and NIST’s Cybersecurity Performance Goals and CISA’s Eviction Strategies Tool as part of its guidance.
litellm hijack plants stealthy credential stealer
litellm version 1.107.0 was published with a malicious payload that runs at Python startup, turning a routine dependency update into a credential-theft and remote code execution risk. It uses the files cook.pth, cook.py, and sitecustomize.py so the code can execute even when applications never directly import the package. Researchers at JFrog Security Research said the embedded stealer (tracked as privcollect) targets high-value secrets such as SSH keys, cloud credentials, and AI development tokens, and it includes an hourly mechanism to pull and run additional code. LiteLLM also disclosed its own investigation into how the poisoned artifacts were shipped through a compromised release pipeline, including time windows when affected PyPI and Docker Hub downloads occurred. The incident includes credential-abuse activity tied to 168.100.8[.]57 and 165.227.201[.]8, raising the stakes for teams that may have built or deployed from the tainted release during that period.
BlackX bootkit bypasses Secure Boot
BlackX is a UEFI bootkit described as a BlackLotus variant that was used in an early-2026 espionage campaign against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. It exploits the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot, allowing the attackers’ code to persist at a level that can survive operating system reinstallation and frustrate conventional cleanup. In the installation chain, it uses files including inst.exe and PVMDIJGKAX2, with components decrypted using RC4. Kaspersky said it injects a malicious driver into the Windows kernel (signed with a revoked certificate), tampers with security solutions, and then deploys user-mode payloads such as OxiDLLRunner and a RAT that can use cloud storage for command-and-control. The campaign was attributed to APT41 based on overlaps in tactics and tooling, underscoring the risk that a single foothold can become long-term, hard-to-detect access to sensitive diplomatic communications.
Top Vulnerabilities Reported in Last 24 hours
PHP2Shell bugs open servers to takeover
Two critical PHP runtime flaws dubbed PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — can let an unauthenticated attacker run code remotely against any PHP installation that serves web requests, turning a simple visit into potential server takeover. The issues stem from use-after-free conditions tied to how PHP handles an out-of-memory exit and how stale internal state can survive between requests, opening the door to code execution as well as arbitrary file reads and memory disclosure. Attackers are already exploiting this in the wild, with Cloudflare CTO Dane Knecht reporting early attacks and The Guardian reporting “millions of attempts within hours” of the announcement. Cisco Talos and multiple agencies — including CISA, Germany’s BSI, CERT-EU, and the UK’s NCSC — have amplified the risk, warning that vulnerable systems can be hijacked for data theft, untraceable follow-on attacks, or crypto mining. A fix is available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and reporting cited over two million potentially exposed internet-facing hosts.
Top Threat Actors Reported in Last 24 hours
APT41 slips BlackX beneath Secure Boot
APT41 (also tracked as Winnti), a China-linked espionage-and-financially motivated group, has been tied to a rare kind of compromise that starts before Windows even fully boots—using a BlackLotus-like UEFI bootkit called BlackX. In early 2026, they targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan, using the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and plant their own trust keys so malicious EFI code can load. The installation chain described in reporting includes an inst.exe launcher and a component named PVMDIJGKAX2, with RC4 used to decrypt parts of the payload. For diplomatic organizations, that kind of foothold can turn a single endpoint intrusion into long-term access that survives reboots and undermines confidence in what systems can be trusted. After gaining early control, they inject a kernel driver signed with a revoked certificate, tamper with security tooling, and roll out user-mode payloads including OxiDLLRunner and a RAT that uses cloud storage for command-and-control.
Storm-0940 turns ConnectWise into cloud access
Storm-0940, a China-state aligned actor, is being blamed for using AI-assisted tooling to accelerate intrusion attempts that spilled into a supply-chain style compromise of ConnectWise integrations. Microsoft said their activity included a password-spraying run against Microsoft 365 and Exchange Online between October 10 and 14, 2026, followed by a ConnectWise compromise that was publicly reported on October 16, 2026, involving unauthorized access using OAuth application identities. For the businesses and public-sector teams that rely on managed tools, this matters because compromised application identities can let an adversary act inside cloud environments without a typical “user login” moment that defenders expect to see. Coverage also ties the operation to scale: more than 2,250 Microsoft 365 tenants were targeted, with over 151,000 failed sign-in attempts against 327 accounts in that October 10–14 window. Microsoft added that in some cases the actor could reach privileged cloud access in under three hours, even though the presence of an affected application or successful authentication does not necessarily mean data was accessed or exfiltrated.
Sandworm and UAC-0099 wipe grain systems
Sandworm, a Russian state-linked hacking group, and UAC-0099 are reported to have teamed up in a destructive attack that hit a Ukrainian grain logistics company—an operation designed to disrupt, not just spy. The intrusion began in July 2025 when they used a phishing email to gain access, establish persistence with a backdoor called MatchWok, and later deploy MythicRatatoskr to run commands and steal files. In September 2025, they escalated to data-wiping malware that destroyed data and disrupted operations. For a company moving grain, this kind of outage can quickly become a real-world supply and revenue problem, affecting customers and downstream logistics. TheRecord reported the attackers also used the decentralized Yggdrasil network for communications, complicating efforts to trace or block their infrastructure.
Frequently Asked Questions
What is SafePay? SafePay is a ransomware operation that has compromised more than 600 entities worldwide, pairing file encryption with data-theft pressure to force payouts. It gets in by stealing or guessing passwords, phishing, and exploiting exposed systems, and it has been tied to attacks leveraging CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
What is litellm? litellm version 1.107.0 was published with a malicious payload that runs at Python startup, turning a routine dependency update into a credential-theft and remote code execution risk. It uses the files cook.pth, cook.py, and sitecustomize.py so the code can execute even when applications never directly import the package.
What is BlackX? BlackX is a UEFI bootkit described as a BlackLotus variant that was used in an early-2026 espionage campaign against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. It exploits the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot, allowing the attackers’ code to persist at a level that can survive operating system reinstallation and frustrate conventional cleanup.
What is CVE-2026-109618? Two critical PHP runtime flaws dubbed PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — can let an unauthenticated attacker run code remotely against any PHP installation that serves web requests, turning a simple visit into potential server takeover. The issues stem from use-after-free conditions tied to how PHP handles an out-of-memory exit and how stale internal state can survive between requests, opening the door to code execution as well as arbitrary file reads and memory disclosure.
What is APT41? APT41 (also tracked as Winnti), a China-linked espionage-and-financially motivated group, has been tied to a rare kind of compromise that starts before Windows even fully boots—using a BlackLotus-like UEFI bootkit called BlackX. In early 2026, they targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan, using the Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and plant their own trust keys so malicious EFI code can load.
What is Storm-0940? Storm-0940, a China-state aligned actor, is being blamed for using AI-assisted tooling to accelerate intrusion attempts that spilled into a supply-chain style compromise of ConnectWise integrations. Microsoft said their activity included a password-spraying run against Microsoft 365 and Exchange Online between October 10 and 14, 2026, followed by a ConnectWise compromise that was publicly reported on October 16, 2026, involving unauthorized access using OAuth application identities.
What is Sandworm? Sandworm, a Russian state-linked hacking group, and UAC-0099 are reported to have teamed up in a destructive attack that hit a Ukrainian grain logistics company—an operation designed to disrupt, not just spy. The intrusion began in July 2025 when they used a phishing email to gain access, establish persistence with a backdoor called MatchWok, and later deploy MythicRatatoskr to run commands and steal files.