The Vulnerability Has A Name Now, And Three Of Them Are Yours
Three vulnerabilities were confirmed as exploited in the same week, and all three carry the same suffix. PHP2Shell, Node2Shell, HTTP2Shell. Three runtimes that sit under almost every application an enterprise owns, each given a marketing name by researchers who understood that a name is what makes a patch get applied. CISA confirmed active exploitation of the PHP pair, ordered civilian federal agencies to patch within days, and added both to the Known Exploited Vulnerabilities catalog. Hackread reported the federal order on 27 October. Bleeping Computer reported CISA's confirmation of Node2Shell exploitation on 28 October. Sweet Security offered free virtual patching for HTTP2Shell to any organisation affected, which is a commercial gesture and a candid admission that a lot of organisations will not patch in time.
That is one thread. The second is a stealer called Aokigahara, reported by Dark Reading on 27 October, which targets what it calls developer keyrings and AI assistants. The third is Gheist, reported 26 October, which takes GitHub tokens and uses them to reach cloud secrets. Put them in a row and the target is no longer the server. It is the set of credentials that let something else act on your behalf.
The blast radius argument is correct, and it is not new
Bleeping Computer's piece on 28 October, headlined around the point that blast radius matters more than a CVSS score, is the most useful thing written this week. Its argument is simple: a 9.8 in a component behind three layers of network control that needs an authenticated session is less dangerous than a 7.4 in something reachable from the internet with no authentication and no logging. True since CVSS v2, and it keeps needing saying because procurement keeps asking for a number.
InfraTrust finds exploited flaws in critical network infrastructure, and Bleeping Computer's report on scanning for a recently patched Oracle flaw shows the scanners arrived within days, targeting the unpatched. The score describes the flaw. The scan describes the schedule.
Blast radius is not only a network question. A stolen GitHub token reaches repositories your team thinks are private, pipelines that deploy to production, secrets stored as repository variables, and the cloud role the pipeline assumes. The radius of a leaked token is the sum of every system that trusted the identity behind it, a bigger number than most people have drawn, and the number the board is asking for.
The scanner wearing thirty-two costumes
Hackread and Dark Reading both carried the story of an attacker who impersonates thirty-two different AI bots while scanning for exposed credentials and private keys. Thirty-two user agent strings, rotating, mixed in with genuine crawler traffic. The technique is not clever in itself. The cover is clever. Security teams have spent two years being told that AI crawlers will appear in their logs and that blocking them may break the tools their developers depend on. So the logs show AI bots and nobody escalates, because the logs are full of them.
Aokigahara adds the endpoint end: developer keyrings, and the local storage and configuration of AI assistants. A file of API keys for four model providers, a local configuration holding a session token, a keyring holding SSH passphrases. None of that appears in your vulnerability management platform, because the platform is looking at ports.
The Gheist story closes the loop. A token becomes a credential, a credential becomes a role, the role becomes cloud secrets. Dark Reading's report follows that path through GitHub tokens, and the reason it succeeds is that the token was over-permissioned for the job it was created to do. A build token with write access to a repository it does not build, a personal access token with no expiry issued in 2021 for a proof of concept. Every organisation has these. They are invisible until they are used.
One attacker needed no stolen credential at all. Bleeping Computer reported on 26 October that a former penetration tester used the ARTEX AI framework to breach more than ninety South Korean organisations, steal 8.2 million records and demand payment in thirty-eight of the cases. He moved from conventional tools to AI utilities in August 2026. The escalation was not his skill improving. It was a tool becoming available, and the population of capable attackers expands with every such tool because the work now takes a fortnight rather than a decade.
The collaboration tool is the new remote access
Two separate reports this week describe attackers using Microsoft Teams external chats as an entry path, and the detail that matters is the timing. Dark Reading's headline puts it at fifteen minutes, from first contact to malware delivery. The chain is a mail bomb to bury the alerts and a Teams message from an account presenting as IT support, then a remote support tool.
This works because Teams federates by default. A user in another tenant can message your staff unless someone restricted it, and the other tenant can be created in minutes with an unverified .onmicrosoft.com domain. I covered this at length last week and will not repeat it. It appears in the file again, which is how most of these things work. A technique is reported, everyone reads it, a small proportion act, and the technique keeps working. The organisations that got hit were not unaware. They were busy.
Microsoft's own advice this week is tangential and worth taking anyway: Bleeping Computer reported the Entra ID team urging administrators to migrate users to passkeys. The identity vendor is telling you that password plus second factor is no longer enough against a scanner that harvests credentials at scale. Passkeys remove the shared secret. They do not fix a helpdesk that will reset anything for a convincing caller.
The supply chain problem has moved from code to contracts
The UK government is considering making software companies liable for cyber breaches, according to The Record's report on 28 October. The detail is in the Budget proposal rather than in the headline. A liability regime for software would change the negotiation, and it would change it in the direction security teams have wanted for twenty years: the vendor bears some of the cost of the defect.
Do not treat this as good news yet. Liability spawns insurance, insurance spawns conditions, and the conditions will concern the customer's own configuration. Expect the first contracts to say liability applies where the product was used as intended, a sentence that will keep lawyers employed for a decade.
Set against that report is Dark Reading's piece on SBOMs and supply chain scope, published 27 October. Its argument is that a software bill of materials tells you what is in the product, not what was built into it, not what was compromised during the build, and not what the product connects to at runtime. Every SBOM is a snapshot of declared dependencies at a point in time, and says nothing about the build system, the pipeline, or the vendor's own suppliers. If you have been treating SBOM collection as supply chain assurance, you have been counting inventory and calling it control.
The Convertr story makes the same point in a way a board will understand. Bleeping Computer reported on 27 October that attackers hijacked an analytics script to steal payment card data. An analytics script. A marketing team adds it to a page on a Friday afternoon, from a vendor the security team has never met, and it executes in the customer's browser with whatever access the page has. That is a supply chain attack, and no SBOM would have found it.
For the sector-level version of the same failure, The Record reported on 27 October that HMICFRS found UK police forces had been repeatedly breached through suppliers holding their data, with most contracts containing no ongoing cybersecurity assurance.
The physical consequences keep arriving
University of New Mexico Health diverted ambulances after a ransomware attack, reported 27 October, disrupting patient care and surgeries. That is the second hospital in two weeks in this file, and the pattern is not subtle. Healthcare is hit because downtime is measured in lives, which makes payment more likely and makes urgency override careful recovery.
Japan's GMO told customers to shut down their PCs amid a ransomware threat, reported 27 October. A financial services company told its customers, in public, to turn off their computers, because it could not defend the endpoints and chose to remove them from the network instead. A defensible decision and an extraordinary one.
The breaches continue alongside. The University of Copenhagen exposed data belonging to 525,000 people, ENGIE disclosed a customer data breach, and telemetry is now a breach category in its own right.
One item will not get the attention it deserves: Hackread reported on 26 October that 12,976 internet-exposed refrigeration control services were found across 99 countries. Cold chain, pharmaceutical storage, food retail. Any organisation with a supplier relationship to temperature-controlled logistics now depends on the security of equipment it does not own and cannot patch. That dependency belongs in your risk register before an auditor asks about it.
What a CISO should do this week
Identify every PHP, Node.js and HTTP/2 endpoint you own, including the ones a hosting provider owns on your behalf, and patch against the KEV deadlines. Then do the part people skip: check which of those services can reach your identity provider, your secrets store or your internal network. The severity of the flaw is fixed. Its relevance to you is not.
Inventory your non-human identities. Every token, every service account, every CI credential, every AI assistant session with a stored key. Ask three questions of each: what can it reach, when does it expire, and would anyone notice if it were used from an unfamiliar address. Anything that fails all three goes on a list your risk committee sees by name.
Restrict Teams external access to a named allowlist and set a default deny. Assign ownership of the setting to a person, in writing, because the reason this keeps working is that no one owned it.
Change your vulnerability triage to rank by reachable blast radius rather than by score. Publish the method so procurement can quote it back to vendors, and so that when a vendor sends you a 9.8 you have a documented reason to ask what it can actually reach.
Migrate Entra ID to passkeys on a timetable with a date on it, and pair that with a helpdesk script that refuses to reset credentials on an inbound call. The passkey does not help if someone can talk their way past the person who supports it.
Audit your third-party scripts, starting with analytics and tag managers, and count how many execute on pages that take payment details. If the answer is more than zero and you cannot name the vendor's security contact, that is your finding.
Read your supplier contracts for a cybersecurity obligation, a notification deadline, and a right to see logs. HMICFRS found those clauses missing across an entire sector, and they are not missing only in policing.
None of that needs a new platform. All of it needs someone to have looked, and this week's file contains four examples of what happens when nobody has.