Security Risk Advisors

On October 22, 2026, ESET Research disclosed MythicRatatoskr, a previously undocumented Go-based backdoor identified during a coordinated intrusion involving Russia-aligned threat groups UAC-0099 and Sandworm. On July 16, 2025, UAC-0099 gained initial access to a Ukrainian grain logistics company through a spearphishing email containing a malicious attachment. The infection c...

Group-IB disclosed an analysis of SiriusQT, a Windows remote access trojan (RAT) distributed through a malware-as-a-service (MaaS) model. The malware has been advertised on underground forums, with at least 30 users purchasing valid licenses. Researchers identified more than 280 SiriusQT client samples associated with different campaigns, including activity targeting the Unit...

GitLab disclosed CVE-2026-110264, a flaw rated 10.0 on the CVSS scale affecting GitLab Community Edition and Enterprise Edition. Self-managed GitLab installations are affected on all versions before the fixed release for their branch, back to 7.0. GitLab.com is already patched, and GitLab Dedicated is covered on builds 19.3.5-internal0, 19.4.2-internal0, or later.

The ...

On October 21, 2026, Group-IB and NyxLab disclosed a large-scale intrusion campaign associated with k0t, targeting internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect devices across organizations worldwide. Researchers identified more than 70,000 exposed credentials and related records, including network-device credentials and LDAP dumps, with FortiGate compromis...

On October 21, 2026, Wiz Research disclosed PHP2Shell, a collection of critical memory-safety vulnerabilities in the core PHP engine tracked under CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2. The vulnerabilities affect PHP versions dating back to 5.4, with every PHP version released over the past decade affected by at least one identified issue. The f...