# Today's Top Stories

A critical code-execution vulnerability in EDK2, the open-source UEFI firmware implementation used by most modern servers, allows attackers to execute arbitrary code during the early boot process before the OS loads. Because EDK2 underpins UEFI firmware across a vast range of enterprise and cloud server hardware, successful exploitation could compromise systems at a level below OS-based defenses. Security teams should prioritize firmware patching and monitor vendor advisories for affected hardware platforms.

CISA added two critical PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 CVSS — to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation enabling unauthenticated remote code execution. Federal agencies were given a tight remediation deadline of Thursday to patch affected PHP deployments. The PHP project also issued a second emergency Windows package rebuild within five days to address the related Brotli library flaw CVE-2026-111497 affecting PHP 8.2 through 8.5.

Kaspersky researchers linked North Korea's Lazarus Group to 'Operation FlashHole,' an espionage campaign active since at least July 2025 targeting South Korean organizations in construction, software, and wire-communication manufacturing. The group abused legitimate South Korean security software as an attack vector and deployed malware using post-quantum encryption, signaling an evolution in their operational tradecraft to defeat future decryption efforts. At least three organizations have been confirmed compromised.

Apple backported patches for CVE-2026-86950, an out-of-bounds write in CoreGraphics with a CVSS score of 8.8, to older iPhones and iPads after the flaw was exploited in 'extremely sophisticated' targeted attacks. The fix was originally released last month for current iOS devices; the backport extends coverage to users unable to run the latest OS versions. Defenders should treat this as urgent given confirmed in-the-wild exploitation.

Microsoft patched CVE-2026-80097 in Microsoft Authenticator for Android (fixed in version 6.2606.4246), a flaw that allowed a zero-permission malicious app to impersonate trusted Microsoft applications like Teams and harvest work account sign-in tokens. Successful exploitation could enable full account takeover without requiring any special Android permissions, making it particularly dangerous in BYOD enterprise environments. All users of Microsoft Authenticator for Android should update immediately.

Australia's Signals Directorate (ASD) conducted an offensive cyber operation against the Amadey malware backend, successfully severing the threat actor's access to approximately 180,000 infected computers worldwide. ASD operators gained access to the criminal operation's command-and-control infrastructure and cut off the controller's connection to all victim machines. This marks a notable example of a national intelligence agency using offensive access to a botnet backend for defensive disruption at scale.

Crypto hardware wallet maker Keystone announced on October 26 it will destroy all 18,835 devices in inventory after an attacker compromised its website and stole the device verification key used to authenticate genuine hardware. An adversary in possession of the key could manufacture counterfeit Keystone wallets that pass the official legitimacy check, enabling cryptocurrency theft from unsuspecting buyers. The company confirmed no existing user funds were directly at risk from this incident.

Tailscale disclosed nearly a dozen security vulnerabilities — dubbed 'Tailworm' — in its Tailscale SSH component that could be exploited for credential theft, server crashes, and root privilege escalation. Details were made public before any patches were available due to uncoordinated disclosure, forcing Tailscale's security team to rush fixes under active researcher scrutiny. Organizations using Tailscale SSH should monitor the vendor's security advisories and apply patches as soon as they are released.

The University of New Mexico Health Sciences Center suffered a ransomware attack that caused system outages, forced ambulance diversions to Albuquerque and Santa Fe facilities for approximately two hours, and suspended outpatient surgeries and appointments. The incident disrupted both patient care and academic operations at the health system, underscoring the continued targeting of healthcare institutions by ransomware operators. Specific threat actor attribution has not yet been publicly confirmed.

HPE released patches addressing dozens of critical vulnerabilities across its networking product portfolio, including eight maximum-severity flaws enabling remote code execution and authentication bypass. The scope of affected products spans HPE's networking line, making this a high-priority patching event for enterprise network administrators. No CVE identifiers were specified in the initial disclosure, but the presence of max-severity RCE bugs warrants immediate review of affected HPE deployments.