Daily cyber recap, Oct 28: Magento, PeopleSoft, PHP2Shell

Watch the 2-minute recap

In the last day or so, attackers breached hundreds of online stores through newly exploited Adobe Commerce and Magento flaws, a Cloudflare AI model leaked data between customers, and Australia cut a criminal off from 180,000 infected PCs. It matters because most of these have a patch or a clear action available today. Below is the short version of each story, with sources, so you can act on the ones that apply to you.

Today at a glance

CISA lists Adobe Commerce, Magento and Brotli flaws as exploited; hundreds of stores breached (The Hacker News)
Australia’s signals agency cuts a criminal off from 180,000 Amadey-infected PCs (The Hacker News)
Oracle PeopleSoft zero-day is three chained flaws, exploited by ShinyHunters since May (The Hacker News)
Lazarus runs Operation FlashHole against South Korean construction, software and equipment firms (The Hacker News)
Cloudflare discloses 155 Workers AI responses that leaked data between customers (Cloudflare blog)
Interpol’s Operation Serengeti brings 1,462 arrests and $105 million recovered (Dark Reading)
A New Mexico university hospital diverts ambulances for about two hours after a cyberattack (The Record)
PHP2Shell: two critical PHP flaws now under confirmed active exploitation (The Hacker News)

Adobe Commerce and Magento flaws added to CISA’s exploited list

CISA added two Adobe Commerce and Magento vulnerabilities, plus one in Google’s Brotli decoder library, to its Known Exploited Vulnerabilities catalog on Tuesday. Attacks have breached hundreds of stores. Anyone running an online storefront on these platforms is in scope. Patch the storefront now, and check which of your systems use the Brotli library. (The Hacker News)

A dark e-commerce checkout screen glowing on a monitor in the centre, abstract shopping cart and payment card icons

Australia cuts a criminal off from 180,000 Amadey-infected PCs

The Australian Signals Directorate says its operators got into the backend of an Amadey malware operation. A criminal using Amadey can no longer access or steal data from 180,000 infected computers around the world. Anyone whose PC was infected is a potential victim, even though the operator has lost access. If you suspect an infection, run a full scan and keep your system updated. (The Hacker News)

A dark server rack in the centre with a glowing cable being cut by a pair of scissors, sparks of cyan light, rows of

Oracle PeopleSoft zero-day turns out to be three chained flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, researchers say. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Organisations running PeopleSoft are the ones affected. If that is you, confirm the June patch is actually applied. (The Hacker News)

A dark corporate ERP console room, a large curved monitor in the centre showing abstract dashboards, tables and charts

Lazarus targets South Korean firms in Operation FlashHole

Kaspersky attributes Operation FlashHole to the North Korea-linked Lazarus group. The espionage campaign abuses local security software and targets at least three South Korean organisations in construction, software and wire-communication equipment manufacturing. It has been active since at least July 2025. Firms in those sectors should watch for abuse of security tools installed on their machines. (The Hacker News)

A dark office seen from behind a silhouetted operator, a monitor in the centre showing an abstract phishing lure: an

Cloudflare Workers AI leaked data between customers

Cloudflare disclosed on Monday that between August 27 and September 9, a small number of customers using its GLM 5.3 Workers AI model received responses containing data from other customers’ requests. In total, 155 responses were affected. Cloudflare says it found no evidence of deliberate exploitation. If you build on AI services, read your vendors’ incident disclosures. (Cloudflare blog)

A cloud AI data stream: a glowing cyan cloud shape in the centre with streams of data cubes flowing into an abstract

Interpol’s third Operation Serengeti: 1,462 arrests

The third iteration of Operation Serengeti led to 1,462 arrests across 20 African countries and the US, and recovered $105 million in stolen funds. Fraud victims are the people affected. If you are scammed, tell your bank right away, because speed gives the best chance of recovering money. (Dark Reading)

A dark police operation map table, a holographic abstract map of the African continent outline in the centre with cyan

A New Mexico hospital diverts ambulances after a cyberattack

A University of New Mexico hospital diverted ambulances for about two hours on Monday. It then suspended outpatient surgeries and appointments for the rest of the day. Patients and staff bore the impact. Any organisation that runs critical services should rehearse its downtime plan and keep offline backups. (The Record)

A dark hospital corridor in perspective, rows of medical monitors along the walls all dark or showing flat red offline

Story of the week: PHP2Shell

PHP2Shell is the one story that has kept growing across the week. It covers two critical PHP flaws, both rated 9.2 on the CVSS scale. The fixes shipped on October 21, in PHP 8.4.27 and 8.3.36, and Cloudflare published WAF protections the same day. Since then, exploit attempts have reached millions. (The Hacker News; Cloudflare blog)

On Monday, CISA confirmed active exploitation and added the flaws to its Known Exploited Vulnerabilities catalog. Any server running PHP is potentially affected, so this is no longer a patch-when-convenient item. Update PHP to a fixed release now. (BleepingComputer)

A dark code editor on a monitor in the centre showing abstract colored lines of code blocks (unreadable) and a terminal

What to do this week

Patch exposed systems first: online storefronts (Adobe Commerce, Magento), PHP servers and PeopleSoft.
Update PHP to a fixed release (8.4.27 or 8.3.36) and confirm it is live, not just downloaded.
Run a full scan on any PC you suspect is infected, and keep the system updated.
Ask your AI and cloud vendors for their incident disclosures, and read them.
Rehearse your downtime plan and keep backups offline. Tell your bank right away if you are scammed.

Sources

Follow for the daily recap

A new two-minute recap goes up every day. Follow if you like this content and want to stay up to date. Home of the daily recap: edwinvonlabja.com.

Produced with an AI-assisted pipeline; every claim is checked against the linked sources.