Good morning. Three items today, and the first one should move to the top of your patch list.
1. FortiSIEM is now being exploited in the wild (CVE-2026-106173). Canada's Cyber Centre updated its Fortinet advisory on October 23 to warn that this FortiSIEM flaw is being exploited in the wild. The bug is a path traversal in the phQueryMaster gRPC service, reachable without a client certificate, so an unauthenticated attacker can steer a file write outside the intended folder and reach code execution. A public proof of concept from Horizon3 has been out since October 20. What to do: if you run FortiSIEM 7.5.0, upgrade to 7.5.1 today and restrict TCP 27918 to internal nodes only. Hunt by comparing file timestamps on scheduled scripts, because this attack leaves no revealing application logs.
2. PHP2Shell exploitation confirmed by honeypot (CVE-2026-109618, CVE-2026-109619). A honeypot recorded confirmed remote code execution against Apache mod_php on PHP 8.4.26, with an 800 KiB decoded cookie dump delivered just before the shell command ran. If you have not patched PHP yet, this is the confirmation that ends the debate. Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. One correction: Unit 42 has retracted its assessment that a European government intrusion it described was PHP2Shell initial access. Do not cite that case as PHP2Shell evidence.
3. Whitearmor claims J.B. Hunt breach, $5 million demand (UNVERIFIED). The emerging group Whitearmor posted a leak site claim naming J.B. Hunt, and a second post on October 26 accused the company of quietly emailing customers to update passwords. Nothing in the claim is independently verified, and no confirmation from J.B. Hunt was found this morning. Treat it as a trigger to verify, not proof of a breach, and reset passwords only through official channels.
Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library
No new CISA KEV entries since the October 23 catalog in this morning's check. That is the quiet part. FortiSIEM and PHP2Shell are not quiet, so patch those first.
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com