https://daniele-michelin.com/en/radar/ Daily IT news, briefly put in context, and the weekly patch radar. en https://daniele-michelin.com/en/radar/#r-9e8f060397f4https://daniele-michelin.com/en/radar/#r-9e8f060397f4Mon, 26 Oct 2026 06:30:14 +0000A malicious AGENTS.md in the Downloads folder fooled AI coding agents into installing a rogue npm package. Teams using AI code assistants should restrict file access and verify npm installations. https://daniele-michelin.com/en/radar/#r-3eda0d6ae7e3https://daniele-michelin.com/en/radar/#r-3eda0d6ae7e3Mon, 26 Oct 2026 06:30:14 +0000Exploitation attempts still target vulnerable PHP apps using PHP2Shell‑like flaws. Operators of PHP services should patch applications, harden inputs and monitor for scanning activity. https://daniele-michelin.com/en/radar/#r-4a8154151413https://daniele-michelin.com/en/radar/#r-4a8154151413Mon, 26 Oct 2026 06:30:14 +0000Unpatched Tailscale SSH flaws let a compromised device use port‑forwarding to gain root on reachable servers. Admins using Tailscale SSH should verify patches, review access rules and disable port‑forwarding if not required. https://daniele-michelin.com/en/radar/week/2026-43/https://daniele-michelin.com/en/radar/week/2026-43/Sun, 25 Oct 2026 23:00:00 +0000Weekly roundup, week 43/2026: 16 security items and other IT news — briefly put in context, with what admins should check now. https://daniele-michelin.com/en/radar/#r-e62f85ca100bhttps://daniele-michelin.com/en/radar/#r-e62f85ca100bSun, 25 Oct 2026 06:30:14 +0000Microsoft will add AI‑driven, context‑aware phishing detection to Teams messages. Support teams should pilot the feature, brief users on new warnings, and ensure existing mail filters still apply to Teams traffic. https://daniele-michelin.com/en/radar/#r-a6ce31709924https://daniele-michelin.com/en/radar/#r-a6ce31709924Sun, 25 Oct 2026 06:30:14 +0000The BlackX UEFI bootkit exploits the Baton‑Drop flaw to bypass Secure Boot and load malicious drivers. Administrators should verify firmware updates, re‑enable Secure Boot policies, and monitor for unauthorized drivers. https://daniele-michelin.com/en/radar/#r-3a1a036ef73ahttps://daniele-michelin.com/en/radar/#r-3a1a036ef73aSun, 25 Oct 2026 06:30:14 +0000An accidentally published LiteLLM master key allowed theft of GitHub tokens and injection of malicious packages. AI pipeline owners should purge secrets from repos, rotate keys and audit their release workflows. https://daniele-michelin.com/en/radar/#r-a0a9e49aec28https://daniele-michelin.com/en/radar/#r-a0a9e49aec28Sun, 25 Oct 2026 06:30:14 +0000A memory‑corruption bug in the Brotli decoder impacts Node.js, Bun, Python Brotli packages and Envoy proxies. Operators of web services and CI pipelines should upgrade the affected libraries and validate any Brotli‑compressed input. https://daniele-michelin.com/en/radar/#r-27be26c6f177https://daniele-michelin.com/en/radar/#r-27be26c6f177Sat, 24 Oct 2026 05:30:15 +0000Windows Server 2016 will stop receiving security updates after January 2027. Administrators need to plan migration to newer server releases and consider interim isolation of critical workloads. https://daniele-michelin.com/en/radar/#r-015a882ee274https://daniele-michelin.com/en/radar/#r-015a882ee274Sat, 24 Oct 2026 05:30:15 +0000Researchers uncovered an AI‑driven intrusion framework used by ransomware affiliates. SOCs should hunt for similar C2 patterns and monitor for AI‑generated anomalies in network traffic. https://daniele-michelin.com/en/radar/#r-4645fb818a8ehttps://daniele-michelin.com/en/radar/#r-4645fb818a8eSat, 24 Oct 2026 05:30:15 +0000Ruby released patches for three Onigmo regex bugs that enabled four critical RCE flaws in GitLab. GitLab operators should upgrade Ruby to the fixed releases and verify that GitLab’s own patches are applied. https://daniele-michelin.com/en/radar/#r-077ef200d3e0https://daniele-michelin.com/en/radar/#r-077ef200d3e0Sat, 24 Oct 2026 05:30:15 +0000A new UEFI bootkit bypasses Secure Boot even on patched Windows systems lacking revocation updates. Windows admins must verify firmware settings, ensure revocation lists are current, and isolate potentially compromised machines. https://daniele-michelin.com/en/radar/#r-0151e8522bf7https://daniele-michelin.com/en/radar/#r-0151e8522bf7Fri, 23 Oct 2026 05:30:14 +0000LiteLLM’s release pipeline was compromised, publishing malicious Docker images that steal credentials and secrets. Verify affected packages, remove rogue images, and rotate credentials. https://daniele-michelin.com/en/radar/#r-6af5f5a84e31https://daniele-michelin.com/en/radar/#r-6af5f5a84e31Fri, 23 Oct 2026 05:30:14 +0000Railway detected suspicious activity in its environment‑variable store and urges developers to rotate all secrets immediately. Renew keys and review access logs. https://daniele-michelin.com/en/radar/#r-23872cb1986ehttps://daniele-michelin.com/en/radar/#r-23872cb1986eFri, 23 Oct 2026 05:30:14 +0000Arista reports a critical SQL‑injection zero‑day in VeloCloud Orchestrator that can elevate read‑only accounts to operator level. Verify patch status and tighten access controls immediately. https://daniele-michelin.com/en/radar/#r-40ccda1b01a4https://daniele-michelin.com/en/radar/#r-40ccda1b01a4Fri, 23 Oct 2026 05:30:14 +0000Quad9 withdrew its DNS service following a censorship ruling. Operators should verify resolver availability and switch to alternative DNS providers if needed. https://daniele-michelin.com/en/radar/#r-e9fd60a700e2https://daniele-michelin.com/en/radar/#r-e9fd60a700e2Thu, 22 Oct 2026 05:30:21 +0000Onamae Desktop Cloud’s infrastructure was breached, installing malware on up to 26,739 customer VPS. VPS and cloud‑storage operators should audit their images for unknown processes, verify integrity, and consider notifying affected tenants. https://daniele-michelin.com/en/radar/#r-f5335e20393bhttps://daniele-michelin.com/en/radar/#r-f5335e20393bThu, 22 Oct 2026 05:30:21 +0000LiteLLM 1.107.0 was distributed via PyPI wheels and Docker images containing a credential stealer and backdoor. Users of AI automation should uninstall the compromised package, switch to a clean source, and audit systems for any unauthorized credential use. https://daniele-michelin.com/en/radar/#r-a9726704f0fahttps://daniele-michelin.com/en/radar/#r-a9726704f0faThu, 22 Oct 2026 05:30:21 +0000GitLab disclosed an unauthenticated RCE vulnerability affecting every self‑managed instance back to 2014. Operators must apply the October 21 fix immediately, even if they installed the October 12 patch, and verify their GitLab version is updated. https://daniele-michelin.com/en/radar/#r-9b69347cfd29https://daniele-michelin.com/en/radar/#r-9b69347cfd29Thu, 22 Oct 2026 05:30:21 +0000The ConnectWise Cloud Backup service was breached using the closed‑source ARTEX AI framework by the Storm‑0940 actor. Admins of ConnectWise backups and any AI‑driven automation should verify the October 21 patch is applied and monitor for unexpected scanning activity. https://daniele-michelin.com/en/radar/#r-75d505f0d852https://daniele-michelin.com/en/radar/#r-75d505f0d852Wed, 21 Oct 2026 16:11:50 +0000New concepts aim to boost AI compute power, while high demand and limited manufacturing push storage costs higher. Cloud‑storage and AI teams need to review pricing and capacity forecasts. https://daniele-michelin.com/en/radar/#r-6e45f239cf9bhttps://daniele-michelin.com/en/radar/#r-6e45f239cf9bWed, 21 Oct 2026 16:07:00 +0000Node.js 22.x, 24.x and 26.x fix high‑risk bugs and guard against compromised eMudhra certificates. Update all Node.js instances promptly and verify certificate validation in your services. https://daniele-michelin.com/en/radar/#r-6478f5844cefhttps://daniele-michelin.com/en/radar/#r-6478f5844cefWed, 21 Oct 2026 16:07:00 +0000PHP released emergency patches for the PHP2Shell critical RCE flaws. Only a full upgrade to the listed patch releases fully mitigates the issue – verify the PHP version on all web servers. https://daniele-michelin.com/en/radar/#r-f29fd7d40b5fhttps://daniele-michelin.com/en/radar/#r-f29fd7d40b5fWed, 21 Oct 2026 16:07:00 +0000Chrome introduces ClickFix warnings when Enhanced Protection is on, blocking users from pasting malicious code. Ensure Enhanced Protection is enabled on client browsers and brief users about the new prompts. https://daniele-michelin.com/en/radar/#r-c7a020f274e0https://daniele-michelin.com/en/radar/#r-c7a020f274e0Wed, 21 Oct 2026 16:07:00 +0000Researchers identified the Bronze Sandcastle threat using Sandboxie DLL sideloading to install backdoors. Audit systems for unexpected DLL loads and patch or replace vulnerable sandbox components.