ZeroFox Daily Intelligence Brief - October 22, 2026
|by Alpha Team
ZeroFox Daily Intelligence Brief - October 22, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- ZeroFox Intelligence Flash Report - FBI Suspects Ransomware Negotiator Aided ShinyHunters
- NPHP Flaws Prompt Government Websites to Go Offline as Precaution
- Geopolitical Focus: U.S. Orders Staff to Leave Saudi Arabia, Taiwan Accuses China of Misinformation, Ebola Outbreak, and More
ZeroFox Intelligence Flash Report - FBI Suspects Ransomware Negotiator Aided ShinyHunters
Source: https://www.zerofox.com/advisories/42727/
What we know: The FBI arrested a prominent cybersecurity executive on October 8, 2026, in connection with its ongoing investigation into the ShinyHunters extortion group, with the bureau suspecting the executive operated shinywire[.]com—a now-defunct site used to pressure ShinyHunters victims into paying ransoms. A second cybersecurity executive from a separate firm has also been identified as a very likely active participant in the same site.
Context: Separately, the CEO of a ransomware recovery company was arrested for defrauding victims by claiming to use proprietary decryption technology while secretly paying attackers for decryption keys.
Analyst note: Ransomware negotiators and incident mitigation service providers very likely represent a secondary threat layer—and these most recent examples are not isolated. Many insurance providers suggest victims work with specific incident response firms; however, most breach response companies are unlikely to facilitate payments to threat actors, based on standing advice from the FBI and CISA not to pay ransoms.
PHP Flaws Prompt Government Websites to Go Offline as Precaution
What we know: Government agencies and other organizations across the world temporarily took their websites and online services offline as a precaution after two vulnerabilities were found in the PHP language, which powers a large portion of the internet’s websites. A major tech company reportedly detected attempts to exploit the flaws against its honeypot infrastructure.
Context: The shutdowns reportedly affected government portals, hospitals, schools, and other public-facing services, as well as some Wikimedia systems. The outages were largely precautionary and do not indicate that the affected organizations were compromised. PHP has released fixes for supported versions, while PHP 8.1 and older remain end-of-life and require migration to a supported release.
Analyst note: Continued exploitation attempts are very likely against internet-facing PHP systems that remain unpatched, particularly older or unsupported deployments. The public availability of patches and technical details of proof-of-concept (PoC) are likely to accelerate vulnerability scanning and exploit development, while AI-assisted analysis can further reduce the time required for threat actors to reverse-engineer the vulnerabilities.
Geopolitical Focus: U.S. Orders Staff to Leave Saudi Arabia, Taiwan Accuses China of Misinformation, Ebola Outbreak, and More
- The U.S. Department of State has ordered non-emergency government employees and their families to leave Saudi Arabia amid increasing Houthi attacks on civilian airports and critical infrastructure. The State Department denied reports of similar ordered departure from the UAE, Jordan, Qatar, and Bahrain.
- Taiwan’s National Security Bureau reportedly accused China of spreading more than 2.5 million pieces of disputed or false online information targeting Taiwan to influence its upcoming local elections. The content reportedly focused on energy, food security, defense policy and specific electoral candidates.
- Nigeria has confirmed one imported case of Ebola Bundibugyo virus disease involving an individual with a recent travel history to Uganda. Authorities are tracing 44 contacts. The Bundibugyo Ebola outbreak now spans three regions of Africa and has infected more than 9,500 people and killed over 4,600.
- Super Typhoon Champi is moving towards Taiwan and eastern China as it strengthened to Category 5 with 185 mph winds. Taiwan reportedly issued a maritime warning, urging vessels in the Bashi Channel and waters east and north of Taiwan to remain alert. It is expected to bring 18 inches of rain, damaging winds, potential flooding and power outages.
DEEP AND DARK WEB INTELLIGENCE
RehubCom user dharmaka: Untested threat actor "dharmaka" has advertised network access allegedly associated with an unnamed Canada-based air ticket sales company on the predominantly Russian-language dark web forum RehubCom. The actor claims the access provides entry to a database running Trams Back Office, a travel industry accounting and financial management system developed by TRES Technologies and associated with Sabre. The advertised access allegedly enables management of accounting, financial, commission, debt, and creditor functions, as well as integration with Global Distribution Systems and generation of financial and ticketing reports.
VULNERABILITY AND EXPLOIT INTELLIGENCE
Plex2Shell vulnerabilities: CISA has added four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), collectively known as Plex2Shell, to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to patch them. The flaws can be chained to achieve unauthenticated remote code execution (RCE) and have reportedly been exploited to deploy cryptocurrency miners and proxy malware.
Affected products: Plex Media Server 1.43.3.10861
Tags: DIB, tlp:green