Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-83844 in Microsoft Paint: the source articles reported no exploitation. NVD rates it 7 (HIGH) on CVSS v3.1. (checked 2026-11-08)
- CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-11-06)
- CVE-2026-109619 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-11-06)
TL;DR
Claude Code exposed passwords and API keys in 1,122 public GitHub repositories when users selected 'Don't Ask Again' on commands. Microsoft Paint RCE patch is live but only via the Store. PHP vulnerabilities affecting ~70% of websites are now actively exploited.
Executive Summary
- Anthropic's Claude Code AI assistant inadvertently saved developer secrets to a persistent cache file that ended up in 1,122 public GitHub repositories, exposing passwords, API keys, and authentication tokens.
- Microsoft Paint remote code execution vulnerability (CVE-2026-83844) is now patched, but the fix is delivered exclusively through the Microsoft Store and will not reach users via standard Windows Update.
- PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting approximately 70% of websites have moved from PoC to active exploitation, with researchers warning of potential site outages.
- WordPress patch installations remain vulnerable during the update window, allowing attackers to strike as the old code unpacks patched files.
- OpenSSH SSHole flaw (CVE-2026-123158) is under active attack within hours of disclosure, with threat actors gaining root access on honeypot systems.
Top Threats Today
1. Claude Code Credential Exposure in Public GitHub Repositories
Severity: HIGH Affected: Technology
Passwords and API keys entered into commands approved via Anthropic's Claude Code AI assistant are exposed in 1,122 public GitHub repositories [1]. When developers select 'Yes, and don't ask again,' the AI saves the full command including embedded secrets to a persistent cache file, which can be committed to ⚠ version control systems [1]. Any attacker with GitHub access can enumerate and harvest these credentials for further compromise.
Sources:[1] The Hacker News
Recommended Action
- Search GitHub for any personal or organizational repositories containing Claude Code cache files (typically in project root or .claude directories)
- Rotate all API keys, database passwords, and authentication tokens that may have been pasted into Claude Code commands
- Audit commit histories for accidental secret commits and use GitHub's secret scanning to identify exposed credentials
- Disable the 'Don't Ask Again' feature in Claude Code and require explicit approval for each command
2. Microsoft Paint Remote Code Execution – Patched but Delivery Gap
Severity: HIGH Affected: Technology
A remote code execution vulnerability in Microsoft Paint (CVE-2026-83844) has been fixed, but the patch is available only through the Microsoft Store, not via Windows Update [1]. The corrected build 11.2609.401.0 is now deployed through the Store and was confirmed as the latest version in multiple countries ⚠[1]. Organizations relying on centralized Windows Update deployment will not automatically receive this patch, leaving systems vulnerable until users manually install from the Store.
Sources:[1] The Hacker News
Recommended Action
- Communicate to end users that Paint updates must be installed directly from the Microsoft Store, not via Windows Update
- For managed environments, configure deployment of Microsoft Store apps or test manual Store update workflows
- Consider disabling Paint functionality if RCE risk is unacceptable pending full organizational patching
3. PHP Vulnerabilities Under Active Exploitation – 70% of Web at Risk
Severity: HIGH Affected: Technology
Two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) permit attackers to achieve full server takeover and are now actively exploited in the wild [1]. Nearly 70 percent of websites depend on the affected core PHP software and require urgent updates to prevent compromise [1]. Working exploits are publicly available, and security experts warn of widespread website outages as both vulnerable and patched instances compete for resources during mass remediation ⚠[1].
Sources:[1] Krebs on Security
Recommended Action
- Immediately patch PHP to the latest patched version; prioritize production web servers and APIs
- If patching cannot be completed immediately, implement Web Application Firewall (WAF) rules to block known exploit patterns
- Monitor server logs and process execution for suspicious activity during and after patching
- Coordinate patching windows with application teams to minimize outage risk during mass remediation wave
4. OpenSSH SSHole Actively Exploited Post-Disclosure
Severity: HIGH Affected: Technology
Threat actors are actively exploiting CVE-2026-123158 (SSHole), a recently disclosed OpenSSH flaw enabling sign-in to accounts with no password set, within hours of public disclosure [1]. Previdian researchers observed attackers successfully gaining root access on honeypot systems, demonstrating reliable weaponization [1]. The vulnerability carries a CVSS score of 8.1 and affects Linux systems running vulnerable OpenSSH versions [1].
Sources:[1] The Hacker News
Recommended Action
- Patch OpenSSH to the latest version immediately on all Linux systems
- Disable password-less account access or enforce strict SSH key rotation policies
- Enable SSH access logging and monitor for unexpected root-level logins from unfamiliar source IPs
- Consider temporarily restricting SSH access to known networks via firewall rules during patching
5. Major Data Breaches: Iris Ohyama, Crédit Mutuel, DigiCert
Severity: HIGH Affected: Retail, Finance, Technology
Iris Ohyama, a Japanese e-commerce and retail manufacturer, disclosed that personal information of approximately 7.7 million customers was exposed after unauthorized access to a third-party cloud service [1]. Crédit Mutuel Arkéa, a French cooperative bank, was targeted in a cyberattack enabling fraudulent transactions up to $133 million via a compromised service provider [2]. DigiCert, a certificate authority, reported an internal business system was externally accessible over the summer, allowing an attacker to create an unauthorized account and access customer business information including names, email addresses, phone numbers, and business addresses [3].
Sources:[1] BleepingComputer[2] BleepingComputer[3] The Record
Recommended Action
- Monitor for credentials or data tied to your organization in breach databases and threat feeds
- If your organization uses DigiCert certificate services or was a customer, audit account access and certificate issuance logs
- Review third-party cloud service access controls and enforce least-privilege principles with vendors
- Implement continuous monitoring of financial transactions for anomalous patterns indicative of fraud
Ongoing Coverage
Earlier briefings covered SonicWall VPN authentication bypass (CVE-2026-19868, now on CISA KEV), WordPress patch installation vulnerabilities, and a 1.3 million Android TV box botnet takedown. See earlier coverage for detail.
Today’s Action Checklist
- ☐ URGENT: Audit GitHub repositories for Claude Code cache files and rotate all exposed credentials
- ☐ URGENT: Patch PHP servers to address CVE-2026-109618 and CVE-2026-109619 before active exploitation spreads
- ☐ URGENT: Update OpenSSH to patch CVE-2026-123158 (SSHole) on all Linux systems
- ☐ HIGH: Verify Paint updates are distributed via Microsoft Store and test in pilot environments before full rollout
- ☐ HIGH: Check if your organization is a Iris Ohyama, Crédit Mutuel, or DigiCert customer; if so, review breach notifications and reset credentials
- ☐ MEDIUM: Disable Claude Code 'Don't Ask Again' feature organization-wide pending further security review