Daily Tech Insights — Wednesday, October 28, 2026

We examine firewall exploits, AI session theft, and recent breaches to ask if you are compromised without knowing it. Full credits and links in the show notes.

Daily Tech Insights — Wednesday, October 28, 2026

This episode investigates whether small and mid-sized businesses are suffering silent breaches, highlighting a China-linked threat actor actively exploiting PHP vulnerabilities to gain root access on firewalls. We also examine the rise of infostealers targeting AI assistant sessions and recent incidents at major providers like 123 Reg and GMO, which underscore the critical detection gap in lean IT teams. The core argument is that silence does not equal safety, prompting a shift toward assuming breach until proven otherwise.

In this episode

• A China-linked threat actor is chaining PHP vulnerabilities with a Linux kernel bug to drop persistent webshells on unpatched, internet-facing firewalls.
• A new infostealer named Aokigahara targets developer keyrings and active AI assistant sessions, stealing live tokens and API keys rather than just static passwords.
• The 123 Reg breach, suspected to be linked to the Artex group, highlights the expanding blast radius of third-party service provider compromises for SMBs.
• The University of New Mexico Health Sciences Center incident, where 36,000 systems were compromised, serves as a wake-up call to audit privileged identity accounts and Active Directory integrity.
• The GMO data breach illustrates the detection gap in lean IT teams, reinforcing the need to assume breach and focus on limiting the critical harm of data leakage.

News stories

• PHP2Shell Exploits Trigger 'Black October' Cybersecurity Surge — 조선일보
• The Reality Revealed by the GMO Data Breach: In an Era Where Even the Digital Agency Gets Hit, Small and Medium-Sized Enterprises Are 'Being Hit Without Realizing It' — note
• 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants — Dark Reading
• [UNM Health Ransomware: 36,000 Systems Claimed [2026]](https://news.google.com/rss/articles/CBMijAFBVV95cUxNQUhENjkwaERWWmtIRGd2UFBEWnpMZXlDczNCV21VTV9xdm9vcDh3RnNOS2M2RjFqU3ZEY3FsOTlJUXNRXzF4ejk2NkhwTzVfbzF4NkNXdGZSZ05nZk9UTldyczJBcWdmVTZKTHBWVkhoaEFfZ3hWR0tEUWVnQmNoMzNVQ292T0hzMXdncQ?oc=5) — https://tech-insider.org/
• China-Linked Hackers Exploit PHP2Shell to Root Firewalls — SecurityWeek
• 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus — The Register

Music credits

• Music: "Werq" by Kevin MacLeod (incompetech.com) (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/)

---

Voices in this episode were generated with AI text-to-speech from the hosts' script.
Research and drafting for this episode were assisted by AI tools. All content was reviewed and fact-checked by the host.
Views expressed are my own and do not represent my employer.