国家サイバー統括室(注意・警戒情報)
@cyber_forecast
【更新】PHPの複数の脆弱性（PHP2Shell）に関する注意喚起を更新。あるファイアウォール製品で侵害の成功を示唆する痕跡を確認したと報告されています。引き続き、本脆弱性の対処に関しては利用製品への影響を確認し、速やかな対策と侵害調査をお願いします。 t.co/dPIBKxqc1z
Okta
Security incidents tagged Okta. Newest first.
3 Okta incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 5
- Live
- 3
- Patched
- 4
- Days without an incident
- 0
- Longest quiet run: 929 days (Feb 2–Aug 18)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- LiveHighNo fix neededBreaches
"Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agents
Distributed Denial of Secrets published "Icepick" on Oct 28 2026, an archive covering more than 41,000 employees and contractors of the US Department of Homeland Security and seven component agencies, including ICE and CBP. The records, last updated Aug 19 2026, include work email addresses, cellphone numbers, office addresses, supervisors and more than 55,000 permission-group names, some referencing undercover operations, wiretap programs and tools such as Palantir and PenLink. DDoSecrets says the data came from DHS's Okta login system via a group calling itself the Department of Peace; Okta says it has no evidence its own systems were compromised.
US Department of Homeland Security (Okta identity directory)Since Oct 28, 2026
- LivePatchedPatch now
Okta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546)
Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.
Okta Access Gateway (on-prem appliance)Since Oct 22, 2026
- LiveCriticalPartly patchedPatch now
PHP2Shell: critical unauthenticated RCE in PHP core
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
PHPSince Oct 17, 2026
Show 2 older incidents2 older incidents
November 2023 1
HighCloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breachBreachesNo fix needed
Cloudflare internal Atlassian environment No fix needed
A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.
September 2023 1
- ClosedHighNo fix neededBreaches
Okta support system breach: HAR files with session tokens stolen
An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.
Okta Help Center (customer support system)Closed Nov 29, 2023
Posts 35
- PHP2Shell: critical unauthenticated RCE in PHP core
- "Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agentsInternational Cyber Digest@IntCyberDigest
‼️ BREAKING: A leak has exposed ~41,000 Homeland Security workers, including undercover ICE agents. Wired found mobile numbers, ICE and CBP sites and groups tied to Palantir and Grok. DDoSecrets says it came via DHS's Okta login. Okta says it has no evidence it was compromised. t.co/fqaan4E5P5
- "Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agentsWIRED@WIRED
The leaked records include the locations of ICE and CBP facilities, workers' cellphone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot. t.co/av5nTBqwAo
- PHP2Shell: critical unauthenticated RCE in PHP coreGreyNoise@GreyNoiseIO
GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619). On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor. "We’re seeing successful exploitation of these t.co/GtgtBgtn5l
- PHP2Shell: critical unauthenticated RCE in PHP corePraetorian@praetorianlabs
php2shell is exploitable, the easy path needs display_errors=On. We found zero live customer hosts with it. Under default config, the leak takes heap control down to the freelist. Blog: t.co/6OpSN35DvL Demo: t.co/iaZFQLbcBH #OffensiveSecurity #PraetorianGuard t.co/Vys6PpGVlS
- PHP2Shell: critical unauthenticated RCE in PHP coreFlorian Roth ⚡️@cyb3rops
Interesting finding from my colleagues for anyone following #PHP2SHELL activity They found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs t.co/LzPMiLuSRh
+29 more on the incident pages above.