News

What the cybersecurity press and forums are saying · updated
From the press
The Hacker News ·

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in…
The Register - Security ·

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
Help Net Security ·

Chrome puts insecure sites behind a permission prompt

Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction…
CyberScoop ·

Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. The post…
Dark Reading ·

TiDB Breach Exposes Flawed Cloud Security Assumptions

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.
SANS Internet Storm Center ·

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the…
The Record from Recorded Future News ·

Meta on the spot for $25 billion under New Mexico privacy ruling

The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
FIDO Alliance ·

Biometric Update: FIDO sets out certification framework for digital identity wallets

FIDO Alliance is advancing its digital identity wallet certification program with two technical frameworks intended to establish common requirements for credential management and help wallets verify…
BleepingComputer, Security ·

Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks

Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]
SecurityWeek ·

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis. The post Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP…
HIPAA Journal, Healthcare Data Breach ·

Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit

Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action […] The post Jefferson County Health Department Pays $2.25M…
Krebs on Security ·

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an…
CISA Known Exploited Vulnerabilities Catalog ·

Critical Vulnerabilities in PHP Require Immediate Patching

Critical Vulnerabilities in PHP Require Immediate Patching sbarker Oct 21, 2026 Release Date October 21, 2026 Description CISA strongly urges organizations to immediately patch the recently disclosed…
The Hacker News ·

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket,…
The Register - Security ·

OpenClaw creator says he spent $10 million in tokens last month

Good thing it's somebody else's money
Help Net Security ·

eMudhra security blunder left trusted CA signing keys exposed to anyone

Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On…
CyberScoop ·

PHP releases emergency fixes for 2 critical vulnerabilities

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. The post PHP releases emergency fixes for 2 critical…
Dark Reading ·

Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
The Record from Recorded Future News ·

Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity

Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
FIDO Alliance ·

Authenticate 2026 Day 3: Trusting the transaction in the agentic economy

Authenticate 2026 closes today with its busiest day yet for agentic AI. A morning session asks who’s on the hook when things go wrong, Mastercard covers Verifiable Intent, and PayPal […]
BleepingComputer, Security ·

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected

Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]
SecurityWeek ·

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches. The post PHP2Shell Patches Land as First Exploitation Attempts Hit…
HIPAA Journal, Healthcare Data Breach ·

HHS Sends Letters of Nonconformity to Suspected Information Blockers

The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health IT (ONC) has sent […] The post HHS Sends Letters of Nonconformity to Suspected Information…
CISA Known Exploited Vulnerabilities Catalog ·

CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors mnavarro Oct 21, 2026
The Hacker News ·

OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So

OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two…
The Register - Security ·

Reach new heights of laziness by burning tokens to let an AI tap your smartphone screen for you

Nothing will ruin your faith in humanity like an AI that operates your smartphone slowly, struggles with basic tasks, and can charge you for it
Help Net Security ·

NVIDIA unveils security architecture that can stop AI agents crossing set boundaries

NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing…
Dark Reading ·

Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.
The Record from Recorded Future News ·

Democrat lawmakers say Russia is aiming to undermine party ahead of midterms

The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
BleepingComputer, Security ·

Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
SecurityWeek ·

‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets

Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold. The post ‘Context Bombs’ Cut AI Attack…
HIPAA Journal, Healthcare Data Breach ·

Feds Issues Advisory About SafePay Ransomware Group

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in […] The post Feds Issues Advisory About…
The Hacker News ·

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and…
The Register - Security ·

Nvidia woos wary Europeans with more open weights models

New embedding, parsing, and reranking models promise smarter agentic RAG workflows
Help Net Security ·

PHP2Shell: Critical PHP vulnerabilities patched, update now!

The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on…
Dark Reading ·

'PHP2Shell' Bugs Signal Red Alert for Security Industry

Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
The Record from Recorded Future News ·

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it…
BleepingComputer, Security ·

CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]
SecurityWeek ·

High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as…
The Hacker News ·

Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social…
The Register - Security ·

LiteLLM supply chain attack hoovers up passwords and secrets

Plus a RAT for good measure - get threat hunting now
Dark Reading ·

OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors

A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
The Record from Recorded Future News ·

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
SecurityWeek ·

Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security

Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform. The post Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime…
The Hacker News ·

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa…
The Register - Security ·

AI will eat a fifth of tech budgets in 2027, but don't expect it to pay for itself

Forrester says only isolated wins are likely, while 'good enough' open-weight models soak up the tokens
Dark Reading ·

Optiv Launches CyberBOT Cybersecurity Awareness Training Program

Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.
The Hacker News ·

Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports

Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized,…
The Register - Security ·

Signal bug could keep your mic - and camera - on after hangup

Careful what you say after goodbye, or better yet, update your messaging app
Dark Reading ·

Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk

360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
The Hacker News ·

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that…
The Register - Security ·

OpenBSD 8.0 beefs up virtual machines and gets a taste of Wine

Proposed port brings 64-bit Windows apps within reach
Dark Reading ·

Decades-Old Windows Utility Powers Modern ClickFix Attack

The attack uses malicious Google search results related to Amazon and leverages the "finger" utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
On the forums
I'm tired of putting out the PHP fire
r/sysadmin · 588 · 202
Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
r/cybersecurity · 573 · 54 News - General
PHP patches for critical PHP2Shell vulnerabilities
r/netsec · 110 · 6
php patch is available now
r/hacking · 112 · 11 Vulnerability
PHP patch is now available
r/sysadmin · 631 · 168 General Discussion
PHP: Critical remote code execution vulnerabilities, update now
r/cybersecurity · 301 · 21 News - General
PHP - As an IT person, what should I be doing?
r/cybersecurity · 181 · 95 Business Security Questions & Discussion
Headlines and pictures belong to their publishers and link to them.