IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on… what could possibly be hiding inside? We break out a…
OpenAI’s models are deliberately breaking their misalignment monitoring systems
AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two…
Almost 50 arrested as police target Western Balkan network linked to killings
Nearly 50 suspects have been arrested in an international operation targeting a drug trafficking network with Western Balkan members, linked to killings,…
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix…
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
‘Coordinated vulnerability disclosure, unless there’s evidence of active exploits in the wild,’ Chainguard CEO tells The Reg
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
2026-10-09: Pcap of infection from Macfinger Clickfix activity
This post has no text preview — click the link below to read the original article. This article has been indexed from Malware-Traffic-Analysis.net – Blog Entries Read the original article: 2026-10-09: Pcap of infection from Macfinger Clickfix activity
The Nansh0u Campaign – Hackers Arsenal Grows Stronger
In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses…
2026-10-22: Seven days of scans and probes and web traffic hitting my web server
This post has no text preview — click the link below to read the original article. This article has been indexed from Malware-Traffic-Analysis.net – Blog Entries Read the original article: 2026-10-22: Seven days of scans and probes and web traffic…
From Seats to Usage: How AI Is Changing Software Monetization
From Seats to Usage: How AI Is Changing Software Monetization josh.pearson@t… Fri, 10/23/2026 – 07:36 Traditional software business models have long…
2026-10-16: Coruna-like iOS exploit kit traffic
This post has no text preview — click the link below to read the original article. This article has been indexed from Malware-Traffic-Analysis.net – Blog Entries Read the original article: 2026-10-16: Coruna-like iOS exploit kit traffic
Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site
On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access.…
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We…
The Oracle of Delphi Will Steal Your Credentials
Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced…
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of…
Two critical PHP flaws put the web on alert as emergency patches arrive
Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the…
Zoomtopia 2026: Zoom Introduces AI Agents, New Security Controls
Zoom unveils AI agents and its Unified Context Layer at Zoomtopia 2026. Learn how its new automation and security tools could affect IT teams.
Ahold Delhaize Cyberattack Disrupts Online Grocery Services in US, Europe
Ahold Delhaize took IT systems offline after a cyberattack disrupted grocery services in the US and Europe, highlighting business continuity challenges.
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to…
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,”…
Beyond Day Zero: Akamai’s Rapid Response and AI Threat Intelligence
Discover how Akamai responded to critical PHP vulnerabilities using agentic AI, real-time telemetry, and rapid action switching to deliver adaptive WAF…
WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
Hackers Exploit Open Banking to Test Stolen Bank Logins for Free
Hackers used open-banking services to test stolen bank logins for free. Group-IB uncovered related phishing activity and verification costs for platforms.