IT Security News: Morning roundup, 2026-10-22 Summary This roundup highlights a growing trend of threat actors weaponizing artificial intelligence, as seen in AI-assisted attacks across Latin America and Asia alongside malicious AI agent skills designed to subvert code reviews. Alongside…
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords,…
Workshop on Economics and Information Security (WEIS) Archive
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s…
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the…
EU wants Booking.com to check out of its scam problem
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses ‘absolutely substandard’
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. […]
Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and…
Splunk Patches Three Critical 9.9 Flaws and Two RCE Vulnerabilities
Splunk’s October 21 security updates address three critical CVSS 9.9 vulnerabilities and two authenticated RCE flaws. Here’s what administrators need to…
Amazon Bee Frontier and Bee Eclipse Raise Workplace Consent Concerns
Amazon’s new Bee AI devices can summarize conversations, but their recording controls raise consent questions for employers and meeting participants.
Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence
Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and…
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not…
Top 10 Best Secure File Sharing Platforms in 2026 [Ranked & Scored]
Users share files the easiest way available your only real choice is whether the easiest way is also the governed one. The 2026 secure-sharing shortlist…
ARTEX AI Tool Linked to Cyberattacks on Japanese Companies
Researchers linked the ARTEX AI tool to cyberattacks targeting Japanese companies, while separate findings reveal how attackers exploit mobile apps and…
Top 10 Best Enterprise DRM & Information Rights Management Solutions in 2026 [Ranked & Scored]
Perimeters don’t follow files. The deal model emailed to a counterparty, the design doc shared with a contractor, the board pack synced to a trustee’s…
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But…
Fortinet Urges Customers to Patch Critical Flaws Affecting FortiOS, FortiManager, and FortiAnalyzer
Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated…
IT Security News Hourly Summary 2026-10-22 13h : 34 posts
34 posts published in the last hour 10:36What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers 10:36Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks 10:35Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches 10:35Cisco…
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an…
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
ChatGPT Can Now Do More in Chrome, but There’s a Security Trade-Off
OpenAI expands ChatGPT’s Chrome integration with tab access and browser automation. Learn what the update means for productivity, privacy, and enterprise…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
12 DevSecOps Platforms: The 2026 Buyer’s Verdict Guide
DevSecOps platforms sell one promise in several architectures: security that rides the development workflow instead of auditing it afterward. The 2026…