IT Security News: Overnight roundup, 2026-10-22 Summary This period's security developments were dominated by the rapid escalation of emergency patching for foundational web infrastructure alongside a surge in AI-driven attack vectors and governance challenges. Critical vulnerabilities in widespread technology stacks—including…
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral…
AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to…
ISOC, AI Agents, And The New Shape Of Security Operations
See how ISOC and AI agents are reshaping the SOC, helping teams investigate faster, reduce alert fatigue, and give human analysts more room for judgment.
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16. The…
Hackers Exploit ‘Basic Flaws’ To Attack French Supermarket Fridges
French cyber-security agency finds lack of basic security precautions enabled attacks that destroyed food, caused fires
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions…
Is the ad a scam? How to tell before you click
You can trust a social media platform and still get scammed by an ad running on it
Sites Go Dark As Admins Rush To Patch PHP Flaw
Governments, other organisations take websites offline after researchers publish fix for critical PHP flaw affecting 70 percent of internet
North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
North Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware…
Google Blames Power Outage For Widespread Cloud Disruption
Power issue blamed for outage at London data centre that roiled services for hours across banking, businesses, courts
IT Security News Hourly Summary 2026-10-22 10h : 31 posts
31 posts published in the last hour 07:36US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny 07:35Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal 07:35Meta Ordered to Pay New Mexico $25 Billion…
US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny
DeepSeek has been dealt a huge blow in the US, even as it continues to innovate and keep pace with, or in some cases outperform, rival models from…
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
Orlando, Florida, United States, 21st October 2026, CyberNewswire
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019.
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
A hacker hijacks more than 10% of Tor’s exit nodes, a second ransomware negotiator has been linked to ShinyHunters, a Chinese crime ring hacked Staples,…
Operation FlashHole: Lazarus breaks security, defies control
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and…
Hackers Plant Malware on Onamae.com Cloud Servers, 26,739 Systems Potentially Affected
Hackers gained unauthorized access to Onamae.com Desktop Cloud. They installed malicious programs in customer server environments, prompting the Japanese…
Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data
Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft…
Delinea gives AI assistants read-only access to governance data
Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already use. Using the…
ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)
This post has no text preview — click the link below to read the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: yellow Read the original article: ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144,…
PHP emergency patches, compromised TLS certificates, Signal hot mic bug
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/…
Pryx – Four Dead in Cairo, a Cybercrime Past and…
Simone Kraus writes: On October 9, 2026, Reuters introduced the world to Adem El Adeb, a 19-year-old so called former cybercriminal known as Pryx, who…