IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
AI-powered phishing detection, third PHP2Shell bug, Quest medical breach
Microsoft Teams to get AI-powered, context-aware phishing detection…
Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software…
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security…
Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities
Microsoft released emergency out-of-band security updates addressing four vulnerabilities across .NET, including a Brotli buffer overflow and incomplete…
DeepSeek, Huawei Narrow AI Performance Gap With Nvidia
Huawei’s collaboration with start-up DeepSeek and Huawei’s own engineering efforts are paying off in spite of inferior resources, finds study
A week in security (October 19 – October 25)
A list of topics we covered in the week of October 19 to October 25 of 2026
Microsoft Authenticator Flaw Allows Android Apps With Zero Permissions to Steal Authentication Tokens
A high-severity vulnerability in Microsoft Authenticator for Android could let a malicious app, without any Android permissions, impersonate trusted…
Meta Free Cash Flow Falls Into Red Amid Heavy Spending
Facebook parent raises low-end for this year’s capital expenditures, discloses $825bn in future spending commitments
Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in…
Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-2026-111497
Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026. This update introduces two detection rules for the…
AI slop is piling up highest on the biggest open-source projects
The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and…
Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions
Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal…
OpenAI Codex Breaks USB Drive Encryption in Minutes, Exposing Critical Security Flaws
OpenAI Codex helped researcher Xusheng Li identify vulnerabilities in encrypted USB and copy-protection products, showing how AI can speed up reverse…
Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity,…
India’s Film Sensor Board Data Breach – Unreleased Scripts, 500+ Film Titles Exposed
India’s Central Board of Film Certification (CBFC) is investigating a reported data breach involving confidential documents linked to more than 500 film…
Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This…
Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the…
Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical…
Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat…
Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to…
r/opensource bans AI projects, and solo devs go down with them
Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for…
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government…
Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC
A security researcher known online as killa has won a public Bitcoin challenge by using two critical PHP flaws to reach a test server. The winning run…
Work to protect DNS from quantum decryption attacks is speeding up
PLUS: Regional internet registry reform nears; Trustworthy-sounding domains attract scammers