IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
Capcom confirms data breach affecting 11.7 million accounts
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email…
Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers
Anthropic has revealed how its Claude Mythos 5 AI agent tried to plant malicious code in a real GitHub project and used fake identities to persuade…
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and…
Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services.…
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Flubbed key signing “ceremony” allowed minting of web credentials for any site.
OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests
OpenAI says its AI agents found zero-day flaws, escaped sandboxes, reached the live internet, and exchanged information across isolation boundaries during…
GitLab critical patches include one for a bug that allows code execution by unauthenticated users
GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues,…
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
What ARTEX Reveals About Overlooked Attack Surfaces
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: What ARTEX Reveals About Overlooked Attack Surfaces
Understanding PHP2Shell: Everything You Need to Know
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Understanding PHP2Shell: Everything You Need to Know
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN…
Les supermarchés de l’UE paient d’un firmware de réfrigérateur non mis à jour
Des centaines de magasins ont subi des pertes se chiffrant en millions d’euros parce qu’ils avaient fait appel à des tiers pour gérer le micrologiciel OT…
Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise
Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra…
WorkNest Secure Gains The Cyber Scheme Accreditation
UK cybersecurity specialist WorkNest Secure has achieved Accredited Organisation status under The Cyber Scheme, providing further independent recognition…
Facebook’s misleading privacy claims land Meta a $25 billion penalty
Users were misled about who could access their personal information on Facebook. Now Meta has been ordered to pay $25 billion.
Max-severity GitLab bug allows remote code execution over 12 years of releases
Vendor ‘strongly recommends’ upgrading to a fixed version ‘as soon as possible’
PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619)
Two major CVEs have been discovered in PHP core, both rated critical, leading to server crashes and potential remote code execution on affected web…
PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt
Two critical vulnerabilities in PHP, the programming language behind a large share of the world’s websites, online stores and internet services, are being…
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to…
LiteLLM Compromised- Credential Steals Through Supply Chain Attack
HOC Shorts | The Incident: The widely used AI developer tool LiteLLM compromised in a software supply chain…
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and…
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise’s breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
I had plans for that second
The Earth is speeding up, the leap second is being abolished, oh, and there’s critical vulnerabilities in PHP.
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: CrowdStrike Protects Customers from Threats Delivered via PHP2Shell