IT Security News Roundup: 2026-10-22 Afternoon

IT Security News: Afternoon roundup, 2026-10-22

Summary

This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to public fixes. Alongside server infrastructure crises, software supply chain risks flared up with compromised GitHub release channels and the collapse of a global certificate authority due to cracked private keys. Furthermore, law enforcement actions, emerging extortion tactics, and AI-driven phishing and security scanning tools highlight a rapidly shifting cyber landscape.

1. Threat actors aggressively probed two critical PHP runtime vulnerabilities four days before official patches and public advisories were released. The head start left unpatched web infrastructure exposed to unauthorized code execution.
2. Attackers compromised a contributor's account to replace official OVHcloud GitHub CLI binaries with secret-stealing malware. The malicious releases went undetected for over an hour before customer checksum failures raised the alarm.
3. Kaspersky released detailed detection guidance for the critical PHP2Shell vulnerabilities affecting core PHP runtimes. Implementing endpoint monitoring and updating PHP installations are crucial to prevent server takeovers.
4. Coco Robotics and Serve Robotics are facing class-action lawsuits in Chicago over claims of illegally collecting biometric facial data using delivery robots. The cases highlight expanding legal and regulatory scrutiny over public AI data collection.
5. OpenAI introduced a Locked Chats feature in ChatGPT, enabling users to secure specific conversations behind biometric or PIN controls. The feature adds an extra layer of privacy for sensitive user prompts on shared devices.
6. Extortion group ScarlettGroup launched a dark web leak site featuring target company names alongside public countdown timers. The aggressive tactic increases pressure on victim organizations to pay ransoms before stolen data is exposed.
7. PHP maintainers issued emergency fixes for two core vulnerabilities while urging administrators to take unpatched servers offline. Active exploits in the wild present severe risk to unpatched web applications.
8. Certificate authority eMudhra shut down its SSL/TLS certificate issuance after researchers discovered private keys so weak they could be cracked in under a second. The critical flaw destroyed trust in the company's public key infrastructure.
9. PHP published emergency releases across several version branches to address two critical PHP2Shell remote code execution vulnerabilities. Because the bug lies in the PHP engine, all hosted applications are vulnerable until updated.
10. Fortinet received the 2026 Global Annual Cybersecurity Leadership Award from Crime Stoppers International. The award recognizes Fortinet's continuous collaboration with law enforcement to disrupt international cybercrime operations.
11. System administrators temporarily took websites offline worldwide to apply emergency patches for the newly disclosed PHP2Shell flaws. Rapid containment is necessary to block unauthenticated remote code execution attacks.
12. The FBI and CISA issued a joint alert warning that the SafePay ransomware gang poses an ongoing threat to critical infrastructure. The group was previously linked to a major cyberattack targeting distributor Ingram Micro.
13. Cybersecurity firm Huntress extended its distribution agreement with Ingram Micro across Canada, Latin America, and the Caribbean. The expansion consolidates channel access for managed service providers operating in those regions.
14. Security expert Corey Thuen discussed his methodology for identifying and hiring cybersecurity professionals with a natural adversarial mindset. He emphasizes that effective offensive security relies on innate curiosity and problem-solving skills.
15. A U.S. federal court sentenced Chukwuemeka Victor Amachukwu to eight years in prison for orchestrating business hacking, tax fraud, and investment schemes. The defendant was ordered to pay millions in restitution and forfeiture.
16. Amazon Threat Intelligence revealed that hackers targeted the PHP2Shell flaws four days before public patches were available. The pre-patch activity underscores the extreme risk posed during coordinated vulnerability disclosure windows.
17. A new industry analysis highlights how generative AI tools are enabling attackers to perform sophisticated account takeovers and phishing attacks. Defense strategies must evolve to counter increasingly natural human impersonations.
18. eMudhra announced its complete exit from the global SSL/TLS certificate market following the disclosure of severely compromised intermediate CA private keys. Web browsers rapidly took emergency action to revoke trust in eMudhra certificates.
19. Malwarebytes warned that mobile phone scammers are taking advantage of user warning fatigue to execute sophisticated voice and messaging fraud. Experts recommend using multi-factor protections and verifying unexpected communication channels.
20. Anthropic updated Claude Security to provide continuous background repository scanning and automatic fix tracking for software projects. The automated workflow helps software teams locate and resolve vulnerabilities faster.
21. The PHP security team issued emergency security patches for CVE-2026-109618 and CVE-2026-109619 to close critical remote code execution paths. System administrators are advised to upgrade their PHP installations immediately.
22. European and Ecuadorian law enforcement agencies arrested 20 suspects in Operation CANTABRIA to dismantle an international drug trafficking syndicate. The joint success demonstrates the importance of cross-border intelligence sharing.
23. Salt Security earned three cybersecurity industry awards at CyberDefenseCon 2026 for its API security and agentic AI capabilities. The awards highlight growing enterprise demand for AI-driven threat detection and API defense.
24. Researchers uncovered Athena StealthRoute, a new phishing-as-a-service platform that uses AI to create deceptive lures and obscure malicious traffic. The tool enables cybercriminals to execute stealthy credential theft campaigns.
25. PHP released emergency security updates targeting severe PHP2Shell vulnerabilities that allow unauthenticated code execution. Web hosters and server administrators must apply patches immediately to block server compromises.

Summaries written with AI (Google Gemini) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Hackers got a four-day head start on epic PHP2Shell vulnerability
2. OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware
3. Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
4. Chicago's Food Delivery Robots Face Lawsuits Over Facial Data Collection
5. ChatGPT Locked Chats Explained: How to Use It and What to Know
6. A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks
7. PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
8. eMudhra kills its certificate business after researchers cracked its private keys in under a second
9. PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
10. Fortinet Recognized by Crime Stoppers International for Cybersecurity Leadership
11. PHP2Shell: Why many websites had to go offline for emergency security updates
12. FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
13. Huntress Expands Ingram Micro Partnership Across Canada and Latin America
14. Hacker Conversations: Corey Thuen and the Evil Bit
15. Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft
16. Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched
17. When the attacker becomes the user: Rethinking account takeover
18. eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure
19. Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself
20. Claude Security Now Scans Repositories Continuously to Find Flaws and Track Fixes
21. PHP ships emergency patches for critical PHP2Shell flaws
22. European and Ecuadorian cooperation leads to 20 arrests in major hit against drug trafficking
23. Salt Security wins three InfoSec Innovator awards
24. New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
25. PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities