Security News — 21 October 2026

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

Exploited

PoC

Audience

Windows admins

Action

Patch when a fix is available; monitor exposure

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before th…

php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

Impact

Remote code execution

Audience

Linux/server admins

Action

Patch when a fix is available; monitor exposure

CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this…

Two critical RCEs in PHP core

Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the…

Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers

Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sh…

FreshRSS 1.30.4

Milestone This is a fourth security release in the continuation of 1.30.x , mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were alread…

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected…

FreshRSS 1.30.3

Milestone This is a third security release in the continuation of 1.30.x , mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delay…

“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Mu…

Compromised eMudhra intermediate certificates

Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply…

Critical Vulnerabilities in PHP Require Immediate Patching

Update October 23, 2026 : CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance. Purpose CISA…

ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)

Workshop on Economics and Information Security (WEIS) Archive

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.