Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

A critical PHP security release is coming today, so get ready to update!
The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The project will publish those details, along with the patched version numbers, when the release goes out. Until then, administrators should assume every PHP installation they run could be affected.

Privacy-preserving AI can protect your heart data, the bill is the problem
Heart recordings now move from wearables through phones to cloud services and AI systems. Encryption protects stored and transmitted data, but processing usually requires decryption, and shared AI model updates can expose patient information. A dissertation by Istanbul Technical University’s Beyazıt Bestami YÜKSEL proposes protections tailored to each stage of that journey.

PHP2Shell: Critical PHP vulnerabilities patched, update now!
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately.

Say a few words, and a rigged AI asks for $5,000
Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,000, and AI agents reading the transcript made the transfer in a sandboxed banking environment.

AI agent permissions are outrunning security
Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago.

Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop an attacker, and why the cost curve turns steep once workloads move on premises.

AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the open-source language that runs websites and web applications. Calif found one of the PHP flaws using OpenAI’s GPT-5.6 Sol model, as part of OpenAI’s Patch the Planet initiative for open-source security, and Wiz independently found and reported both.

What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet.

New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21.

Drone program compliance: What a CTO says most agencies get wrong
In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short.

ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick.

Quarantined, but still on your calendar: The explosion of invite-based attacks
There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%.

AOMEI Backupper servers hijacked for minutes at a time to push backdoor
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals.

Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should be, sits the word “Helpline” and a phone number – the hook for a callback scam.

OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both episodes in a misalignment report released earlier this week and said it is tightening its defenses, but admits it cannot yet explain why the agents behaved this way.

RPO and RTO explained with a real disaster recovery example
In this Help Net Security video, Matthew Burden, CEO of BlackBox Hosting, explains RPO and RTO and how they differ in practice. RPO, the recovery point objective, is the most data you can lose, measured in time. RTO, the recovery time objective, is the longest your business can stay down. A backup does not guarantee quick recovery, and quick recovery does not help if the data is days old.

Bringing AI into the SOC means watching for shadow AI and loose permissions
In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata.

Why security tools lose sight of the credential
Credentials move across repositories, endpoints, pipelines, and collaboration tools. Removing an exposed AWS key does not reveal whether it still works, what it can access, or where other copies exist. Security teams must piece together answers across tools. An attacker may need only one valid credential.

With open-weight AI, more of the security burden falls on enterprises
Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing the risks of these models.

US Army is developing AI agents that could strike enemy networks and vanish without a trace
The US Army is looking for AI agents that can slip into an adversary’s network, find their target, copy themselves onto nearby tablets and computers, and then erase themselves before anyone notices.

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4.

Incomplete security patches show hackers where to look next
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year.

Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware.

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy.

eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates.

Signal flaw could expose audio and video even after users hang up
A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video calls in Signal’s apps, built on WebRTC, the technology browsers use for live audio and video.

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.

Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service. Its operators sent their entire working prompt to the decoy, expecting a live model on the other end to carry out the instructions.

Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the company’s web services and to play some of its games online.

Microsoft 365 accounts compromised at 79 organizations, no passwords needed
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.

UK proposes 14-year jail terms for subsea cable saboteurs
Damaging a cable on the seabed off the UK coast could soon cost someone 14 years of their life behind bars, under plans the British government published this week. The proposal comes from a White Paper by the Department for Digital, Culture, Media and Sport that would update laws protecting undersea cables and pipelines, some of which date back 140 years.

Ransomware pressure now reaches employees’ homes and families
Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack.

Half the AI bot traffic hammering your website comes from Meta
AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure.

Bearer CLI: Free, source-available code security scanning tool (SAST)
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below.

Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks
Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Apple and Google followed with 8% each. Dropbox and YouTube recorded the biggest climbs in the rankings.

Cloudflare bets you’re overpaying an LLM to read your invoices
Cloudflare released a preview of Clairic, an extraction model that pulls typed values out of messy text and images in one pass without generating tokens. In Cloudflare’s test on a damaged-product support claim, a pipeline built around Clairic finished in 19.3 seconds, against 61.7 seconds for a version that used an LLM at every step, and cost 49% less.

Your frontline workers have a workaround for that MFA prompt
Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months.

Microsoft wants to limit AI agents’ permissions when they stray from the job
Microsoft’s Guardian Agents in Project Perception adapt as agent activity, risk, security context and organizational policy change. They help security teams understand why risk changed, investigate relevant evidence, recommend or apply containment measures and use what they learn to strengthen policies. People retain control over objectives and consequential decisions.

Chrome flags malicious commands that scammers pass off as fixes
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering.

Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier
Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries.

DevGuard: Open-source vulnerability management for the software supply chain
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it.

Safari blocks trackers that turn your email into a tracking ID
Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers.

NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models, managing agent operations and enforcing security rules.

Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode.

AI agent observability is struggling to keep up with hallucinations
Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries.

AI coding boom exposes cracks in cloud development
Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report.

Africa cybercrime crackdown nets 1,462 arrests and over $105 million
Police in 21 countries arrested 1,462 suspects and took down 10,909 malicious networks in Operation Serengeti III, an INTERPOL-coordinated cybercrime sweep across Africa that ran from June 29 to August 31, 2026. Investigators recovered more than $105 million in illicit funds.

Anthropic finds 94 cases where open-source projects drop security controls without warning
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code running before security checks.

Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches for review.

AI is taking cybersecurity jobs at junior and experienced levels alike
Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report.

Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google positions them as options for demanding work, lower-cost professional tasks and everyday use that requires fast responses.

Cybersecurity jobs available right now: October 20, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: October 23, 2026
Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler.