Daily digest,
Multiple Vulnerabilities Disclosed in Major Programming Languages (+4 more)
Vulnerabilities
Multiple Vulnerabilities Disclosed in Major Programming Languages
In a span of four days, 16 vulnerabilities were disclosed across major programming languages, including PHP, Java, and Python. The Korea Internet & Security Agency (KISA) reported a remote code execution vulnerability in PHP, which can be exploited without authentication. This vulnerability was identified during session processing and allows attackers to execute malicious commands. Following the PHP disclosure on October 21, vulnerabilities were also reported in Node.js, GitLab, and Python, with Node.js experiencing the highest number of issues. AI has played a significant role in identifying these vulnerabilities, accelerating the patching process. However, the rapid discovery of flaws has created a race against time for organizations to implement fixes before exploitation occurs. The vulnerabilities have been officially patched, but the ongoing threat remains as hackers attempt to exploit these weaknesses.
Vulnerability · 2 sources · score 70 · Node2Shell
Critical PHP Vulnerabilities Prompt Global Security Response
The PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, with a CVSS score of 9.2. These flaws could allow attackers to take over servers, prompting urgent patching efforts worldwide. The foundation operates with only one full-time employee, highlighting its underfunded status despite PHP's critical role in powering up to 70% of websites globally. Following the disclosure, mass scanning and exploitation attempts were reported, although no successful compromises have been confirmed. The vulnerabilities were publicly disclosed after a leak, leading to heightened security measures, including the temporary shutdown of several government websites in Europe. A third flaw, CVE-2026-115560, was identified shortly after, but it is considered less likely to be exploited in practice. Organizations are urged to apply the available patches immediately to mitigate risks.
Vulnerability · 2 sources · score 70 · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
High-Risk Authorization Bypass in phpMyFAQ Disclosed
A vulnerability, CVE-2026-116183, has been identified in phpMyFAQ versions prior to 4.1.10, allowing unauthenticated attackers to modify or delete visitor questions via the public API. The flaw stems from an object-level authorization bypass, where attackers can supply arbitrary openQuestionIDs to POST requests without proper ownership checks. This vulnerability has a CVSS score of 7.5, indicating a high severity level. Although no active exploitation has been confirmed, the risk remains significant for internet-accessible deployments, especially those with deletion capabilities enabled. Security teams are urged to upgrade to version 4.1.10 or later and monitor for unusual API activity. The vulnerability was publicly disclosed on October 25, 2026, and is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability · 2 sources · score 64 · CVE-2026-116183
AI-Driven PHP Vulnerabilities Spark Internet Security Concerns
Recent vulnerabilities in PHP, a backend language used by 70% of websites, have led to significant disruptions, including the takedown of government and gaming websites. Cloudflare CEO Matthew Prince warns that AI tools are making it easier for both researchers and attackers to discover critical flaws, with many more vulnerabilities expected to surface in the coming years. The Electronic Frontier Foundation reported that 3% of all software vulnerabilities were identified in October alone, with nearly a quarter of known issues discovered this year. These developments indicate a shift in how vulnerabilities are found and exploited, as AI reduces the time and expertise needed for such tasks. The PHP flaws have already caused widespread outages, prompting urgent patching efforts across affected systems. Experts emphasize the need for enhanced defensive measures, including the use of AI in cybersecurity strategies.
Other Threats · 3 sources · score 64
Threat actors and malware
AI Agents Transform Cybersecurity Landscape with New Threats
The World Economic Forum's Global Cybersecurity Outlook 2026 highlights the complexities introduced by AI agents in enterprise systems, emphasizing the need for robust governance. AI agents can automate tasks and enhance offensive operations, but they also pose risks such as accumulating excessive privileges and propagating vulnerabilities. A notable incident cited is Anthropic's disclosure of a cyber espionage operation in November 2025, marking the first confirmed use of AI agents in full-scale attacks against high-value targets. The report indicates a rise in organizations assessing AI tool security, from 37% in 2025 to 64% in 2026. However, the speed and persistence of these agents necessitate continuous verification and accountability structures based on zero-trust principles. The integration of AI in cybersecurity is reshaping both attack and defense mechanisms, requiring urgent adaptation from security professionals.
APT · 2 sources · score 52 · Iranian Cyber Espionage
New on leak sites
24 victims listed on ransomware leak sites by 8 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-115560, CVE-2012-1823
- Malware: Amadey, Aoki, Danabot, IcedID, Latrodectus
- Campaigns: Be Ready, ClickFix campaign, Fortress America, Ghana Anti-Disinformation Coalition Project, Iranian Cyber Espionage
- Vulnerabilities: Brotli Decoder Out-of-bounds Write, HTML2Shell, Log4j, Node2Shell, OS Command Injection
- Ransomware groups: Chaos, Emperador, N0n
- APT groups: Electrum, FulcrumSec, Handala, Lazarus, Lunar Spider
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.