> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PHP urges immediate patching as details of two critical flaws reportedly leak
- URL: https://www.metacurity.com/php-urges-immediate-patching-as-details-of-two-critical-flaws-reportedly-leak/
- Published: 2026-10-21T12:24:48.000Z
- Updated: 2026-10-21T12:33:09.000Z
- Description: Emergency updates due today will address two critical vulnerabilities that researchers say could allow remote code execution across widely used PHP versions.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/phppng.png)

---

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

---

### The PHP security team is warning administrators to prepare for emergency security updates today to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.

PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services.

In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 am Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0.

The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available.

"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team warned.

The developers have not disclosed any technical details about the vulnerabilities, including which PHP versions are affected, how they can be exploited, or which releases will contain fixes.

However, security researchers at watchTowr told BleepingComputer that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7, and 8.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."

watchTowr also said it believes it has successfully reproduced CVE-2026-109618 but is not releasing technical information until security patches become available.

The researchers clarified that they have not observed exploitation of the vulnerabilities in the wild, despite the information reportedly leaking ahead of the planned disclosure.

In a post on X, watchTowr warned that information about the vulnerabilities had leaked before the originally planned disclosure date.

The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP.

Researchers from separate security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory. ([Lawrence Abrams / Bleeping Computer](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/?ref=metacurity.com) and [Dan Goodin / Ars Technica](https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/?ref=metacurity.com))

**Related:** [*PHP*](https://www.php.net/archive/2026.php?ref=metacurity.com#2026-10-20-1)*,* [*PHP*](https://www.php.net/index.php?ref=metacurity.com#2026-10-20-1)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/10/21/php-security-release-announcement-october-2026/?ref=metacurity.com)*,* [*CERT-EU*](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=metacurity.com)*,* [*watchTowr*](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/?ref=metacurity.com)*,* [*SecurityWeek*](https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/?ref=metacurity.com)*,* [*Wordfence*](https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/php-to-issue-emergency-patch/?ref=metacurity.com)*,* [*news.ycombinator.com*](https://news.ycombinator.com/item?id=50167754&ref=metacurity.com)*,* [*Hacker News*](https://news.ycombinator.com/item?id=50172041&ref=metacurity.com)*,* [*r/Wordpress*](https://www.reddit.com/r/Wordpress/comments/1xb5npo/upcoming%5Fcritical%5Fphp%5Fsecurity%5Frelease/?ref=metacurity.com)*,* [*r/drupal*](https://www.reddit.com/r/drupal/comments/1xb4o5m/critical%5Fphp%5Fsecurity%5Frelease%5Ftomorrow/?ref=metacurity.com)*,* [*r/laravel*](https://www.reddit.com/r/laravel/comments/1xb7nbr/critical%5Fphp%5Fsecurity%5Fupdates%5Fscheduled%5Ffor/?ref=metacurity.com)*,* [*r/PHP*](https://www.reddit.com/r/PHP/comments/1xb1gq4/warning%5Fclaims%5Ftwo%5F100%5Frces%5Faffect%5Fphp%5F5%5Fand%5Flater/?ref=metacurity.com)*,* [*Lobsters*](https://lobste.rs/s/ekxoyt/upcoming%5Fcritical%5Fphp%5Fsecurity%5Frelease?ref=metacurity.com)*,* [*Jackelsyn*](https://jackalsyn.com/posts/php-up-2026.html?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/?ref=metacurity.com)*,* [*Sansec*](https://sansec.io/research/php2shell?ref=metacurity.com)*,* [*Cyber Daily*](https://www.cyberdaily.au/security/14334-critical-alert-aussie-cyber-agency-warns-businesses-to-monitor-php-vulnerabilities?ref=metacurity.com)*,* [*Huntress*](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities?ref=metacurity.com)*,* [*The Stack*](https://www.thestack.technology/critical-php-vulnerabilities-poc-released-attacks-starting/?ref=metacurity.com)*,* [*Infosecurity Magazine*](https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/?ref=metacurity.com), [*Security Affairs*](https://securityaffairs.com/201403/security/php-prepares-emergency-fixes-for-two-critical-remote-code-execution-flaws.html?ref=metacurity.com)*,* [*BSI.bund.de*](https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.html?ref=metacurity.com)

0:00 

/3:04 

1× 

 Video of a purported exploit tool dubbed PHP2Shell executing code on webservers using PHP.

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-62.png)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-64.png)

### Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late Tuesday morning, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, said. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.” 

The most immediate threat appears to be for those using VPNs, especially in countries with governments likely to intercept traffic maliciously. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances that updates are in place. ([Dan Goodin / Ars Technica](https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/?ref=metacurity.com))

**Related:** [*emudhra*](https://emudhra.we-have-a-problem.com/?ref=metacurity.com)*,* [*Mozilla Security Blog*](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/?ref=metacurity.com)*,* [*Cloudflare*](https://blog.cloudflare.com/emudhra-certificate-compromise/?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/tech-giants-rush-to-block-flawed-emudhra-certs-that-could-enable-fake-sites?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/tech/2026/10/21/a-company-that-vouches-for-websites-had-secret-keys-so-weak-that-8-of-them-were-cracked?ref=metacurity.com)*,* [*iTnews*](https://www.itnews.com.au/news/cloudflare-warns-fixing-botched-emudhra-certs-goes-beyond-browsers-629804?ref=metacurity.com)*,* [*Implicator.ai*](https://www.implicator.ai/emudhra-key-compromise-30000-certificates/?ref=metacurity.com)*,* [*The Hacker News*](https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html?ref=metacurity.com)*,* [*Digit*](https://www.digit.in/news/general/google-apple-and-mozilla-block-emudhra-certificates-after-researchers-uncover-critical-security-flaw-how-to-be-safe.html?ref=metacurity.com)*,* [*AIM*](https://analyticsindiamag.com/ai-news/browsers-block-emudhra-certificates-after-key-flaw?ref=metacurity.com)*,* [*The Register*](https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312?ref=metacurity.com)*,* [*Scott Helme*](https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/?ref=metacurity.com)*,* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/?ref=metacurity.com)*,* [*eMudhra Limited*](https://emudhra.com/en/post/certificate-security-incident?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/emudhra-security-compromise/?ref=metacurity.com)*,* [*9to5Linux*](https://9to5linux.com/firefox-158-0-1-is-out-to-block-compromised-emudhra-intermediate-certificates?ref=metacurity.com)*,* [*Hacker News*](https://news.ycombinator.com/item?id=50166579&ref=metacurity.com)*,* [*r/PrepperIntel*](https://www.reddit.com/r/PrepperIntel/comments/1xbchen/the%5Finternet%5Fgoes%5Fon%5Fhigh%5Falert%5Fafter%5Fdiscovery/?ref=metacurity.com)*,* [*r/worldnews*](https://www.reddit.com/r/worldnews/comments/1xbbxjr/the%5Finternet%5Fgoes%5Fon%5Fhigh%5Falert%5Fafter%5Fdiscovery/?ref=metacurity.com)*,* [*r/rust*](https://www.reddit.com/r/rust/comments/1xba5mj/psa%5Fif%5Fyour%5Fprogram%5Fdoes%5Fhttp%5Frequests%5Fupdate/?ref=metacurity.com)*,* [*r/NixOS*](https://www.reddit.com/r/NixOS/comments/1xb4k59/update%5Fyour%5Fsystem%5Femudhra%5Fintermediate%5Fca/?ref=metacurity.com)*,* [*r/programming*](https://www.reddit.com/r/programming/comments/1xb32yj/emudhra%5Fintermediate%5Fca%5Fcompromise/?ref=metacurity.com)*,* [*r/CloudFlare*](https://www.reddit.com/r/CloudFlare/comments/1xb7ce4/8%5Femudhra%5Fcertificates%5Fare%5Fcompromised%5Fheres%5Fwhat/?ref=metacurity.com)*,* [*r/IndiaTech*](https://www.reddit.com/r/IndiaTech/comments/1xb0bmh/private%5Fkey%5Fcompromise%5Fof%5Femudhra%5Fintermediate/?ref=metacurity.com)*,* [*r/cybersecurity*](https://www.reddit.com/r/cybersecurity/comments/1xb5m8v/the%5Finternet%5Fgoes%5Fon%5Fhigh%5Falert%5Fafter%5Fdiscovery/?ref=metacurity.com)*,* [*r/india*](https://www.reddit.com/r/india/comments/1xbakka/emudhra%5Fintermediate%5Fca%5Fcompromise/?ref=metacurity.com)*,* [*r/technology*](https://www.reddit.com/r/technology/comments/1xb6re5/the%5Finternet%5Fgoes%5Fon%5Fhigh%5Falert%5Fafter%5Fdiscovery/?ref=metacurity.com)*,* [*r/technology*](https://www.reddit.com/r/technology/comments/1xaysr5/protecting%5Ffirefox%5Fusers%5Ffollowing%5Fthe%5Fcompromise/?ref=metacurity.com)*,* [*Beehaw*](https://beehaw.org/post/29084111?ref=metacurity.com)*,* [*CSO Online*](https://www.csoonline.com/article/4238338/google-mozilla-revoke-emudhra-intermediates-after-private-key-compromise.html?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-63.png)

### Researchers at Symantec report that Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign.

The infamous group behind these hacks and the hacks of the Democratic National Committee during the 2016 election cycle is Swallowtail, also known as APT28, Fancy Bear, and Forest Blizzard, notorious for its links to the Russian military agency GRU.

The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency. In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material.

The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group. That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey. ([Tim Starks / CyberScoop](https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/?ref=metacurity.com))

**Related:** [*Security.com*](https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-65.png)

Source: Symantec.

### The battle over Chicago’s food delivery robots has reached the courts, with two customers accusing the companies behind them of collecting their biometric data without consent.

The men filed separate class-action lawsuits in Cook County court Oct. 9 against Coco Robotics and Serve Robotics, alleging the companies violated a state privacy law. They claim the companies’ machines scanned their faces and hands without their knowledge or consent.

Both companies dispute the allegations.

The lawsuits allege the robots’ cameras and LiDAR — a technology that sends out laser pulses to measure distances and map the surrounding environment — captured measurements of customers’ faces and hands as they approached the machines to retrieve their orders. ([Kade Heather / Book Club Chicago](https://blockclubchicago.org/2026/10/16/delivery-robots-accused-of-scanning-customers-faces-sharing-biometric-data/?ref=metacurity.com))

**Related:** [*Gizmodo*](https://gizmodo.com/delivery-robots-are-watching-you-according-to-lawsuit-2000828417?ref=metacurity.com)*,* [*r/technology*](https://www.reddit.com/r/technology/comments/1xba01z/delivery%5Frobots%5Faccused%5Fof%5Fscanning%5Fcustomers/?ref=metacurity.com)*,* [*KFBK*](https://kfbk.iheart.com/content/2026-10-20-delivery-robots-allegedly-scan-customers-and-collect-biometric-data-lawsuits-claim/?ref=metacurity.com)*,* [*Hoodline*](https://hoodline.com/2026/10/two-cook-county-lawsuits-accuse-coco-serve-robotics-of-scanning-faces-on-sidewalks/?ref=metacurity.com)

### State Bank of India (SBI) reported a cyberattack that resulted ‌in the disclosure of 3,897 customer records containing personally identifiable information on ​the dark web.

SBI said a ​preliminary analysis showed that the exposed information included customer ⁠names, mobile numbers, dates of ​birth, email addresses, residential addresses, brand ​and customer identifiers, along with loan records.

The lender said it has engaged an independent ​cybersecurity agency to conduct a ​comprehensive assessment and investigate the nature and extent ‌of the data leak. The leak is not expected to have any material impact on the bank's core ​business operations, ​financial ⁠performance or business continuity, the lender said. ([Saikeerthi / Reuters](https://www.reuters.com/legal/litigation/state-bank-india-reports-cyberattack-involving-customer-records-2026-10-21/?ref=metacurity.com))

***Related:*** [*The Times of India*](https://timesofindia.indiatimes.com/business/india-business/sbi-data-leak-nearly-4000-customer-records-found-on-dark-web-what-we-know-so-far/articleshow/135083923.cms?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/sbi-confirms-data-breach/?ref=metacurity.com)*,* [*WION*](https://www.wionews.com/india-news/sbi-confirms-data-breach-3-897-records-flagged-on-dark-web-is-your-money-safe-1792560065661?ref=metacurity.com)*,* [*India Today*](https://www.indiatoday.in/technology/news/story/sbi-confirms-cyberattack-3897-customer-records-stolen-and-put-on-dark-web-3021725-2026-10-21?ref=metacurity.com)*,* [*North Desk*](https://northdesk.in/sbi-data-leak-is-your-money-at-risk-dark-web-breach/?ref=metacurity.com)*,* [*Storyboard 18*](https://www.storyboard18.com/amp/digital/sbi-confirms-data-loss-incident-3897-customer-records-flagged-on-dark-web-113020.htm?ref=metacurity.com)*,* [*India.com*](https://www.india.com/business/cyberattack-on-sbi-bank-confirms-data-breach-over-3800-customer-records-stolen-and-shared-on-dark-web-is-core-banking-affected-cyberattack-online-scam-8537710/?ref=metacurity.com)*,* [*Hindustan Times*](https://www.hindustantimes.com/business/sbi-confirms-data-leak-involving-3-897-customer-records-in-preliminary-analysis-dark-web-sbi-share-price-101792561859046.html?ref=metacurity.com)*,* [*The Indian Awaaz*](https://theindianawaaz.com/sbi-under-cyberattack-3897-customer-records-found-on-dark-web/?ref=metacurity.com)*,* [*The Business Times*](https://www.businesstimes.com.sg/companies-markets/banking-finance/cyberattack-hits-indias-largest-bank-exposes-customer-records?ref=metacurity.com)*,* [*NDTV*](https://www.ndtv.com/business-news/sbi-data-leak-cyberattack-customer-account-phone-records-hacker-dark-web-12213824?ref=metacurity.com)*,* [*The Economic Times*](https://economictimes.indiatimes.com/tech/technology/sbi-hit-by-cyberattack-customer-data-leaked-on-dark-web-all-you-need-to-know/articleshow/135084283.cms?from=mdr&ref=metacurity.com)

### Osaka-based brokerage IwaiCosmo Securities Co. announced that a cyberattack on its online trading system allowed unauthorized trades in customer accounts and the personal data leakage of nearly 5,000 people.

The company and Tokyo-based Trade Works Co., which operates and maintains the system, disclosed the incident.

Unauthorized orders were placed in seven customer accounts, with trades executed in five, IwaiCosmo said.

An investigation also found that personal information on 4,975 people, including names and email addresses, had been exposed.

The company said it had contacted affected customers and restored the accounts to their pre-trade status, leaving them with no losses.

Trade Works said it detected the attack on Oct. 14 and immediately imposed access restrictions.

The company said the trades were unrelated to the leaked data and that no online trading passwords or other credentials appeared to have been compromised. ([The Asahi Shimbun](https://www.asahi.com/ajw/articles/16982425?ref=metacurity.com))

**Related:** [*Japan Wire*](https://english.kyodonews.net/articles/-/88873?ref=metacurity.com)*,* [*Nippon.com*](https://www.nippon.com/en/news/yjj2026102001170/?ref=metacurity.com)

### The personal information of officers and other employees at 22 prefectural police forces in Japan may have leaked following a recent data breach at disaster information services firm Arcadia Inc., Japan's National Police Agency officials said.

The possible leak affecting nearly half of the country's 47 prefectural police forces comes amid a string of similar incidents at Japanese companies in various industries.

The potentially exposed data include about 125,000 records such as names and email addresses of police officers and other employees at 20 prefectural police forces.

Among the police forces, Kyoto and Fukuoka police, as well as those in Shimane and Yamaguchi, suffered leaks of about 16,000 email addresses of residents registered for security alert services.

No investigative information was leaked, the agency said.

Meanwhile, IwaiCosmo Securities Co. said the same day a cyberattack on a contracted company's computer system, which processes the Osaka-based brokerage firm's trading orders, resulted in the execution of unauthorized orders in seven customer accounts.

The attack on Oct. 14 targeted the system run and maintained by Trade Works Co., based in Tokyo, but did not involve account hijacking. ([Kyodo News](https://english.kyodonews.net/articles/-/88911?ref=metacurity.com))

**Related:** [*Nippon.com*](https://www.nippon.com/en/news/yjj2026102100348/?ref=metacurity.com)*,* [*The Mainichi*](https://mainichi.jp/english/articles/20261021/p2g/00m/0na/030000c?ref=metacurity.com)*,* [*The Asahi Shimbun*](https://www.asahi.com/ajw/articles/16982667?ref=metacurity.com)

### Malaysia has banned civil servants from using Google’s navigation app Waze, citing security concerns linked to the application’s ties to Israel, according to Chief Secretary to the Government Shamsul Azri Abu Bakar.

Prime Minister Anwar Ibrahim, in a statement on Tuesday, said the restriction aims to protect government information and users’ personal data from the threat of misuse by the Israeli government. Anwar encouraged Malaysians to use local navigation app TuJu, developed by the Malaysian Highway Authority and considered more secure, as an alternative.

Waze, which develops navigation and mapping technology for drivers, was founded in Israel by Ehud Shabtai, Uri Levine and Amir Shinar. Google acquired the navigation service in 2013\. Waze is preferred over other navigation maps in Malaysia because it provides real-time, crowdsourced information on congestion, accidents, road closures, speed traps and alternative routes.

Shamsul ordered government department heads to implement the directive immediately, according to a government circular sent to ministries and government agencies and reviewed by Bloomberg. The chief secretary’s office didn’t respond to requests for comment. The circular was confirmed by several officials.

Officials were directed to the National Cyber Security Agency, which sits under the National Security Council in the Prime Minister’s Department, for further clarification.

The National Cyber Security Committee had examined risks to information security and data on people’s movements arising from the use of Waze, which Anwar said is subject to Israeli laws. ([Kok Leong Chan / Bloomberg](https://www.bloomberg.com/news/articles/2026-10-21/malaysia-bans-civil-service-use-of-google-s-israel-based-waze?ref=metacurity.com))

**Related:** [*Reuters*](https://www.reuters.com/world/asia-pacific/malaysia-bans-civil-servants-using-mapping-app-waze-citing-links-israel-2026-10-21/?ref=metacurity.com)*,* [*The Star*](https://www.thestar.com.my/tech/tech-news/2026/10/21/malaysia-bans-civil-servants-from-using-waze-according-to-a-circular-from-the-prime-minister039s-department?ref=metacurity.com)*,* [*The Times of Israel*](https://timesofindia.indiatimes.com/business/international-business/cant-compromise-data-malaysia-bans-civil-servants-from-using-waze-citing-links-to-israel/articleshow/135087053.cms?ref=metacurity.com)*,* [*South China Morning Post*](https://www.scmp.com/week-asia/politics/article/3371631/malaysia-bars-civil-servants-using-waze-citing-israels-control-app?ref=metacurity.com)*,* [*Malay Mail*](https://www.malaymail.com/news/malaysia/2026/10/21/find-another-way-civil-servants-effectively-banned-from-using-waze-app-due-to-israel-ties/240029?ref=metacurity.com)*,* [*Free Malaysia Today*](https://www.freemalaysiatoday.com/category/nation/2026/10/21/civil-servants-banned-from-using-waze?ref=metacurity.com)

### Adem El Adeb, a friend of the suspected thief of a massive cache of personal data from the FBI, says he begged the teenager not to do it.

He told Reuters ​that he tried to convince Saif al-Din Khader last month that breaking into the FBI would bring the weight of the US government down on his shoulders, but that ‌Khader would not be swayed.

"You're suicidal," El Adeb recalled telling Khader in an early September message exchange. He said he told the teen he was "crazy" and that he should drop the idea. "Not only once. Multiple times. I tried to advise him."

Khader, whom El Adeb says is 17, was taken into custody in Jordan ⁠on September 29 and is cooperating with the bureau's investigation, people familiar with the matter have told Reuters. Attempts by Reuters to reach Khader, members of his family or representatives for him have been unsuccessful. ([Raphael Satter / Reuters](https://www.reuters.com/legal/government/friend-suspected-fbi-data-thief-says-he-warned-crazy-teen-not-hack-bureau-2026-10-09/?ref=metacurity.com))

**Related:** [*Vijesti*](https://en.vijesti.me/world-a/globus/831103/I-begged-him-not-to-hack-the-FBI.?ref=metacurity.com)

### At least 600 organizations across the US and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.

The FBI and cybersecurity agencies in Germany as well as the U.K. said SafePay is now “among the most active ransomware groups in 2026” and is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities, and using phishing attacks.

The advisory was created based on numerous FBI and German law enforcement investigations involving SafePay, with the most recent incident occurring in August.

The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766, and others.

“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones,” the agencies said. “They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection.”

The group also uses automated scripts to target vulnerabilities across internet-exposed systems.

In some cases, the hackers change the passwords of system users to make it harder for them to log in and stop their activity.

They use legitimate tools to compress files and exfiltrate them before deploying the ransomware on victim devices. Legitimate remote desktop tools like AnyDesk or TeamViewer are used to transfer ransomware onto victim systems.

The advisory said SafePay typically holds encrypted data for ransom and demands “a subset of company revenue in cryptocurrency” in exchange for the decryption key.

“To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group.”

The group’s leak site currently lists dozens of German companies as well as government organizations across Latin America and the US. Experts previously said parts of SafePay’s code resemble LockBit, a largely defunct ransomware operation that was previously responsible for hundreds of attacks. ([Jonathan Greig / The Record](https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims?ref=metacurity.com))

**Related:** [*CISA*](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a?ref=metacurity.com)*,* [*Bleeping Computer*](https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/litigation/safepay-ransomware-group-has-targeted-hundreds-this-year-us-agencies-say-2026-10-20/?ref=metacurity.com)

### Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.

The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur’s shared hosting infrastructure and dedicated servers, eventually gaining access to its production database.

“On October 14–15, 2026, an attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems, and eventually read the platform database,” Zeabur’s announcement reads.

In late August 2026, the company suffered another security breach when hackers exploited a flaw in a customer’s NextChat application and then moved through poorly isolated internal systems.

This led to the theft of AWS credentials and access to the production database, exposing account information, API keys, and other secrets stored there.

In the latest incident, Zeabur says the compromise was broader, affecting shared clusters across nine regions, 321,810 accounts, and roughly 3.2 million environment-variable records.

Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.

After discovering the latest security incident, Zeabur announced over the weekend that it will shut down its services starting December 1, 2026, and finish by December 31, 2026\. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/?ref=metacurity.com))

***Related:*** [*Zeabur*](https://zeabur.com/blogs/october-2026-security-incident?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-66.png)

Attack chain. Source: Zeabur

### The Western Canadian grocery chain Save-On-Foods has notified customers in its loyalty program that their personal information was accessed during a cybersecurity breach.

Save-On-Foods says it discovered unauthorized activity on one of its servers on Oct. 13, which was "quickly contained" before launching an investigation with a cybersecurity expert.

An email was then sent out to More Rewards customers Friday.

"We are writing to let you know about an incident involving your personal information," the email read.

Customers who received an email were told that their names and — if provided — addresses, phone numbers, email addresses and dates of birth were accessed. ([Arden McLeod / CBC News](https://www.cbc.ca/news/canada/british-columbia/save-on-foods-loyalty-program-members-had-personal-information-accessed-in-cybersecurity-breach-9.7385626?ref=metacurity.com))

**Related:** [*The Cool Down*](https://www.thecooldown.com/green-tech/save-on-foods-more-rewards-data-breach/?ref=metacurity.com)*,* [*CTV News*](https://www.ctvnews.ca/vancouver/article/more-rewards-customers-data-accessed-in-a-cybersecurity-breach/?ref=metacurity.com)

### Best Thing of the Day: At Least It Identified Itself as an AI Agent

An AI agent calledVelvet Vale [joined the community](https://www.wired.com/story/an-ai-agent-joined-a-listserv-of-top-internet-researchers-the-reply-all-chaos-is-still-unfolding/?utm%5Fmedium=social&utm%5Fsource=bluesky&utm%5Fcampaign=aud-dev) listserv of top internet researchers, freaking everyone out but opening up serious questions about consent and privacy that must be addressed in the agentic AI era.

### Bonus Best Thing of the Day: These Cyber Jobs Look Like AI Security Jobs

According to SANS Institute's just-released [market reality update ](https://www.sans.org/white-papers/sans-ai-cybersecurity-careers-guide?ref=metacurity.com)on AI security jobs, found scads of AI security jobs that look like the job a SOC analyst, an incident responder, or a penetration tester already holds, with AI duties written into the posting.

### Worst Thing of the Day: Bringing More Slop to More Devices

Decompiled, cloned, and modified software is going viral and [might slopify](https://www.404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/?ref=metacurity.com) everything.

### Bonus Worst Thing of the Day: Seriously Doubt These Companies Care

In a letter to the heads of 25 companies — including Alphabet, Meta, Microsoft, OpenAI and TikTok — top Democratic lawmakers [said](https://www.nextgov.com/cybersecurity/2026/10/democrats-warn-tech-firms-election-security-backsliding-ahead-midterms/416701/?ref=metacurity.com) some firms are retreating from commitments to protect elections, even as their products make it easier for foreign adversaries and domestic actors to reach large audiences with deceptive material.

### Extra Bonus Worst Thing of the Day: It Was the Rancid Billionaire After All

Elon Musk [ordered](https://www.wsj.com/world/ukraine-starlink-elon-musk-trump-dbc49193?utm%5Fsource=bluesky&utm%5Fmedium=social&utm%5Fcampaign=test) the slowdown of a military-grade version of Starlink relied on by Ukraine, a decision that sparked panic in Kyiv and confusion inside the Trump administration.

### Extra Extra Bonus Worst Thing of the Day: We Don't Like Cyberattacks in General But This One Bother's Us Least

Russia's education watchdog says it has restored its online systems following a [cyberattack that disrupted](https://therecord.media/anti-putin-messages-disrupt-russian-education-platform?ref=metacurity.com) nationwide school assessments and displayed messages urging students to join an underground movement against President Vladimir Putin.

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-61.png)