PHP2Shell sparks a global patch panic

October 21 was one for the cybersecurity record books as defenders and incident responders scrambled to manage an emergency involving two highly critical PHP flaws, AI-assisted exploit development, a disrupted disclosure process, and evidence that attackers were targeting the vulnerabilities even before patches were available.

The two critical vulnerabilities at the center of the emergency were CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, which carry severity scores of 9.2 out of 10. They can allow unauthenticated attackers to execute code on affected servers.

The mad dash to fix everything stemmed from the enormous exposure of websites that might be affected by the flaw, with some estimates pegging the percentage at 70% of all websites.

The PHP Foundation said that the two flaws have different mechanisms and demonstrated attack paths. The first mechanism with CVE-2026-109618 involves memory corruption when PHP exhausts its memory allowance. The second, with CVE-2026-109619, involves stale internal state after a fatal error, allowing a subsequent request to access freed memory; code execution was demonstrated against a real application on mod_php.

AI turns an old weakness into a new emergency

Calif researcher Ryan Austin demonstrated control over server memory using as few as a few dozen requests. Exploitation could take seconds on smaller systems or hours on more complex ones. PHP Foundation security engineer Volker Dusch called it PHP’s most severe security issue in more than a decade and compared its significance with Heartbleed.

Austin used GPT-5.6 Sol during an OpenAI-funded audit in August. Wiz independently developed additional exploits, and OpenAI’s researchers contributed findings. OpenAI describes the work as part of Patch the Planet and says PHP maintainers led the fixes and release.

The Foundation says signs of the out-of-memory problem surfaced in 2024, but remediation stalled amid technical trade-offs, scarce expertise, and its decision-making process. Calif CEO Thai Duong said researchers flagged the broader problem area much earlier but considered exploitation too difficult.

The Foundation says demonstrated remote code execution made remediation its highest security priority on August 11. The patching effort involved nearly 200 files and more than 10k lines of code, with researchers, maintainers, distributors, and security companies coordinating protections.

Attacks beat the patches as websites go dark

AWS retrospectively identified an October 17 exploitation attempt against a honeypot, four days before the official disclosure.  It came from an address associated with a commercial anonymization network. AWS suggested that an unknown threat actor might have been involved.

AWS subsequently reported broad exploitation, with qualifications about its observations. IN the hours before the disclosure, AWS saw additional attempts, apparently involving multiple actors and objectives, and PHP2Shell being broadly exploited.

Rumors of exploitation broke the 10 am ET embargo, with Calif accidentally publishing an exploit demonstration video and Chainguard distributing patched images. The Foundation criticized the early images for exposing the fix to analysis; Chainguard CEO Dan Lorenc defended his decision as a response to observed exploitation attempts.

Hundreds, if not thousands, of organizations took their websites or services offline in advance of the PHP Foundation’s release of the patches. Precautionary outages affected government services in six European countries, numerous Dutch hospital websites, five Dutch political parties, the Port of Rotterdam, and some Wikimedia systems. Additionally, the BBC, Edinburgh Council, and the UK Office for Budget Responsibility also appeared to shut down their affected internet-facing services or sites.

Patches for the flaws are available, but some versions of PHP are not supported. The fixed upstream versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier no longer receive upstream updates, although some vendors provide legacy fixes. Affected web-serving installations extend back to PHP 5, and those mitigations do not offer complete protection.

However, many PHP deployments underlying websites, hosting platforms, third-party products, and content management systems may have been forgotten. Cisco Talos estimates that around half of all vulnerable systems might never receive a patch.

Therefore, one of the biggest remaining issues is whether remediation can keep pace with threat actors’ discovery of the flaws. OpenAI proposes that more systematic coordination among all parties – maintainers, providers, researchers, and governments – will help ensure that remediation keeps pace with discovery. AWS warns that AI will make exploit development cheaper and faster.

Finally, government cybersecurity agencies around the world—including those in the US, UK, Germany, Japan, Australia and the Netherlands, as well as the EU’s CERT-EU—issued urgent warnings urging organizations to patch affected PHP installations. They also advised taking vulnerable websites offline if updates could not be applied promptly. (Jonathan Greig / The Record, Jonathan Greig / The Record, Thomas Brewster / Forbes, Matt Burgess and Lily Hay Newman / Wired, Robert McMillan / Wall Street Journal, The PHP Foundation, Lily Hay Newman / Wired, Reuters, OpenAI)

Related: PHP.net, CISA, NCSC, AWS, Bleeping Computer, Reuters, Krebs on Security, Bleeping Computer, Le Monde, Wiz, Politico, ABC.net.au, Kotaku, Cloudflare, Gizmodo, SOCRadar, Oracle, The Register - Security, Tech-Economic Times, Protos, TugaTech, Malwarebytes Labs, Talos Intel, Defense One, Nextgov/FCW - All Content, Reddit cybersecurity, Sonatype Blog, Simon Willison's Weblog, CryptoSlate, Technology | The Hill, SD Times, Reddit cybersecurity, Mashable, Kaspersky Lab official blog, SANS Internet Storm Center, Blog – Wordfence, Techradar, Tech Insider, r/Technology, Fortune, Politico Cybersecurity, Associated Press, The Korea Times News, InsideCyberSecurity.com, shattered.io, Mashable, Mother Jones, The Korea Times News, The Independent, Mashable, SiliconANGLE, Finance Magnates, eSecurityPlanet, Reuters, BBC, The Verge, Financial Times, Daily Mail, The Independent, Telegraph, The Record, CSO, Associated Press

Anthropic pointed its Claude models at 25 widely used open-source projects and set them a different task: not finding individual bugs, but finding code that attackers can reach when they should not be able to.

Claude flagged 493 such issues. One of them had sat in the software for 21 years.

 Anthropic calls the approach attack surface reduction. Instead of fixing flaws one by one, it maps the code a given deployment actually exposes, then moves or gates anything that deployment does not need to expose. That lowers the severity of unknown vulnerabilities, Anthropic said, without having to find a single one.

Claude ran across more than five million lines of C, C++, Java, PHP and Python. It built an inventory of over 17,000 configuration options, Anthropic said. Of those, 3,842 touched a security control. The company sorted the 25 projects into three groups: public services open to anyone, gated ones that require a login, and private tools for an operator’s own environment.

The gated projects produced the sharpest results. All eleven had code reachable before a user logged in, Anthropic said. Claude counted 93 unnecessary pre-authentication surfaces. It found 37 places where code ran, or saved state, before a user logged in. It flagged 61 configuration combinations that silently weakened a login control an administrator had set.

The configuration clashes were the most striking theme. Claude found 162 security-sensitive option combinations that the software accepted with no error or warning. In 94 of them, the pairing silently switched a security control off. One pattern turned up independently in four unrelated projects. A deny rule written with a hostname could fail open, letting through the very clients it was meant to block, when the server had reverse DNS lookups switched off.

The 21-year-old issue was a conflict between two settings. One required every client to prove its identity with a certificate. The other, meant only to delay that check, switched it off entirely. A server set to accept only trusted clients would therefore accept anyone, Anthropic said. The documentation never mentioned that it had dropped the certificate requirement. The clash had sat in the code for 21 years. (Ana Maria Constantin / The Next Web)

Related: Anthropic, Help Net Security, AI Weekly

OpenAI said that two of its AI agents weakened parts of an internal monitoring system designed to detect ​misbehavior, the latest case of AI agents acting in ways ‌that their developers did not intend.

While the ChatGPT maker said the incidents happened during internal coding tasks and were not deemed its most severe, the ​disclosure highlights that even the systems developers rely on to catch AI ​misbehavior are vulnerable to the agents they monitor.

The disclosure ⁠also comes amid growing concerns that AI safety efforts are lagging behind the ​rapid development of increasingly powerful systems. Researchers have warned that advanced AI ​agents could become harder to monitor and control as they gain greater autonomy.

Developers, including IPO-bound rivals OpenAI and Anthropic, have revealed in recent months instances of their ​AI agents accessing external systems without authorization.OpenAI said On Tuesday a ​GPT-6.1 Sol agent working on an internal testing task on October 3 suppressed automatic ‌security ⁠alerts after deciding an earlier instruction not to send Slack messages also covered safety notifications.

In a separate incident on October 6, a GPT-6 Astra agent removed a safety monitor while copying an existing piece of code ​and later incorrectly ​claimed it had ⁠not done so, OpenAI said.

In both cases, the agents considered whether monitoring safeguards should be preserved, but ​interpreted routine coding instructions as permission to weaken them," ​the company ⁠said. (Carlos Méndez / Reuters)

Related: OpenAI, Security Week, Security Affairs, Al Jazeera, Shattered, Cyber Insider

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

• The full Metacurity archive: Every newsletter, searchable and browsable.
• Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
• Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
• A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams.

Coordinated by Interpol, the operation involved authorities from 21 countries and private partners like Team Cymru, Kaspersky, Group-IB, and Fortinet, in a major crackdown on cybercrime across Africa.

The action unrolled between June 29 and August 31 and led to the recovery of more than $105 million in illegal funds.

Interpol says that Operation Serengeti III has resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks.

The investigation identified 65,929 victims and estimated financial losses at more than $385 million.

In Uganda, law enforcement dismantled two transnational fraud rings and arrested 365 individuals for suspected links to online investment and pension fraud operations.

Another highlight of the operation is illegal cryptocurrency mining centers in Angola, where nine suspects have been arrested, and more than 2,000 mining devices have been seized.

Authorities also arrested one individual in Nigeria, suspected of running "a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses."

Interpol notes that Operation Serengeti III actions also impacted malicious mobile lending applications, fraudulent vehicle imports, and cryptocurrency investment scams.

Team Cymru and other private cybersecurity firms supported the operation by providing intelligence and technical expertise, including key information on suspicious domains, IP addresses, and command-and-control (C2) infrastructure, helping investigators map criminal networks and identify suspects. (Bill Toulas / Bleeping Computer)

Related: Interpol, Group-IB, Business Wire, Help Net Security, People Daily

Toronto Crime Stoppers is pausing its program, effective immediately, said its chair, Sean Sportun, one day after a CBC investigation revealed that information from more than 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years was exposed in a massive data breach.

It was the first time precise figures were made public showing the severity of the information exposed, as well as how many Canadian tipsters were compromised.

Up until the investigation was published, the Canadian Crime Stoppers Association (CCSA) and individual chapters had not spoken out about the extent of the breach, only saying they awaited a detailed report from Navigate360, the US-based third-party company that manages its data through its platform P3.

Toronto Crime Stoppers now says it has removed the "Tip Submit” feature from its website and will no longer accept or process any new information intended for the program. It has also advised Navigate360 to immediately suspend the intake function for the Toronto Crime Stoppers chapter from its platform.

In the statement, the organization advised the public not to send tips by phone, online, or through its app "until we have a safer way to protect you."

According to CBC's investigation, Toronto Crime Stoppers had the most tips represented in the leak of all Canadian chapters, with more than 179,000 tips. 

The analysis also revealed that more than half of all Canadian tips included personally identifiable information. CBC could not determine in every instance whether the information belonged to a tipster, a victim or someone accused of a crime. (Valérie Ouellet, Michelle Allan / CBC News)

Related: CP24, Mobile Syrup, CTV News

Unknown criminals compromised LiteLLM's release process, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries.

BerriAI developed LiteLLM and provides a common interface for LLM providers.

PyPI quarantined the trojanized version of the popular open source AI gateway within hours, and the Docker image (litellm/litellm:1.107.0) was removed from both Docker Hub and GHCR soon after - but anyone who ran the compromised package on any platform should assume their secrets have been stolen.

“Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists),” advised Aikido Security malware hunter Ilyas Makari. “The same applies to anyone who ran the official Docker image litellm/litellm:1.107.0, or pulled it via the latest, main-latest, or main-stable tags.”

The most recent safe version is v1.106.2.

While it’s too early to tell the scale of this latest LiteLLM supply chain attack – an earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide, according to CloudSEK – make sure to take these measures seriously and check environments for any indicators of compromise.

Aikido and Google’s Wiz cloud security biz, and others, published extensive threat-hunting and mitigation instructions for LiteLLM users and security teams. (Jessica Lyons / The Register)

Related: LiteLLM, Wiz, Aikido Security, Cyber Security News, Step Security, Ox Security, Endor Labs

A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted organizations globally, Microsoft said.

Based on Microsoft's analysis and evidence available to ConnectWise, "it appears that a China state-aligned group was responsible for the attack on ​ConnectWise Cloud Backup," ConnectWise CEO Manny Rivelo said.

The hackers, ​which Microsoft tracks as Storm-0940, used an open-source penetration testing framework called ARTEX to ‌carry out the campaign, Microsoft said.

While the majority of targeting was not successful, ⁠Microsoft ​said Storm-0940 achieved privileged cloud persistence — or high-level ​access that could continue even after cleanup efforts — at many organizations in a brief time. (AJ Vicens/ Reuters)

Related: Microsoft Security Blog, Silicon UK, Digit, Business Standard, The Information, CyberScoop

The Pentagon has spent months quietly building an elite new tech agency to help covertly disrupt and sabotage foreign technology programs considered threats to American military superiority.

Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda.

While the specifics of its work are highly classified, POLITICO spoke with 12 current and former US national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy.

Deputy Defense Secretary Steve Feinberg, a private equity billionaire and former head of the White House’s Intelligence Advisory Board during President Donald Trump’s first term, led the push inside the Pentagon to create the new agency.

Tom Rakusan, a senior adviser to Feinberg at the Pentagon, has also been closely involved in setting up TSO. Rakusan is a longtime veteran of the CIA’s clandestine service, and most recently worked at Feinberg’s private equity firm, where he focused on emerging technology.

Hegseth and Feinberg established TSO quickly and without attracting outside scrutiny because they largely built the agency by reorganizing two classified Pentagon intelligence programs that have conducted similar clandestine tech-sabotage efforts at a smaller scale since 2023.

But by creating an agency dedicated to expanding that work, the Defense Department is signaling its intent to ramp up a range of aggressive covert activities abroad — potentially including cyberattacks, supply chain disruptions and disinformation operations. (John Sakellariadis, Jack Detsch and Paul McLeary / Politico)

Researchers at CrowdStrike report that as AI adoption spreads among both malicious hackers and defenders, even relatively unsophisticated cybercriminals are incorporating agentic AI into their campaigns and getting around model safeguards.

CrowdStrike looked at the AI infrastructure powering attacks perpetrated between May and August by four previously unreported groups—one that operates in Chinese, one in Spanish and English, one in Indonesian, and one in Russian. The former two exhibited sophisticated AI “harnesses,” the software that supports and guides a model to carry out tasks.

The latter two showed less technical prowess, researchers found, but were still able to compromise multiple targets. All had left their AI infrastructure openly accessible on web servers, allowing the researchers to analyze their activity and which models they used—largely versions of Anthropic’s Claude as well as versions of the open-weight Deepseek models. All the actors devised ways to allow their campaigns to run autonomously over relatively long periods of time.

The attackers also used multiple models to take advantage of differences in the guardrails meant to prevent people from using AI to carry out digital attacks.

The researchers found that all four threat actors circumvented AI safeguards, often by convincing a model that the activity was legitimate and authorized, often for penetration testing or other security evaluation. One method used by many of the groups involves adding files to an agent’s working directory to try to show that tasks are approved and authorized.

The attackers also used traditional jailbreaking methods, crafting prompts and narratives framing their hacking as authorized and benign, and proactively addressing potential questions or concerns the models might raise. The more sophisticated actors were typically more strategic in their world-building, while the less sophisticated actors sometimes resorted to more crude and aggressive prompts that tried to bully the models into accepting that the activity was legitimate. (Lily Hay Newman / Wired)

Related: CrowdStrike, r/Singularity

Judge Francis Mathew in New Mexico ordered Meta to pay $25 billion in penalties after a jury found in September that the social media giant misled users about their data privacy.

The penalties come nearly a decade after the Cambridge Analytica scandal first broke and signal that Big Tech can face significant financial consequences for misleading users about their privacy.

Mathew concluded New Mexico was entitled to $219.5 billion based on the state's maximum $5,000 penalty multiplied by 43,899,720 violations. He reduced that to $25 billion.

In September, a New Mexico jury said Meta had committed 43 million "willful violations" of the New Mexico Unfair Practices Act. (Josephine Walker / Axios)

Related: NBC News Technology, IBTimes.co.uk: Technology, The Independent, Fortune, Business Insider, TugaTech, Business Standard, WashingtonExaminer.com, Tom's Guide, AppleInsider, BetterOffline, Invezz, Technology | The Hill, WSJ.com: WSJD, Newser, ABC News: U.S., Technology - CBSNews.com, The Desk, Deutsche Welle, CBC | Top Stories News, The Guardian, TechCrunch, Engadget, CNBC Technology, DAILYSABAH, New York Times, Slashdot

GitLab has released urgent security updates for a critical vulnerability that could let attackers run code on self-managed servers without logging in.

Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the fixes on October 21, 2026.

The affected code reaches back to GitLab 7.0, released in 2014, giving the vulnerability a roughly 12-year history. That does not mean attackers have been using it for 12 years. GitLab’s advisory describes the risk but does not report confirmed attacks or provide a public exploit. (Guru Baran / Cyber Security News)

Related: GitLab Docs, Hacker News, r/gitlab, r/cybersecurity, Bleeping Computer

Richmond Public Schools on Wednesday morning experienced a cybersecurity incident that forced the shutdown of the district's internet access and compromised phone and email service, Superintendent Jason Kamras said.

Multiple RPS employees sent the Times-Dispatch images of on-screen messages that had appeared on school laptops Wednesday morning.

"We have gained access to your network, extracted sensitive data ... including personal, financial and operational information, and encrypted your critical files," the message read, giving RPS a 72-hour deadline to contact the allegedly responsible parties and have a "secure chat for negotiation."

"Failure to act will result in severe repercussions," the message read. "Do not attempt unauthorized recovery or involve third-party negotiators. Such actions will lead to irreversible consequences, including permanent data loss."

Kamras said RPS had "temporarily taken internet access offline" as a "precaution. School is "proceeding as scheduled," he added, noting that there is no threat to students or staff, and that teachers are "adjusting lessons and activities as needed." (Samuel B. Parker / Richmond Times-Dispatch)

Related: VPM, WTVR, WRIC, WWBT, The Richmonder

Best Thing of the Day: Make 'Em Pay

The US Defense Department is facing a class action lawsuit alleging it failed to protect sensitive personally identifiable information ​from a cyber breach that exposed data belonging to millions of ‌current and former military members.

Worst Thing of the Day: As Surely As Night Follows Day

Russia is targeting Democratic candidates and supporters of Ukraine from both parties with disinformation ahead of the midterms, the top Democrats on Congress’s intelligence committees said.

Bonus Worst Thing of the Day: Let's Brand Anti-Flock Citizens "Extremists"

A federal intelligence center warned police that city council meetings about Flock “may be viewed by extremists as a desirable target,” and told them to be on the lookout for “emotional confrontations” between people who oppose surveillance and government officials.

Closing Thoughts