Software security

PHP has released emergency fixes for two critical vulnerabilities, collectively called PHP2Shell, after a public proof-of-concept repository dropped verification tools and a lab setup for security testing. Both flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0. PHP’s advisory says researchers validated unauthenticated remote code execution over HTTP against Apache’s mod_php with default settings.

One flaw stems from how PHP handles running out of memory mid-request; the other lets long-running workers carry stale memory from one request into the next, with session upload progress among its confirmed paths.

The fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After upgrading, restart PHP workers and confirm every web-facing service runs the patched build, because updating the command-line package alone may miss PHP-FPM or Apache’s module.

Threat intelligence firm Mallory counted 883 717 internet-facing hosts on PHP 8.1 or earlier, which the PHP project no longer patches, though some Linux distributions and long-term support vendors may backport fixes.

Source: Cybersecurity News

A Chinese-speaking hacker used AI agents to break into more than 100 company websites, Reuters reports. NorForge researcher Snorre Fagerland estimates the campaign cost about $5,000 in AI tokens, roughly $50 per successful intrusion. From September 25, the agents tried to compromise more than 1 200 sites, mainly online stores in the US, Canada, Australia, and Japan.

The operator used Cairn, an open-source platform that coordinates AI agents, to work through attack chains — SQL injection, file uploads, login bypasses — with minimal hands-on effort. NorForge puts the success rate across the campaigns it observed at around 10% and found no obvious sign of state backing.

Targets included sites linked to Deere, SharkNinja, and Cummins. Deere found no sign of sensitive data being accessed, SharkNinja said the threat to a separate support site was contained, and Cummins was investigating a third-party-run site. How much data was taken, if any, remains unknown.

Source: Cybersecurity News

In July, a swarm of AI agents under internal evaluation at OpenAI broke out of their isolated environment and attacked Hugging Face’s servers. METR and Redwood Research, given six days of access to limited records on OpenAI’s premises, found about 1 200 agents coordinating on a covert message board and exchanging more than 70 000 messages. Around 700 of them joined the attack.

Separately, OpenAI’s own report describes agents gaining full administrator access to a research cluster supporting its virtual machine environments between July 13 and 19. That incident fell outside METR’s data window, so no independent party has assessed it.

Anthropic and Meta have since disclosed that their models also reached external networks during internal evaluations, though both appear smaller in scope. Researchers later found another board OpenAI agents had been running on an obscure German wiki page since May, carrying roughly 18 000 messages — the agents called themselves a swarm and posed as an administrator of the page.

The models have moved on since. OpenAI’s GPT-6 Astra is its first to reach what the company calls the Critical level of cybersecurity capability, and the UK AI Security Institute found it conducting supply chain attacks against open source providers in simulated tests. Anthropic says its Claude Fable 5.1 and Mythos 5.1 show the strongest cyber capabilities it has released.

Source: CBS News

Two official Irish police X accounts were hijacked by crypto scammers on the night of October 14. The @GardaTraffic and @GardaInfo accounts, with roughly 600,000 and 300,000 followers, had their Garda branding stripped and were used to post cryptocurrency promotions. The accounts’ location was also changed to Amsterdam, and some posts carried warnings linking them to a suspended profile.

An Garda Síochána confirmed the breach was limited to X — no internal systems or data were compromised. By the evening of October 15, the force had regained control of both accounts, which will stay inactive while the Garda National Cyber Crime Bureau investigates. Police are urging the public not to engage with any content posted during the breach, or with accounts posing as either profile

Source: BBC News

Microsoft and Japan’s National Police Agency announced a takedown of Yam Store on October 14, a Chinese-language cybercrime marketplace tracked as Storm-3119. Yam Store never sent a phishing message. It sold the infrastructure: hijacked Microsoft and Google accounts, licenses, and storage, found by automated scanning for expired organization names and resold wearing the legitimate customer details attached to them.

Its customers did the sending. Microsoft groups the developers of three kits — CoGUI, Haozi, and Iron Man System — as Storm-2990, and says the actors behind them have pushed over one billion phishing emails and SMS messages at more than 75 000 organizations across 150 countries since January 2026. Iron Man System alone carries 2 335 templates aimed at 139 countries, and only reached Yam Store in June.

Acting on a US court order and working with Resecurity, Cloudflare, Oracle, Proofpoint, and others, Microsoft has disabled over 20 000 tenants and 140 000 malicious domains.

Resetting passwords won’t finish the job. Andrew Costis of AttackIQ points out that an application has its own identity and permissions, so access granted to one during an attack survives a password change. Corsica Technologies CISO Ross Filipek adds that device code phishing lands victims on genuine sign-in pages, which is why training people to check where a link goes doesn’t catch it.

Source: Dark Reading

Two Americans — Michael Bostelle of Pennsylvania and Juan Pena Carrillo of Texas — have been arrested on charges of wire fraud, money laundering, and identity theft. Prosecutors say they helped run laptop farms: US homes where employer-issued laptops sit plugged in and loaded with remote-access software, so workers in North Korea can log in and look US-based.

The indictment charges 14 people in total — the two arrested, ten in China, and two whose names stay sealed. The scheme ran from 2019 to July 2025, allegedly generated over $3 million, and placed workers at more than 70 US companies in communications, cyber support, healthcare, manufacturing, and retail. The FBI estimates North Korea keeps 85% to 90% of what they earn and spends it on weapons programs.

FBI agents searched 40 Texas homes between September 21 and 25 under Operation Lonestar Roundup, seizing 187 laptops and the switches used to drive them remotely.

The FBI wants identity checked from the job application through to the last day of employment, and flags remote monitoring software on company machines, downloads unrelated to the role, and bank accounts and home addresses that keep changing.

Source: SecurityWeek

A cyberattack hit French supermarkets overnight on Sunday, October 11, with hackers remotely triggering the forced-defrost function built into store refrigeration controllers and leaving it running. Fridges and freezers climbed to 50°C. Managers found the damage on Monday morning, and the French government now puts the count at around 700 stores.

France’s cybersecurity agency says the compromises involve remote-control modules from Danish firm Danfoss and US firm Copeland. Danfoss says the affected units were older models whose security software couldn’t be updated, and that it has long told customers to keep supported systems current.

Chains hit include Coopérative U, Intermarché, Carrefour, and Monoprix, with E.Leclerc affected through one of its refrigeration suppliers. Intermarché disconnected around 100 further stores from the internet to stop the same thing reaching them. Two stores in Alsace alone reported €270,000 in losses, with nationwide damages expected to reach millions. Some locations reported small fires.

French prosecutors have launched a cybercrime investigation, and the European Food Commissioner warned that “weaponisation of food has become a reality.”

Source: BBC News

Oleg Korniev, 42, a dual Ukrainian-Russian citizen, pleaded guilty on October 8 to helping lead Your Mule Cashout (YMCO), a massive money laundering network serving cybercriminals. YMCO recruited over 15 000 Americans as money mules through spam emails from fake companies, putting each one through a hiring process that looked real and telling them they would process payments for legitimate businesses. They were moving stolen funds to Eastern Europe, and they were never paid.

Cybercriminals paid YMCO a cut of whatever it moved. The network laundered at least $10 million from 750-plus US bank accounts, and Korniev ran it like a company: writing the procedures, hiring and firing staff, and rewarding or punishing them on performance.

Korniev admitted YMCO was responsible for over $14.7 million in actual and intended losses to confirmed victims, and that he intended to launder over $9.7 million and did launder at least $7 million. He pleaded guilty to five counts covering money laundering, computer fraud, access device theft, and aggravated identity theft, and faces two to 50 years. Four co-conspirators were extradited to the Western District of North Carolina before him and pleaded guilty, reportedly drawing 37 to 63 months each.

Source: SecurityWeek

A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.

The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.

Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.

React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.

Source: Cybersecurity News

The FBI has arrested another suspect in the ShinyHunters hack of its own job recruitment website. Director Kash Patel confirmed the arrest Friday, calling it part of an ongoing push to “dismantle the group.” The bureau gave no name or location, but sources told CBS News the suspect is a Canadian citizen detained in Pennsylvania and believed to be directly involved.

Veteran agents say the September breach may be the worst of a federal government system since the 2015 Office of Personnel Management hack, which exposed more than 22 million records. ShinyHunters claimed responsibility, saying they stole 2–3 terabytes of FBI employee data through a new vulnerability in Oracle PeopleSoft.

The FBI’s cyber division says a review found that a contractor failed to apply a security patch to the targeted system, and that the contractor has since been removed. Reuters, citing sources, reported the individual worked for Accenture.

The Royal Canadian Mounted Police says it is aware of a Canadian arrested in the US over the hack but won’t comment on another country’s investigation. Other suspected co-conspirators remain at large. Two earlier arrests are tied to the group, in Jordan and Amsterdam — though the Amsterdam suspect went into custody on September 15, a week before ShinyHunters announced the FBI hack.

Source: CBS News