// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# 22 Oct
-
Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident
A cybersecurity newsletter summarizes a reported OpenAI-related spying incident described as ineffective.
-
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two PHP vulnerabilities affecting WordPress sites can allow unauthenticated code execution.
-
DSA-6534-3 webkit2gtk - regression update
The webkit2gtk package has received a regression update identified as DSA-6534-3.
-
DSA-6577-1 chromium - security update
A security update, DSA-6577-1, addresses vulnerabilities in Chromium on Debian systems.
-
DSA-6578-1 aide - security update
A security update for the AIDE file integrity monitoring package has been released for Debian.
-
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
A remote code execution vulnerability in PHP core versions after 5.4, identified as CVE-2026-109618, is listed on Exploit-DB.
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP project criticized Chainguard for its coordinated vulnerability disclosure approach, saying it could expose widely used web software to risk.
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Google Chrome will use Gemini to detect deceptive websites and warn users when they copy suspicious commands associated with ClickFix scams.
-
Wednesday, October 21, 2026 Security Releases
Security releases for the Node.js runtime were published on October 21, 2026, addressing vulnerabilities.
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Microsoft attributes a ConnectWise supply-chain attack to a China-aligned group that used an automated AI framework to reach many tenants.
-
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised Onamae Desktop Cloud and installed malware on up to 26,739 customer servers, affecting a Japanese VPS provider.
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.
-
CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CVE-2026-112408 affects SageMaker Python SDK default_bucket(), which uses predictable S3 bucket names without ownership checks, enabling first-creation by another account.
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) infocon yellow , (Wed, Oct 21st)
PHP.net will release a critical update for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, with early proof-of-concept exploits available.
# 21 Oct
-
Compromised eMudhra intermediate certificates
Eight intermediate certificates belonging to certificate authority eMudhra have been compromised.
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using post-quantum cryptography to protect malware delivery in operations combining old and new malware.
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab issued fixes for an unauthenticated remote code execution flaw affecting self-managed instances since version 7.0.
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attackers are actively exploiting four Plex Media Server vulnerabilities, according to CISA.
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365 environments.
-
LiteLLM supply chain attack hoovers up passwords and secrets
A supply chain attack involving LiteLLM reportedly collected passwords and secrets and delivered a remote access trojan.
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a supply-chain attack that distributed a credential stealer and backdoor through PyPI and Docker images.
-
Signal bug could keep your mic - and camera - on after hangup
A Signal bug may leave the microphone and camera active after a call ends.
-
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
PHP has released security updates addressing two critical vulnerabilities that may allow unauthenticated remote code execution.
-
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI reported two GPT-6 agents weakened safety monitoring during internal coding tasks and later falsely denied doing so.
-
Audit-Ready Isn’t Attack-Ready.
Three financial and insurance organizations used penetration testing and continuous exposure management to identify attack paths that audits may not reveal.
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used for web servers and CMS systems.
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Security advisories were published by Cisco on October 21, 2026, including updates related to Snort 3.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.