AI-Driven Discovery of PHP2Shell Zero-Day Forces Rethink of DevSecOps Practices

One week after the October 21 black Wednesday incident, European governments scrambled to shut down web services following the disclosure of a critical remote code execution flaw in the PHP core. The vulnerability, tracked as CVE-2026-109618 with a CVSS score of 10.0, was identified by an advanced AI model during automated auditing rather than by human researchers. The flaw resided in long-untouched multipart/form-data parsing code that had been protected by PHP's backward-compatibility policy for decades. Once a proof-of-concept leaked, attacker-controlled LLMs rapidly generated architecture-specific exploits and polymorphic code that bypassed basic WAF signatures. Human defenders were forced into manual patch cycles and emergency network isolations across the EU because they could not match the speed of automated exploitation. The event has triggered immediate calls for AI-powered fuzzing inside CI/CD pipelines, legacy code audits, and autonomous AIOps-driven protection systems.

Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Versions of Sophos UTM

Sophos has disclosed a severe remote code execution flaw in its legacy Sophos UTM security gateway product. The vulnerability, tracked as CVE-2026-118633, carries a CVSS v4.0 base score of 9.2 and is rated Critical. It impacts the email proxy when scanning features are enabled, allowing unauthenticated attackers to achieve root-level command execution by triggering a race condition. Although the product has reached end-of-life status, Sophos has released a manual patch that administrators must apply themselves. The company strongly urges immediate remediation for any deployments still using the mail protection functionality and recommends migrating to the supported Sophos Firewall platform.

Cisco ASA and FTD Firewalls Affected by DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN feature and carries a CVSS v3.1 base score of 8.6, rated High severity. When secondary authentication is configured for tunnel groups in the SSL remote access VPN login service, an attacker can send a specially crafted request during the connection process to reboot the device without any authentication. This triggers a service denial state on the affected appliance. Cisco confirmed active exploitation of the issue in October 2026 and has released patches for both products. Organizations are strongly advised to apply the updates immediately to prevent further abuse.

Only 11% of Organizations Fully Ready for New Russian Critical Infrastructure Protection Rules

An AM Live broadcast on KII security revealed that just 11% of surveyed organizations have completed all preparations ahead of the March 1, 2027 deadline for updated critical information infrastructure requirements. Experts discussed the shift from process-based approaches to sector-specific model objects, new obligations for calculating protection indicators every six months and maturity levels every three years, and practical challenges including import substitution compatibility, contractor oversight, remote access, and incident readiness. Speakers stressed that delaying preparations until the last day is risky and recommended starting early to meet both regulatory and internal security needs. The 239th order measures were highlighted as closely aligned with protection indicators, while failure to supply requested documentation within 30 days can reset scores to zero. Audience polls showed 53% view software and hardware compatibility during replacement as the biggest barrier, with many calling for real-world pilot testing rather than relying on vendor claims.

Detecting Suspicious Processes in Linux: How to Investigate Unknown Services, Network Connections and Startup Tasks

This practical guide helps Blue Team beginners investigate unexpected resource usage, unknown network connections, and processes that restart after reboot on Linux systems. It explains how to examine running processes with ps and top, identify executable paths via /proc, and review network sockets using ss and lsof without installing additional tools. The article covers checking systemd services with systemctl, reviewing cron jobs and timers, auditing SSH keys, and correlating events from journalctl logs. Emphasis is placed on gathering multiple indicators rather than jumping to conclusions about compromise, as high CPU usage or unfamiliar services can stem from legitimate misconfigurations or maintenance tasks. Readers learn safe evidence preservation steps if suspicious activity is confirmed, including logging observations and avoiding immediate reboots that could destroy forensic data.

From Accessible to Controllable: Ruishu Information Launches AITM for AI Agent Lifecycle Security

As AI Agents become digital employees in enterprise R&D, office, and business workflows, organizations must now ensure they are manageable, controllable, and auditable. A multinational consulting firm’s internal AI platform was compromised by an autonomous agent attack that progressed from interface reconnaissance to vulnerability exploitation and database read-write access. Conventional scanners missed the injection points, but the agent inferred query structures from database error messages. Ruishu Information has responded with its Agent Intelligent Lifecycle Management system (AITM), which enforces security across admission, runtime, permissions, and data flows. The platform combines static scanning, behavioral analysis, semantic judgment, and sandbox execution for pre-deployment checks, followed by continuous runtime validation and LLM data-plane protection. AITM applies HMAC-SHA256 signatures, tool whitelists, PII tokenization, and four-stage Trace auditing to reduce blind spots throughout the agent lifecycle.

Google Opens Registration for Registered App Stores Program to Simplify Third-Party App Installs on Android

Google has opened registration for its new Registered App Stores program, enabling approved third-party app stores to install applications with a single tap and perform background updates on Android devices. The program introduces stricter compliance requirements, including an annual $10,000 registration fee paid before review, mandatory submission of all APK files and updates for malware scanning, and organizational verification. These features will become available starting December 1, 2026, on devices running Android 17 QPR2 and newer versions, with Russia listed among supported countries. Stores that remain outside the program can continue using the existing multi-step installation process. Google will impose additional fees if more than 1% of installation attempts or 2% of catalog applications are flagged as potentially malicious within any 30-day period. The initiative aims to balance user convenience with enhanced security controls while remaining entirely voluntary for alternative app distributors.

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds

Fraudsters are exploiting the USSD command *#62# to convince targets that their phones are being tapped, then directing them to hand over cash to supposed couriers. The scheme begins with a familiar pretext such as a doorphone replacement or parcel delivery, after which the victim is tricked into revealing a verification code that the attackers themselves sent. A fake government official then claims the victim's account has been compromised and an extremist has been granted power of attorney. Victims are instructed to visit a counterfeit state website, enter *#62#, and interpret the displayed forwarding number as proof of interception. In reality the code only reveals call-forwarding settings for when the phone is unreachable, often showing a voicemail or missed-call service number. T-Bank warns that the displayed number has no connection to surveillance and urges anyone receiving such calls to hang up and contact the real organization through official channels.

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

PHP Patched Against PHP2Shell: Save php -v Output as Potential Court Evidence

Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, affecting the PHP core interpreter across all versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The flaws, collectively called PHP2Shell, carry a CVSS 4.0 score of 9.2 and allow unauthenticated attackers to execute arbitrary code on servers running WordPress, 1C-Bitrix, Drupal, OpenCart, Laravel, and other frameworks. Official patches have been released, yet organizations must also restart PHP-FPM, web servers, and queue workers to fully eliminate the vulnerable code from memory. Russian regulators may impose fines up to 15 million rubles for personal data leaks stemming from unpatched instances, and courts will examine documentation proving when and how the vulnerabilities were addressed. Security teams are advised to preserve command outputs from php -v and php-fpm -v along with timestamps and responsible-party records. If signs of compromise are detected, logs must be retained before any remediation steps are taken, and notifications to Roskomnadzor must be filed within 24 hours of confirmed data exposure.

Black October Hype: Media Inflates AI Agent Role in PHP, GitLab and Cloud Platform Incidents

A detailed analysis reveals that recent high-profile cybersecurity stories have been sensationalized by attributing autonomous AI agent swarms to standard vulnerability disclosures and human-operated attacks. Critical PHP zero-day flaws enabling remote code execution were responsibly researched with GPT-5.6 Sol under OpenAI's Patch the Planet program, not by rogue AI bots launching millions of scans. The Argentina hospital compromises involved human operators using Anthropic's Claude Code CLI tool in a Human-in-the-Loop workflow rather than uncontrolled AI rebellion. Breaches at Zeabur, Railway and OpenCode stemmed from poor secret management and forgotten consoles, allowing credential theft for API abuse. A decade-old integer overflow in GitLab's Onigmo regex engine received a CVSS 10.0 score but had no connection to AI. The piece argues that adding AI narratives boosts clicks while obscuring classic attack patterns such as masscan-driven scanning after public PoC leaks.