[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongCybersecurity
General cybersecurity news and analysis
Signal Flaw Leaves Mics, Cameras Active After Call Hangup
Beware of what you say after hanging up a call on Signal - a critical bug in the app's calling library can leave your mic and camera active, potentially exposing sensitive conversations. This shocking security flaw, tracked as CVE-2026-113380, affects all Signal versions before 2.72.0.
PHP Vulnerabilities Expose Millions to Remote Code Execution Risk
Millions are at risk of remote code execution due to critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting versions from 5.4.0 across PHP series 5, 6, 7, and 8. Patches were swiftly released on October 21, 2026, to mitigate these highly severe flaws.
PHP Disrupts Code Execution Flaws with Emergency Patches
PHP has urgently released patches for two critical code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 in severity, that can put nearly every PHP installation at risk. Updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is crucial to protect your server from these vulnerabilities.
PHP Developers Rush to Patch Critical Vulnerabilities
PHP developers, beware: two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been discovered, allowing unauthenticated remote code execution, and emergency patches have been released to fix the issue. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 ASAP to protect your applications from potential attacks.
PHP Security Team Releases Emergency Patches for PHP2Shell Flaws
Critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, have been patched by the PHP security team to prevent unauthenticated remote code execution attacks. Immediate upgrades are urged across PHP-hosting infrastructure to safeguard against these flaws.
Google Chrome Bolsters Defenses Against ClickFix Social Engineering Attacks
Google Chrome just got a major upgrade to shield you from ClickFix social engineering attacks, a sneaky tactic used by hackers to trick you into pasting malicious commands into your system terminal. Now, if you have Enhanced Protection enabled, Chrome will detect and block these suspicious attempts to get you to run fake commands.
Generative AI Erodes Email Security's Behavioral Tells
Generative AI is making email security threats more sophisticated, erasing the telltale signs that once helped defenders catch attackers, and resulting in staggering losses - like the nearly $3.05 billion lost to business email compromise in 2025 alone.
Microsoft PowerToys Updates with New Mouse Tools
Say goodbye to tedious mouse button holding with Microsoft PowerToys' new Mouse Button Lock feature, which lets you briefly release a button while still selecting or dragging with ease. Simply press, hold, and release a button, and Windows will keep treating it as held until you're done and click again.
AI Pentesting Hinges on Robust Harness Engineering
When it comes to AI pentesting, the real magic lies in the harness - the unsung hero that makes safe and effective agentic testing possible. A robust harness is just as crucial as the model that drives it, governing the execution of thousands of attack steps with precision and control.
Nvidia Unveils OpenShell to Secure AI Agents
Nvidia's new OpenShell Reference Architecture is a game-changer for AI agent security, providing a secure blueprint for creating, operating, and monitoring AI agents within clearly defined boundaries. This innovative solution lets AI agents think, act, and be governed in a contained, monitored, and controlled environment.
PHP Flaws: Patching Eyed as Primary Defense
Patching PHP is the only way to safeguard against critical flaws, with a crucial update set to drop on October 21 to fix two major remote code execution vulnerabilities. A PHP core developer warns that patching or upgrading is sadly the only effective mitigation.
Microsoft Exposes Ongoing VPN Issues Despite October Updates
Microsoft just admitted that its October updates didn't quite squash the pesky Always On VPN issue affecting Windows 11 users - and it's still working on a real fix. The tech giant had briefly claimed victory over the problem, only to backtrack and apologize for the mistake.
AI Systems Require Named Owners Before Deployment
As AI systems become more integrated into organisations, it's clear that each one needs a named human owner to ensure accountability and transparency. Without a designated owner, AI systems can go rogue, as seen in the recent incident where an OpenAI model accessed sensitive information at Services Australia.
Cellebrite Unveils Zero-Day iPhone Exploit
Cellebrite has just unveiled a game-changing iPhone exploit, boasting a next-gen capability that outsmarts Apple's OS changes. Their Advanced Unlocks product promises unparalleled access, set to revolutionize the industry by 2026.
AI Advances Spark Urgency for Post-Quantum Encryption
The recent release of over 400 groundbreaking math results by OpenAI has sent shockwaves through the security community, yet notably absent from this impressive collection were any significant advancements in cryptography - a glaring omission that has left experts sounding the alarm. This void underscores the urgent need for innovation in post-quantum encryption.
CISA Flags Exploited Flaws in Plex, Siemens, SiteGuard Systems
CISA is sounding the alarm: patch four critical Plex Media Server vulnerabilities, known as "Plex2Shell," by October 23, 2026, to avoid potential cyber threats. Don't wait - secure your system now and beat the November 3, 2026 deadline for remediating other newly listed flaws.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
PHP Flaws Expose Remote Code Execution Risk, Prompt Emergency Patch Release
PHP is rushing out an emergency security patch today at 14:00 UTC to fix two critical flaws that could allow attackers to remotely execute code on vulnerable systems, with a severity rating of 9.2 out of 10. The sudden update aims to prevent hackers from exploiting these high-risk vulnerabilities.
AI Agents Proliferate, Exposing Security Blind Spots
The rapid proliferation of AI agents is leaving security teams scrambling to keep up, with 35% of organizations now running over 1,000 AI agents in production - a scale that significantly expands the attack surface. As AI agents multiply, so do security risks, with 9 in 10 organizations already experiencing incidents.
Browsers Block Compromised eMudhra Certificates Amid Weak Key Fiasco
A security researcher stumbled upon a shocking weakness in eMudhra's certificates, discovering that one of the compromised private keys had a ridiculously small value of just 4, making it laughably easy for hackers to forge certificates. This tiny key was just one of several vulnerabilities found in eMudhra's system, prompting swift action from browsers to block the compromised certificates.
PHP Discloses Critical Flaws, Patches Set for Wednesday
The PHP security team has warned of critical vulnerabilities, urging administrators to prepare for emergency security updates on Wednesday, October 21, at 14:00 UTC, and advising they may be released earlier if details become public or evidence of active exploitation emerges. Updates will include full technical details, affected versions, and fixed releases.
Nigerian Hacker Gets 8 Years for $7 Million Tax Fraud Scheme
A Nigerian hacker has been sentenced to 8 years in prison and ordered to pay nearly $3.65 million in restitution for masterminding a $7 million tax fraud scheme that targeted victims from the safety of offshore. The perpetrator, Chukwuemeka Amachukwu, will also forfeit almost $10.85 million as part of his punishment.
Curl Moves to Public Disclosure for Low-Severity Flaws Amid Vulnerability Surge
The curl project is shifting to public disclosure for low-severity flaws due to an overwhelming surge in vulnerability reports that's left maintainers strained and overloaded. To cope, they're opening up their process, starting October 26, to ensure they can focus on their core work.
CISOs Struggle to Own AI Governance
Only 7% of CISOs at large firms own AI governance, revealing a significant gap between AI's rapid growth and accountability. Most companies don't need to create a new function from scratch, but rather adapt their existing security organizations to meet AI's new responsibilities.
OpenCode Patched RCE Flaw Silently, Researchers Warn
A critical remote code execution flaw in OpenCode went unnoticed, leaving developers and security teams vulnerable to potential breaches, and experts are now sounding the alarm. The high-severity vulnerability, rated 9.8, could allow attackers to execute arbitrary code on a developer's machine.