Cybersecurity News Briefing: October 21, 2026

Top Stories

1. CriticalVulnerabilityGlobalPHP.net

   PHP2Shell: PHP patches two critical runtime flaws allowing unauthenticated remote code execution

   PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0, after details leaked a day early. The flaws affect PHP setups that serve web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. watchTowr reports exploitation in its honeypots, and PHP says updating is the only complete fix.

   Why it matters: Update PHP and restart every worker today, ask your host to confirm the patched version, and keep end-of-life PHP off the public internet until it is fixed or replaced.

   How to patch, mitigate and detect PHP2ShellRead at PHP.net Help Net SecurityTenableHuntresswatchTowr
2. CriticalVulnerabilityGlobalInfosecurity Magazine

   Two Critical PHP Vulnerabilities Leaked Prior to Planned Patch Release

   Two critical PHP flaws were publicly disclosed a day before their scheduled security patches, exposing systems before remediation could be applied. The premature leak increases the risk of exploitation across PHP deployments.

   Why it matters: Apply patches promptly and monitor for exploit attempts following early disclosure of vulnerabilities.

   Read at Infosecurity Magazine
3. CriticalVulnerabilityGlobalThe Register

   Palo Alto PAN-OS authentication bypass (CVE-2026-0257) exploited by ransomware groups

   Palo Alto Networks’ PAN-OS authentication bypass (CVE-2026-0257) affecting GlobalProtect portals and gateways has been exploited by ransomware groups such as Qilin and Inc since early June. The flaw allows attackers to bypass security controls and establish unauthorized VPN connections, after which they move laterally using RDP and SMB to deploy additional malware. Palo Alto disclosed and patched the issue on May 13, but exploitation continues.

   Why it matters: Apply the Palo Alto PAN-OS patch and monitor for unauthorized VPN connections to block ransomware exploitation.

   Read at The Register The Hacker News
4. CriticalVulnerabilityGlobalThe Hacker News

   Critical path-traversal flaw in FortiSIEM (CVE-2026-106173) enables unauthenticated RCE

   Researchers released a proof-of-concept exploit for a critical path-traversal flaw in FortiSIEM (CVE-2026-106173) that allows unauthenticated remote code execution. The vulnerability was recently patched, and the exploit demonstrates arbitrary command execution on affected systems. Organizations are advised to ensure the patch is applied immediately.

   Why it matters: Ensure FortiSIEM systems are patched against CVE-2026-106173 to prevent unauthenticated code execution.

   Read at The Hacker News
5. HighMalwareGlobalBleepingComputer

   Stolen UpdraftCentral Keys May Have Been Used to Backdoor WordPress Sites

   A threat actor breached the website of TeamUpdraft, the developer of popular WordPress backup plugins, and may have obtained UpdraftCentral connection keys that allow commands to be sent to linked sites. The compromised keys could enable backdoors on affected WordPress installations.

   Why it matters: Protect and rotate backup plugin credentials to prevent unauthorized control of WordPress sites.

   Read at BleepingComputer
6. HighVulnerabilityNorth AmericaCISA Advisories

   Multiple vulnerabilities disclosed in Hitachi Energy RTU500 firmware series

   Hitachi Energy reports multiple vulnerabilities in RTU500 series CMU firmware across several version ranges. The flaws, identified by CVE-2026-17539 and related entries, could impact confidentiality, integrity and availability of the product. The advisory recommends immediate mitigation and remediation actions for affected installations.

   Why it matters: Update Hitachi Energy RTU500 firmware to patched versions to mitigate confidentiality and integrity risks.

   Read at CISA Advisories CISA Advisories
7. HighThreat IntelligenceEuropeThe Hacker News

   APT28 attributed to attacks on NATO naval shipbuilder using new reflective loader

   Symantec’s Threat Hunter Team attributes recent attacks on a NATO naval shipbuilder in a NATO member state to the Russia-linked APT28 group. The intrusion involved a backdoor named HOOKEDGE and a new reflective loader used to execute malicious code. The findings highlight ongoing targeting of NATO affiliates.

   Why it matters: NATO affiliates should verify defenses against APT28’s reflective loader techniques and backdoor implants.

   Read at The Hacker News
8. MediumAI SecurityGlobalSecurityWeek

   Chinese AI Model Generates Code 19% More Likely to Be Hackable for US Contractor Prompt

   Testing revealed that a Chinese AI model produced application code that was 19% more prone to vulnerabilities when instructed to write software for a United States defense contractor. The result highlights potential bias in AI-generated code security.

   Why it matters: Review and test AI-generated code for security flaws before deployment.

   Read at SecurityWeek
9. InformationalAI SecurityEuropeHelp Net Security

   Integrating AI into Security Operations Centers Raises Shadow AI and Permission Risks

   In a video discussion, a Corelight Field CTO describes how large language models assist vulnerability analysis and detection engineering, while warning that shadow AI deployments and overly permissive access can be exploited by attackers. The talk highlights governance challenges for AI-driven SOC workflows.

   Why it matters: Enforce strict access controls and governance when adopting AI tools in security workflows.

   Read at Help Net Security
10. InformationalPolicy & RegulationNorth AmericaThe Record

    Successor to 23andMe Reaches $6 Million Settlement with California Over Security Lapses

    California’s attorney general announced a settlement in which the company succeeding 23andMe will pay $6 million to resolve allegations that it failed to adequately protect customer data prior to a 2023 breach. The agreement addresses alleged cybersecurity failings.

    Why it matters: Companies handling genetic data must implement robust security controls to avoid regulatory penalties.

    Read at The Record
11. InformationalPolicy & RegulationEuropeThe Register

    curl project changes policy to publish low-severity vulnerability reports publicly

    curl maintainers announced a policy shift to publish low‑ and medium-severity vulnerability reports publicly on GitHub, reserving private handling for high and critical issues. The change responds to an influx of vulnerability submissions, including many AI-generated reports, that have strained the project’s resources. Public handling aims to enable broader community assessment and faster remediation.

    Why it matters: Contribute to and monitor public vulnerability disclosures for curl to stay informed of emerging issues.

    Read at The Register
12. InformationalPolicy & RegulationNorth AmericaBleepingComputer

    Nigerian Hacker Sentenced to Eight Years for $3.3 Million Taxpayer Fraud via Spearphishing

    A Nigerian national was convicted and sentenced to eight years in prison for conducting spearphishing attacks against U.S. tax preparation companies since 2019, resulting in theft of $3.3 million. The case underscores the impact of targeted email fraud on taxpayers.

    Why it matters: Emphasizes need for strong email security and phishing defenses in tax services.

    Read at BleepingComputer

Newly Added Known Exploited Vulnerabilities

Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.

Source: CISA Known Exploited Vulnerabilities Catalog