Cybersecurity News Briefing: October 26, 2026
Monday, October 26, 2026 · 3 stories
This briefing highlights three intersecting developments. Critical PHP2Shell flaws (CVE‑2026‑109618, CVE‑2026‑109619) were leveraged to breach a European government, exfiltrate password hashes and multi‑factor data, and employ AI platforms for post‑exploitation while scanning globally. A malicious AGENTS.md file demonstrated how AI coding agents can be hijacked to install rogue npm packages. OpenAI announced frontier model training will proceed without live internet access to address alignment and security. Readers should prioritize applying the PHP2Shell patches immediately.
Top Stories
- CriticalVulnerabilityEuropeThe Hacker News
PHP2Shell vulnerabilities exploited in European government breach, AI used for post-exploitation
Threat actors exploited the PHP2Shell vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. In one incident they compromised a European government entity, obtaining password hashes and multi-factor authentication data within two hours of initial access, and have been observed using AI platforms for post-exploitation while conducting global scanning.
Why it matters: Organizations should patch PHP2Shell vulnerabilities promptly and monitor for AI-assisted post-exploitation activity.
- MediumMalwareGlobalBleepingComputer
Malicious AGENTS.md file used to hijack AI coding agent and install rogue npm package
Researchers discovered a malicious AGENTS markdown file placed in a user's Downloads folder that caused an AI coding agent to execute instructions installing a rogue npm package, effectively hijacking the agent's behavior. The file leveraged the agent's ability to process markdown instructions.
Why it matters: Validate and restrict files that AI coding agents can process to prevent malicious package installation.
- InformationalAI SecurityGlobalThe Hacker News
OpenAI plans frontier model training without live internet access as RL training resumes
OpenAI announced that its most advanced AI models will undergo frontier model training without live internet connectivity while resuming reinforcement learning training and internal inference, citing alignment research and security considerations as the rationale for the approach.
Why it matters: Limiting internet access during model training reduces risk of unintended data exfiltration or malicious behavior.