| Contact |
Praveen Sharma
|
|---|
Cybersecurity News – week of Oct 13, 2026
- Threat Hunting Report: A Framework for Cloud Investigations
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
- TP-Link Sued by Four More U.S. States Over Router Security and China Ties
- FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
- Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- AI Attacks Move at Machine Speed. Your Identity Security Needs to Match It
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
- The Alert Fatigue Trap: Why Consolidation Only Solves Half the Problem
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat of the Week
Critical Vulnerabilities in PHP Require Immediate Patching10/21/2026 12:45 PM EDT
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHPinstallations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
CISA urges organizations to take the following actions:
- Identify and inventory systems running any version of PHP across your organization.
- PHP is often a component of other software and prevalence may not be directly observable.
- Apply the patch immediately, prioritizing internet-facing systems.
- Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
- A web application firewall may provide some protection until systems are updated or patched.
- Review the official PHP security advisory for guidance on patching.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
CISA urges network defenders to review the following advisory and apply necessary updates:
️🔥 Trending CVEs
Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.
Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-86360, CVE-2026-86361, CVE-2026-86362 (Dell System Update), CVE-2026-21589 (Atlassian), CVE-2026-93355 (LiteLLM), CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, CVE-2026-106347 (Google Chrome), CVE-2026-102255 (SonicWall SMA 1000), CVE-2026-105192 (LMCache), CVE-2026-102406, CVE-2026-103008, CVE-2026-102404, CVE-2026-102413 (Elasticsearch), CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, CVE-2026-104714(Apache Struts), CVE-2026-91140 (Progress DataDirect), CVE-2025-64393, CVE-2026-58069 (Veeam Backup & Replication), CVE-2026-32740 (Next.js), CVE-2026-18397 (Thales SConnect), CVE-2026-84388 (Fortinet FortiPAM Chrome extension), CVE-2026-76464, CVE-2026-20328, CVE-2026-76454, CVEs, CVE-2026-76482, CVE-2026-76480, CVE-2026-76483, CVE-2026-76455, CVE-2026-76459, CVE-2026-76471, CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 (Cisco), CVE-2026-76281, CVE-2026-76282, CVE-2026-76284, CVE-2026-76268 (Splunk), CVE-2026-85097 (Bricksforge WordPress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265(Apache OpenOffice), and multiple vulnerabilities in WordPress.