PHP2Shell Flaws Exposed, Another PHP Warning, Black October Vulnerabilities – Cybersecurity News [October 19, 2026]

Heres a roundup of the most important cybersecurity stories from the past week, from emergency PHP patches to a fraud ring that used a retailer’s support system to mint millions in gift cards. Many in the industry are calling this stretch ‘Black October’ and CNBC reports that the flood of critical bugs is tied to advanced AI models that are now finding flaws faster than ever. Several other incidents rounded out the week.

PHP2Shell: Two critical flaws put millions of websites at risk!

On October 21, the PHP team released emergency patches for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed PHP2Shell. Both can let an attacker with no account run code on a server through a single network request, and both carry a severity score of 9.2. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Help Net Security urged every PHP user to update right away.

The disclosure itself was chaotic. A proof-of-concept tool surfaced before the planned release date after the embargo broke, and Cloudflare reported that attack attempts rose from tens of thousands to millions within a day of disclosure. TechTarget also noted that Palo Alto Networks counted more than 22 million exposed instances that could be vulnerable.

Another PHP warning lands just two days later!

On October 23, PHP published an informational advisory about CVE-2026-115560, a flaw that may allow code execution in unusual session configurations. The project considers the risk unlikely and recommends turning off session upload progress until a routine fix is ready, as The Hacker News explains.

No exploitation of this newer issue has been reported so far. The attacks seen since October 21 have targeted the two earlier PHP2Shell flaws, so the priority remains installing the emergency updates first.

‘Black October’ and the AI-powered vulnerability wave!

Cybersecurity teams around the world are racing to patch PHP, and CNBC reports that these flaws were discovered using advanced AI models. Former CISA director Chris Krebs told the network that a striking share of all critical vulnerabilities ever recorded were found in the past month alone. Nearly 70% of websites are estimated to run PHP, which makes the stakes very high.

Krebs encouraged smaller companies to scan for vulnerabilities constantly, patch quickly, or take legacy systems offline entirely. The same CNBC report quoted industry voices warning that several dozen serious attacks in a two-day span would each have been the worst of an entire year on their own.

eMudhra’s weak keys could let attackers impersonate any website!

Indian certificate authority eMudhra had private keys for eight intermediate certificates that could be recovered from public certificate data, in some cases in under a second. Bleeping Computer reports that Mozilla, Google and Apple moved to block certificates tied to these keys, and Inc42 notes that Google has scheduled removal of the eMudhra root certificate from Chrome for October 27.

eMudhra says the problem is limited to those eight intermediate certificates and does not affect its root CA keys or other intermediates. Help Net Security explains why the issue is so serious: anyone holding a certificate authority’s private key can forge trusted certificates for any domain. One of the weak keys was reportedly just the number 4, a striking example of how badly the key generation went wrong.

Oracle issues an emergency Java update for a 9.1 trust flaw!

Oracle released an emergency Java security update on October 21 to fix CVE-2026-91403, a critical flaw in how Java applications validate digital certificates, scored 9.1 on CVSS 3.1. The update covers Java SE and GraalVM, and it blocks the affected intermediate certificates linked to eMudhra. Cybersecurity News reports that Oracle lists several current Java SE branches as affected, including 8u511, 11.0.33 and 21.0.13.

Given the eMudhra problem, this is a reminder that certificate trust is now a live concern across the stack. Java teams should check which versions they run and apply the update as soon as possible, especially on internet-facing services.

Node.js ships fixes for certificate hostname checks!

On October 21, Node.js published security updates addressing several vulnerabilities, including two certificate hostname-validation bypasses tracked as CVE-2026-105483 and CVE-2026-106069. Both were rated high severity. Worthview’s weekly roundup recommends upgrading to the fixed Node.js release for your branch.

Hostname validation bypasses matter because they can let a client accept a certificate meant for a different site. Developers running Node.js in production should update their runtimes and check any custom TLS code they have written.

CISA adds two actively exploited flaws to its catalog!

On Friday, October 23, CISA added two flaws to its Known Exploited Vulnerabilities catalog, citing active attacks in the wild: one in Collabora Online’s built-in CODE server and one in Arista VeloCloud Orchestrator. The Hacker News reports that the VeloCloud flaw, CVE-2026-114625, is a SQL injection bug with a CVSS score of 9.9 that could let a remote attacker reach privileged internal functions.

Federal civilian agencies were given until October 26 to apply the fixes. The VeloCloud flaw is the third critical vulnerability in the same product to be weaponized since July, which suggests attackers are repeatedly targeting this platform.

CISA publishes a ransomware advisory on SafePay!

On October 20, CISA published advisory AA26-293A, a #StopRansomware alert covering SafePay ransomware. The advisory is meant to help defenders understand the group’s tactics, techniques and procedures, along with the indicators of compromise they can use to detect intrusions. CISA’s advisories page lists it alongside other recent alerts.

The same page also shows a separate October 16 alert urging organizations to patch a critical flaw in BeyondTrust Remote Support. Security teams that run either product should review the latest guidance and confirm their systems are up to date.

Okta, BeyondTrust and Cloudflare: a tangled chain of incidents!

BeyondTrust said it notified Okta on October 2 of a potential breach after it detected an attempted compromise of its network shortly after an administrator shared a browser recording. TechCrunch reports that Okta contained the incident by October 17, citing its deputy chief information security officer.

Cloudflare separately disclosed an incident that began on October 18, and it said the attacker gained no access to its systems or data. TechCrunch also reports that BeyondTrust accused Okta of not acknowledging the breach for almost three weeks, a dispute that highlights how important fast, transparent communication is during identity-provider incidents.

The rise in cyberattacks also highlights the importance of email security, with SPF, DKIM, and DMARC helping prevent email spoofing and reduce phishing risks.

OpenCode Console breach exposes AI provider API keys!

On October 17, OpenCode disclosed a breach of its Console service, which teams use to share access to AI models through centrally managed API credentials. BleepingComputer reports that the breach affected 1.4% of Console users and involved a legacy system that was being decommissioned. Keys for OpenAI, Anthropic and Google stored in affected workspaces may have been exposed.

Some affected users reported large unexpected charges, with one citing more than $1,700 overnight, and Google reportedly suspended some projects as a result. Infosecurity Magazine advises anyone who stored provider keys in Console to revoke them, generate replacements with restricted permissions and spending limits, and review recent usage for anything unusual.

Staples gift card hack fuelled a $100 million crime ring!

Court documents unsealed in October show that a criminal group took over logged-in customer service sessions at Staples, using its internal support system to issue more than 15,000 gift cards worth over $5 million. 404 Media reports that investigators first learned of the breach in October 2023, when Staples reported the fraudulent cards to authorities.

The group redeemed about 4,630 of the Staples-linked cards, worth roughly $425,000, at retailers including Target. The wider ring is said to have acquired more than $100 million in gift cards through a range of schemes, so the Staples case is one part of a much larger operation.

An unpatched Broadcom Wi-Fi flaw lets nearby attackers take over routers!

Security researcher Quentin Kaiser disclosed a flaw in Broadcom’s Wi-Fi setup software on October 16. The Hacker News reports that an attacker within radio range can run code as root on affected routers without knowing the Wi-Fi password or completing any pairing step. No CVE has been assigned and no fix has been deployed.

Because Broadcom’s WPS code is built into devices from dozens of vendors, Kaiser estimates that millions of routers worldwide are affected. Cybernews names devices from Movistar, Cisco, TP-Link, Netgear and others, and notes that simply disabling WPS may not fully close the gap. Home users should check their router vendor’s website for firmware updates.

Police officer shared her Flock camera login with her ICE agent husband!

A former Savannah, Georgia police officer admitted that she gave her husband, an ICE agent, access to the department’s Flock license plate camera system. KTTC reports that an internal investigation found 983 searches involving 97 license plates between January and July, spanning six states, with most of the registered owners of those vehicles being Hispanic.

Amber Harpe was fired in August along with five other department employees after the investigation. Four of those employees were later arrested and charged by the Georgia Bureau of Investigation, though Harpe was not among them. The case shows how easily shared credentials can turn surveillance tools into a privacy problem.

CISA warns about threats to election and campaign officials!

On October 16, CISA published an advisory describing the techniques cyber threat actors use to target election and campaign officials. The alert appears in CISA’s advisories feed as the US heads toward its November midterm elections.

Election offices, campaigns and their technology vendors should review the advisory to check their own exposure, paying particular attention to phishing and account security. Strong multi-factor authentication and quick reporting of suspicious messages are simple steps with a big payoff.