Compiled on October 23–24, 2026 from the sources listed at the end. Fast-moving stories can change. Items marked “reported” or “claimed” come from a single outlet or from attacker claims and are not independently confirmed.

---

Top story: PHP2Shell, day three. More attacks, a new flaw, and a patching gap

Attacks are growing, but widespread compromise isn’t confirmed. SecurityWeek reports that operators of a Mirai-style botnet have added the PHP2Shell flaws to the ways they spread. Hunt.io attributes the traffic it saw to a botnet active since at least May, and Sophos analyzed an updated build of a Mirai-derived strain, though its data did not show the PHP2Shell requests actually fetching or running that malware. Beazley Security Labs says many exploitation attempts have been reported, including by Cloudflare starting October 21, but it knows of no confirmed mass exploitation. The earliest attempt on record is October 17, four days before the fixes, according to Amazon’s threat intelligence team.

Exploits are getting more capable. Researchers say the publicly available exploits fail against PHP installations with default settings, and attackers need detailed knowledge of the target server. However, one security firm built an exploit that gets past ASLR (a memory protection) using a memory leak on x86-64 systems with PHP error display turned off, which is the recommended production setup.

A third PHP flaw is confirmed. On October 23 the PHP Security Team disclosed another remote code execution flaw, CVE-2026-115560, in the session upload progress feature. The October 21 updates do not fix it. A full advisory will come with PHP’s next regular release, and PHP published a temporary mitigation. The Canadian Centre for Cyber Security added this to its alert AL26-026 (Update 1) on October 23.

Patching is lagging. SecurityWeek, citing one security vendor’s data from about 12,000 customers, says only about 199,000 PHP instances were patched within 12 hours of disclosure, and roughly 110 million instances (71%) run PHP versions 5.4 through 8.1, which are past end of life and will not get vendor patches. As of the morning of October 23, neither CVE was in CISA’s Known Exploited Vulnerabilities catalog. The FBI, the UK’s NCSC, and CERT-EU have urged immediate patching, and network appliance vendors have confirmed that some of their products are affected.

Canada. Some Government of Canada websites that were taken offline on October 21 have been restored, while others continued to face disruptions. The government said there was no indication its systems or information had been compromised. In Quebec, the STM, SAQ, and SAAQ had interrupted online services as a precaution.

What to do today

1. Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you’re on an end-of-life version (8.1 or older), plan an upgrade to a supported branch, since no vendor patch is coming.

2. Apply the temporary mitigation for CVE-2026-115560 described in PHP’s advisory, and watch for the next PHP release.

3. Check third-party products that embed PHP (CMS platforms, e-commerce, control panels, network appliances) and ask vendors for patch status.

4. Hunt for compromise: look for web server processes spawning shells and for new or modified PHP files in web roots, going back to at least October 17.

5. Use a web application firewall as a stopgap, not a fix.

---

More security news

– Arista VeloCloud zero-day exploited. Arista warned on October 22 that attackers are exploiting a SQL injection flaw in VeloCloud Orchestrator, the SD-WAN management system. Action: follow Arista’s advisory.

– LiteLLM compromised again. SecurityWeek reports a fresh supply chain attack on the LiteLLM AI package. Action: pin versions of AI and developer packages and verify before updating.

– Node.js “Node2Shell” demonstration. Imperva researchers showed code execution on an official Node.js 24.22.0 Linux arm64 image by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js released fixes on October 21. Action: update if your apps decode untrusted Brotli data.

– Ransomware groups widen use of the Palo Alto flaw. Cybersecurity Dive reports that multiple groups are exploiting a high-severity GlobalProtect flaw. Action: confirm PAN-OS is patched.

– SafePay ransomware warning (reported). A daily digest of Cybersecurity Dive and Security Affairs reports says the FBI and CISA warned that SafePay has hit more than 600 organizations since 2024, using stolen credentials, VPN access, and double extortion. Action: enforce MFA on VPN and remote access.

– Capcom breach. SecurityWeek reports that 11 million people were impacted.

– PwC claim (unverified). The Everest ransomware group claims to have stolen about 590 GB of data tied to PwC, including HR and training records. Reports say the claim is unverified and PwC has not yet responded.

– State-linked activity. The Hacker News reports that the Russia-linked group Sandworm used a new mesh-network backdoor in a destructive wiper attack on a Ukrainian logistics company.

---

Tech and markets

– AI chips challenge Nvidia’s software lead. Amazon released TorchNeuron on October 19 and Google released the open-source TorchTPU on October 20, both designed to let PyTorch AI apps run on their own chips with little rewriting, according to TechCrunch.

– AI-spending jitters (reported). Chip and cloud shares fell on October 22 after Meta’s quarterly results revived worries about AI spending, according to financial coverage. Why it matters: AI infrastructure demand is a key driver of today’s memory and hardware prices.

– Microsoft cancels a UK AI data centre lease. The Financial Times, via FTI Consulting’s news digest, reports that Microsoft ended an agreement with Nscale after grid connection delays meant the Essex site wouldn’t be powered this year. Microsoft called it a relatively small piece of its portfolio.

– AI and jobs (reported). A news summary citing a Reuters factbox says 31 companies have announced about 102,800 AI-linked job cuts since October 2025.

– New devices. Apple’s $1,999 iPhone Duo went on sale Friday, according to Yahoo Finance.

---

Today’s checklist

– [ ] Update PHP and apply the CVE-2026-115560 mitigation

– [ ] Inventory products that embed PHP and ask vendors about patches

– [ ] Hunt web servers for suspicious processes and new files

– [ ] Verify PAN-OS, Arista, and VPN patching and MFA

– [ ] Pin and verify AI and developer package versions

– [ ] Update Node.js if you process untrusted Brotli data

DBR Soft can check your PHP exposure and patch status. Contact us for help. Contact us for more information.

---

Sources

– SecurityWeek, Mirai botnet operators join PHP2Shell attacks: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/amp/

– Canadian Centre for Cyber Security, AL26-026 (Update 1): https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619

– Beazley Security Labs advisory BSL-A1233: https://labs.beazley.security/advisories/BSL-A1233

– SOCRadar, PHP2Shell update: https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/

– watchTowr, PHP2Shell FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

– Tenable, PHP2Shell FAQ: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

– iSIDefense advisory: https://isidefense.com/blog/security-advisory-php2shell-two-critical-php-remote-code-execution-flaws

– CTV News, Canadian websites offline: https://www.ctvnews.ca/canada/article/canadian-apps-and-government-websites-go-offline-to-ward-off-online-danger/

– Global News, Ottawa taking down federal websites: https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/

– Now Toronto, Canadian websites shut down: https://nowtoronto.com/news/canadian-websites-shut-down-php-cybersecurity-threat/

– BetaKit, Canadian government shuts down some websites: https://betakit.com/canadian-government-shuts-down-some-websites-amid-global-cybersecurity-scare/

– The Hacker News (Arista, Node2Shell, Sandworm): https://thehackernews.com/

– SecurityWeek, LiteLLM compromised: https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/

– SecurityWeek, Capcom breach: https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/

– Cybersecurity Dive, ransomware targeting Palo Alto flaw: https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/

– Daily cybersecurity digest, October 23 (SafePay): https://github.com/rajshevde-01/Linkedin-Daily-Post/issues/399

– GBHackers, PwC and Everest claim: https://gbhackers.com/pwc-allegedly-hit-by-everest-ransomware/

– CybersecurityNews, PwC claim: https://cybersecuritynews.com/pwc-data-breach-claim/

– TechCrunch, Google and Amazon challenge Nvidia: https://techcrunch.com/2026/10/20/google-has-joined-amazon-in-attacking-nvidias-stronghold-with-ai-app-developers/

– Gotrade, chip shares and AI spending worries: https://www.heygotrade.com/en/news/nvidia-nvda-stock-news-october-23-2026/

– FTI Consulting News Bytes, October 23: https://fticommunications.com/fti-consulting-news-bytes-23-october-2026/

– AI News Today, October 23 (Reuters layoffs factbox): https://aiweekly.co/ai-news-today

– Yahoo Finance, Apple and Nvidia market value: https://finance.yahoo.com/markets/article/apple-is-taking-wall-streets-top-spot-back-from-nvidia–for-the-fifth-time-142810503.html