Compiled on October 22, 2026 from the sources listed at the end. Details on fast-moving stories can change during the day. Items marked “reported” come from a single outlet or from attacker or vendor claims.

---

Top story: PHP2Shell, two critical PHP flaws, are being attacked

What happened. PHP released emergency fixes on October 21 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. Details leaked online a day before the planned disclosure, so defenders and attackers learned about them at about the same time. The flaws let an unauthenticated visitor run code on a web server. They affect PHP installations that serve web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed), and PHP says the risk is highest with mod_php.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Exploitation. watchTowr reported seeing exploitation in the wild starting October 21, and Amazon’s threat intelligence team reported an attempt on its honeypot dating back to October 17, before public disclosure. CISA urged immediate patching and, at the time of its alert, said it had not observed exploitation. As of October 22 neither flaw was listed in CISA’s Known Exploited Vulnerabilities catalog, according to watchTowr.

Canada. The Canadian Centre for Cyber Security issued alert AL26-026 and told organizations to update immediately and, where they can’t, take affected applications offline. The federal government temporarily took some of its own websites offline as a precaution, and Quebec’s STM and SAQ sites were reported down, as was service on some websites of a Quebec school service centre. Agencies in several other countries issued similar warnings.

Why it matters to you. WordPress and many other business sites run on PHP. If your website, customer portal, or any web app uses PHP, check it today.

What to do now

1. Inventory every system running PHP: websites, WordPress hosts, intranets, and vendor-hosted apps.

2. Update to a fixed PHP version. Managed hosts and Linux distributions are shipping patched packages, so ask your host or provider for their status.

3. If you can’t patch immediately, PHP lists temporary mitigations (for example, disabling session upload progress and removing the PHP memory limit as a workaround for the second and first flaw respectively), and the Cyber Centre advises taking exposed applications offline until fixed. Treat mitigations as stopgaps.

4. Check logs for unusual requests and new or modified files, since exploitation began before fixes were available.

5. Put a web application firewall in front of critical sites if you have one, and keep it updated. Cloudflare called its emergency rules a stopgap only.

---

Security roundup

Microsoft’s record Patch Tuesday (October 13). Microsoft fixed roughly 1,400 vulnerabilities, the largest monthly total ever recorded. Counts vary by tracker, from about 1,407 to 1,415. Three are zero-days. One is actively exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web warnings. Rapid7 notes that Windows Server 2012 does not get a patch for that flaw, though Server 2012 R2 does.

Action: Deploy the October updates, starting with the Windows Shell fix. Plan to retire unsupported servers.

Palo Alto Networks PAN-OS flaw used by ransomware gangs. Unit 42 reported that the Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication bypass in GlobalProtect, to gain VPN access and then steal domain credentials from virtual server disks. CISA added the flaw to its exploited list in May.

Action: Confirm your PAN-OS and Prisma Access versions are patched.

Ivanti Connect Secure authentication bypass. CVE-2026-104935 is exploited in the wild and listed by CISA. A patch has been available since October 13.

Action: Patch, and review VPN logs.

BeyondTrust Remote Support critical flaw. CVE-2026-102764 is an unauthenticated authentication bypass in versions up to 26.2.3. Check Point reports that a China-linked group tracked as Armory Castle exploited it before public disclosure.

Action: Update self-hosted installations.

Arista VeloCloud Orchestrator zero-day. Arista warned on October 22 that attackers are exploiting a SQL injection flaw that lets a logged-in user, even one with read-only access, gain operator-level control of the SD-WAN management system.

Action: Follow Arista’s advisory if you run VeloCloud.

GitLab critical flaw. GitLab released fixes on October 21 for a critical issue that lets an attacker run code on a self-managed server without logging in (CVE-2026-97229 per Check Point’s report).

Action: Update self-managed GitLab.

Atlassian Data Center. CVE-2026-21589 is being exploited, and CISA listed it on October 15.

Action: Patch Confluence and Jira Data Center.

Siemens Software Center. Siemens confirmed that CVE-2026-110936 was used in ClickFix malware attacks. Version 4.0.9.8 fixes it.

Oracle’s October update. Oracle’s quarterly patch release fixes more than 1,200 vulnerabilities.

Software supply chain. The Hacker News reported that LiteLLM’s release pipeline was compromised again on October 21, pushing a malicious release to PyPI and Docker Hub. Pin versions and verify before updating AI and developer packages.

Rapid7 Q3 findings. Rapid7’s analysis found that high-severity flaws were exploited within three days on average, ransomware dominated incidents, and AI appeared in only about 8% of tracked incidents.

Breaches in the news (reported). CenterPoint Energy disclosed a breach affecting more than 1 million Texas residents, Burger King Japan reported about 11.18 million app members affected, and Educational Testing Service exposure of California student records was reported.

---

Hardware and pricing

Memory prices keep rising into Q4. TrendForce forecasts that conventional DRAM contract prices will rise 10% to 15% quarter over quarter in the fourth quarter, and NAND flash 15% to 20%, with AI server demand driving it. PC memory faces particularly tight supply, and TrendForce expects the share of capacity available to PC memory to shrink further in 2027. Enterprise SSDs are forecast to rise the most, according to a secondary report of the same outlook.

Action: Get quotes now for planned laptop, server, and storage purchases, and ask suppliers how long prices are held.

---

AI and cloud

– OpenAI models coming to Google Cloud. OpenAI and Google Cloud announced plans to offer OpenAI’s models and Codex through Google Cloud’s Model Garden, with general availability expected in the coming weeks. Reports say OpenAI describes Microsoft as still its primary cloud partner.

– AI-assisted vulnerability discovery is in the spotlight. The PHP flaws were found by researchers at Calif, OpenAI, and Wiz, according to BleepingComputer, and Canada’s cyber agency head warned that many more flaws will be found as AI improves, according to The Globe and Mail.

– Nvidia at GTC Berlin (reported). Nvidia unveiled a modular, containerized reference design for AI data centers intended to shorten site build times.

– Anthropic launched a “Claude Duet” research preview on October 21: a proactive agent app for Pro and Max subscribers on a waitlist in the U.S.

---

Canada

– Cyber Centre alerts: AL26-026 (PHP) was issued October 21. Alert AL26-024 on exploited Citrix NetScaler flaws was previously updated.

– Cyber Security Awareness Month is under way in October, a good hook for staff reminders and phishing tests.

---

Today’s checklist

– [ ] Find every PHP system and update to a fixed version, or take it offline

– [ ] Review web server logs for suspicious activity since October 17

– [ ] Deploy October Windows updates, especially the Windows Shell fix

– [ ] Verify patches on edge devices: Palo Alto, Ivanti, Citrix, Cisco, BeyondTrust, Arista

– [ ] Update GitLab and Atlassian Data Center if you self-host them

– [ ] Get written memory-price quotes for upcoming hardware orders

DBR Soft can check your PHP exposure and patch status today. Contact us for help.

---

Sources

– Canadian Centre for Cyber Security, Alert AL26-026, PHP vulnerabilities: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619

– CISA alert on PHP vulnerabilities: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

– Help Net Security, PHP2Shell patched: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/

– BleepingComputer, PHP emergency patches: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/

– watchTowr, PHP2Shell: https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

– SecurityWeek, PHP2Shell: https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/

– Insurance Business Canada, attacks begin as Canada’s cyber centre issues alerts: https://www.insurancebusinessmag.com/ca/news/breaking-news/attacks-begin-on-global-websites-as-canadas-cyber-centre-issues-alerts-594426.aspx

– Global News, Ottawa taking down federal websites: https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/

– The Globe and Mail, Canadian organizations urged to address vulnerability: https://www.theglobeandmail.com/business/article-canada-cybersecurity-php-programming-vulnerability-october-21/

– CSO Online, October Patch Tuesday roundup: https://www.csoonline.com/article/4234759/october-patch-tuesday-roundup-over-1400-microsoft-holes-to-be-plugged-including-three-zero-days.html

– SOCRadar, October 2026 Patch Tuesday: https://socradar.io/blog/october-2026-patch-tuesday-zero-day/

– IT Brief, Microsoft patches 1,413 flaws: https://itbrief.co.uk/story/microsoft-patches-1-413-flaws-including-exploited-zero-day

– Hackread, Qilin and INC exploit PAN-OS flaw: https://hackread.com/qilin-inc-exploit-palo-alto-vpn-flaw-ransomware-attacks

– Check Point Research, October 19 threat intelligence report: https://research.checkpoint.com/2026/19th-october-threat-intelligence-report/

– The Hacker News (Arista VeloCloud, GitLab, LiteLLM): https://thehackernews.com/

– The Hacker News, Atlassian CVE-2026-21589: https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html

– SecurityWeek, Siemens Software Center exploited: https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

– SecurityWeek (Oracle CPU, Rapid7 Q3): https://www.securityweek.com/

– TrendForce Q4 2026 memory forecast (via Guru3D): https://www.guru3d.com/story/dram-and-nand-contract-prices-forecast-to-rise-as-much-as-in-q4-2026/

– TrendForce news, October 20: https://www.trendforce.com/news/2026/10/20/news-dram-prices-seen-rising-20-qoq-in-4q26-despite-slower-gains-ai-demand-tight-supply-support-outlook/

– OpenAI News: https://openai.com/news/

– Anthropic (Claude) release notes: https://support.claude.com/en/articles/12138966-release-notes

– AI news summary, October 22 (OpenAI on Google Cloud): https://note.com/alive_shark4897/n/n56484f87df3f?hl=en