this week in security — october 25 2026 edition

THIS WEEK, TL;DR

Global websites pulled down as PHP bugs threaten to set the internet on fire
The PHP Foundation: Well… you know it's going to be a rough one when PHP makes mainstream news and the family group chats. Where do we start? On Wednesday, the internet almost burned down thanks to two bugs, dubbed PHP2Shell, which allows unauthenticated remote code execution (such as planting malware) on around 70% of the world's internet-facing servers. Not great! Researchers at Calif found the bugs, then OpenAI and Wiz validated them, and alerted The PHP Foundation, which began coordinated disclosure to get patches to many of the web's biggest players ahead of Wednesday… when the embargo lifted and the rest of the world found out. Governments shut down websites, as did big corps to block attacks. Amazon said there was some detected exploitation a week before disclosure and Cloudflare says exploitation attempts are now spiking that patches are out. Thankfully, there was no initial wave of mass exploitation in part because the bugs are a pain to actually exploit — but Palo Alto Networks and Trail of Bits said Friday they have or have seen working exploits, so it's a matter of time before big hacks happen against unpatched systems. The reality is that PHP is just one of the many, many legacy technologies on the web today from yesteryear waiting to blow up now that AI is undoubtedly making vulnerability research and discovery easier. Never a better time for big tech to fund open-source projects, eh!
More: CISA | Censys | Ars Technica | HelpNetSecurity | The Verge | Krebs on Security | Heise | DataBreachToday | tl;dr sec | Wall Street Journal ($) | Wired ($) | 404 Media ($) | @raphae.li | @euroinfosec | @lookitup.baby | @mayahustle | @klrgrz | @Tarah | @MalwareTechBlog

eMudhra shuts down certificate issuing unit after hack exposes weak private keys
Ars Technica: More majorly bad cyber news after eMudhra, an Indian-based intermediate certificate authority trusted to issue HTTPS certificates, was hacked and its private keys leaked. This hack now allows hackers to impersonate pretty much any HTTPS-enabled website as if they were the rightful owners. The major browser makers almost immediately blocked eMudhra's compromised certificates, preventing attackers from launching attacks on the visible web, but that still leaves developer tools, libraries, and other software that haven't yet revoked trust in eMudhra still able to be spoofed. Worse of all, one of the private keys was simply "4" — nothing more, just "4" — meaning these certificates can be easily brute-forced. You can check your exposure on this web-based certificate trust checker. The hack prompted eMudhra to exit the HTTPS certificate-issuing business altogether… which, let's be honest, was probably for the best. 
More: eMudhra | Mozilla | Apple | Cisco Talos | The Register | Bleeping Computer | Biometric Update | Dennis Jackson | Scott Helme | mitmproxy | @filippo | @firewalldragons

Savannah police officer gave ICE husband access to Flock
WJCL 22 News: Returning to the U.S. now. Surveillance company Flock remains in hot water as local reporters in Georgia found that a Savannah police officer gave her ICE-employed husband the username and password to access her police department's Flock systems. The ICE agent husband used the system to run searches on hundreds of people, despite not having an account. The cop was fired, but this is just the latest in a loooonggg string of police officers abusing access or allowing others to use their access to search the license plates and track vehicles of people without permission — in some cases even after they had left their jobs, per the Washington Post ($). This comes in the same week that NBC News ($) found that Flock contracts were priced just under public scrutiny thresholds, allowing mayors and officials to sign Flock contacts while avoiding votes. Some cities are still canceling their Flock contracts, citing abuse, prompting local officials to forcibly unplug the cameras to prevent them from continuing to capture data. 
More: The Washington Post ($) | CyberInsider | The Drive | TechCrunch ($) | Voice of San Diego | @drewharwell

ConnectWise breach allowed Chinese hackers to spy on thousands of organizations
CSO Online: IT and remote access provider ConnectWise had its cloud backup application breached, allowing hackers to steal credentials used for connecting to thousands of organizations that rely on ConnectWise to back up their corporate data hosted on Microsoft 365. ConnectWise shut down its backup system to contain the incident but is now working on restoring it. Microsoft, which has visibility into the incident (by nature of having its customers breached), said at least 2,200 tenants were compromised at a rate of about 3,000 attempts per minute — strongly suggesting that AI was being used to rapidly target affected organizations. The tech giant also blamed a China-aligned actor for the hacks, strongly suggesting an espionage motive. 
More: ConnectWise | Huntress | Insurance Business Magazine | Dysruption Hub | The Register | Microsoft | CyberWire | Cybersecurity Dive | Reuters ($)

THE STUFF YOU MIGHT'VE MISSED

CISA ordered to secretly acquire and hack a voting machine
ProPublica: Political appointees within U.S. Homeland Security asked its CISA cyber agency to acquire and hack an election voting machine, surprising staffers given their job is cyber-defense, and especially given Trump's persistently false claims about voter fraud. CISA was reportedly "directed not to alert the voting machine company if it uncovered flaws." The request never came to fruition because CISA complained that the staffers qualified for the job had just been laid off by Musk's DOGE.

A running list of cyberattacks in Japan
JP Incident Monitor: For all of its tech prowess, Japan's cybersecurity is well-known for being… less than ideal, and has been struggling to keep up in the face of AI-based attacks. Now there's a public tracker of Japanese cybersecurity incidents to help us all keep up. Also: check out the Vulnerability Garden, a growing catalog of over 1,200 named exploits and attacks, from Stagefright to the brand new PHP2Shell. (via @shellsharks)

Railway urges all users to revoke secret keys after cyberattack
TechCrunch ($): Railway, a development platform and cloud host for vibe-coding apps, said its customers' API keys and other secrets stored in their environment variables files were compromised and decrypted in a recent breach. (Disclosure: I wrote this story!) The company is urging "all users" to revoke and rotate their credentials, and has a preliminary post-mortem on its blog detailing some of what happened.

Extortion gang takes credit for breach of TiDB customer data
Dark Reading: An extortion gang called FulcrumSec, whose modus operandi involves stealing data from clouds, claims to have hacked Pingcap, which hosts a cloud-based SQL database called TiDB. The hackers had access for a month, per Pingcap, and stole reams of customer data. @keronyo wrote a detailed blog post describing what it was like as an affected customer, and what lessons can be learned from the incident. 

Russian satellite shadowed perilously close to a U.S. satellite
Fox Business: Top-notch natsec reporter @JenGriffinFNC details how a Russian satellite recently got within about 100-feet of a Finnish-U.S. satellite that provides high resolution imagery to Ukraine. The Russian satellite orbited its Finnish-U.S. counterpart for days before it veered away. Griffin said sources confirmed that the space maneuver is "not routine." (More from Ars Technica, The New York Times ($), and TWZ on this story.) This is the latest in space security shenanigans after the U.S. revealed in September that the military launched its own space weapons into orbit. 

WordPress plugin Updraft hacked and abused to install site backdoors
TeamUpdraft: Makers of the popular WordPress backup plugin UpdraftCentral say they were hacked, allowing miscreants to access customer WordPress installations and admin panels. WordPress.org confirmed 8 customer sites were compromised on its platform, out of at least three million active known installations. More via SecurityWeek.

Brotli compression library bug, Node2Shell, affects a ton of apps and libraries
Aikido: A highly popular, Google-made compression library called Brotli, which is used in a bunch of software like Node.js and Python, has a major security bug that allows at worst remote code execution on an affected system. If you use Brotli anywhere (and you may!), fire up a fresh pot of coffee and get patching. Of course, the bug has its own dedicated website. 

More AI hacks, as the U.S. government outlines how companies should handle AI attacks
SecurityWeek: *pinches bridge of nose and sighs into infinity* OK, let's just blast through some of these… Ars Technica reports that Meta's Muse AI agent was publicly exposing users' private information when they were "sharing" conversations, according to researchers… Meanwhile, Reuters ($) reports on new research from Norforge detailing how they found internet-exposed instances of Cairn, an AI tool used for penetration testing, which hackers were using to break into over 100 companies, per @raphae.li… And, the U.S. Army's Cyber Command is developing an AI agentic platform that can autonomously seek out and "neutralize" computer threats… What could possibly go wrong? Lastly: government nerds to the rescue, as CISA, NSA, and NIST outline in this handy PDF what organizations can do to prepare for, detect, and respond to AI cybersecurity threats. 

Trump administration is weaponizing sanctions to silence its critics
~this week in security~: Imagine one day waking up and your bank account is closed, your credit card doesn't work, and your email account won't load. That's what happens when you're sanctioned and financially cut off from the United States — which also means much of the rest of the world. That's what happened to members of the International Criminal Court, who drew ire from the Trump administration for investigating alleged war crimes involving U.S. troops. Now, Trump has sanctioned an Italian web host favored by left-leaning activists and bloggers, forcing it to shut down after 25 years on the web. I wrote about how sanctions are being weaponized, and the implications that has for international tech and free speech.

OTHER NEWSY NUGGETS

EU books Booking.com on scams: Booking.com is facing the heat from EU authorities after dragging its feet for years on scammers abusing its platform to steal people's money and personal information. The European Commission says Booking.com hasn't gone far enough to protect consumers. (via The Guardian, RTE, @EUCommission)

Pegasus found in Serbian elections: Protests continue in Serbia amid ongoing government corruption (and classic, of course there are U.S. connections). Now, one of Serbia's top protest leaders had his phone hacked with Pegasus spyware, adding to the dozen-plus people who've been targeted of late. (via Cyberscoop, Citizen Lab)

Webmaster for the ShinyHunters: @briankrebs reports that the FBI now suspect that the ransomware negotiator executive arrested earlier in October may have actively helped ShinyHunters "operate a website that pressured victims into paying a ransom" — in other words, its data leak site. This comes after the ShinyHunters breached the FBI's personnel records in September, roiling the bureau. (via Krebs on Security, @raphae.li)

ICANN't believe they'll let the feds in: ICANN, the nonprofit that maintains part of the internet's core infrastructure, will allow law enforcement to access non-public registration data of website owners, known as WHOIS data, for urgent or emergency requests. (via The Register)

Crims steal Staples gift cards: Chinese cybercriminals broke into a Staples customer support tool called Nexus that allowed them to fraudulently issue at least $5 million in gift cards for other stores. 404 Media ($) identified Staples as the company of the hacks and retail thefts. Crazy good reporting here from @josephfcox.

DHS demands departments ditch DeepSeek: Homeland Security has banned Chinese AI model maker DeepSeek from federal civilian networks, citing "multiple threat vectors," including federal data ending up in the hands of the Chinese government. (via Reuters ($), Federal Register) 

Indian bank hack exposed records: India's largest bank by assets, State Bank of India, had around 4,000 thousands of customer records stolen during a recent cyberattack. Much of the customer data appeared first on the dark web (aka a Tor onion site) and an investigation is ongoing. (via Bloomberg ($), LiveMint)

Saudi offers to bail out OpenAI spy: The FBI is reportedly building an espionage case against the Saudi engineer at OpenAI accused of recently planting a listening device in a conference room. The suspicion is that he was offering the audio data to the Saudi government, though, whether he was actively recruited remains unclear. The Saudi government offered to support the accused engineer with "no strings attached" (uh-huh) and, as such, considered a flight risk and ordered to remain in custody. (via Wall Street Journal ($), Wired ($))

Qu'est ce-que Quest: Medical lab testing giant Quest was hacked and its Quanum (not a typo) system for requesting and handling diagnostic tests was compromised. Quest said patient data was accessed, but that it's still trying to work out what data and how much of it was taken. (via TechCrunch ($), Dysruption Hub)

THE HAPPY CORNER

And breeeeeeathe. You finally made it to the happy corner! Just a few more nuggets of goodness from the week, and then it's cyber-cat time!

After this week's fustercluck of a week in security, we are finally and officially cyber-aware. We did it, at last! 🥳 (Phhhrrrbbbttt!)

In other good news: The EFF has an update for Privacy Badger, the popular browser extension and content blocker (think ads, trackers, and other online snoop-tech) now works in the Safari browser on macOS. I've been a long-time user of Privacy Badger, as it's a very easy way to keep online ads and other snooptech out of the browser. (I also recommend Privacy Badger in my blog about ad-blockers!) 

And, while you're here, the EFF has an updated privacy guide geared towards teaching kids and parents the basics about what they need to know about online security and how to think about privacy. Check this out, and share it with your kids or your friends with kids.

This new interactive scam spotter from Malwarebytes is a great way to dissect how text and email scams and phishing attacks work, and what data the attackers can see about you when you interact with their attacks, such as what kind of device you have, where you're located, and more. 

From last week's caption contest, thanks to Allan for the related Snagglepuss reference and sending in: "Heavens to muderdroid, I've been pris au dépourvu." 

And bonus cyber-cats cheetah cubs! Yes, the Smithsonian has a live stream. (Squeee!) These little rascals will be out in the world hacking in no time.

Have good news to share? Get in touch! this@weekinsecurity.com.

CYBER CATS & FRIENDS

This week's cyber cat is Blue, who can be seen here relaxing on the hot exhaust vent of his human's computer, huffing those hacker fumes and dreaming of catching mice and cybercriminals. Thanks so much to Danny for sending in!

SUGGESTION BOX

Woooof. Well that was a week. Didn't this week's newsletter feel a little like this? 

Thank you so much for reading and catching up with me in this edition. Let's call time on the week and do this all over again next Sunday!

Before you go — if you liked this newsletter, please share it! I really appreciate it when you do. Also, if you have anything for next week's newsletter, get in touch. Hearing from you is one of my favorite parts of the week... second only to your cyber-cat submissions. And if you wanted to support this newsletter with a paid subscription, I would greatly appreciate it.

I hope you have a really enjoyable and chill week. We all need one!

Catch you next,
@zackwhittaker