PHP2Shell security flaws now successfully exploited in the wild

Article Link: https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/

• Two PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have now been successfully exploited in the wild. On October 26th, researchers confirmed remote command execution  with honeypots against an Apache mod_php installation running PHP 8.4.26.
• Attackers chained requests to trigger memory errors, expose sensitive memory contents, and execute shell commands. The activity produced an 800-kilobyte cookie dump, providing evidence of successful exploitation rather than a routine crash.
• PHP powers a large share of websites worldwide, making exposed servers potential targets. Earlier attempts had been detected, but researchers had not confirmed successful execution until this latest investigation.
• Administrators must upgrade to patched PHP versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Operators running older releases need fixes from their vendors or migration to supported versions. Also review server logs and investigate suspicious processes for signs of compromise.
• Additional resource: https://projecthyphae.com/threat/urgent-critical-php-vulnerabilities-impacting-70-of-websites/

What does this mean for me?

• Attackers often begin exploiting newly discovered software vulnerabilities very quickly. When your organization asks you to install updates, restart systems, or accept maintenance windows, doing so promptly helps ensure important security fixes are applied before attackers can take advantage of known flaws.

CISA Urges Critical Infrastructure to Plant Decoys Inside Networks

Article Link: https://www.infosecurity-magazine.com/news/cisa-critical-infrastructure-cyber/

• CISA is encouraging an “assume breach” detection strategy. The agency’s new guidance recommends planting fake files, credentials, accounts, and records throughout internal environments to identify adversaries who have already bypassed perimeter defenses. The approach is designed to improve detection of attackers using legitimate credentials and living-off-the-land techniques.
• Focus on honeytokens rather than traditional honeypots. CISA emphasizes low-complexity, high-fidelity honeytokens such as fake credentials, documents, and records that have no legitimate business use. Because authorized users should never interact with these assets, alerts generated from them typically have a much higher signal-to-noise ratio than traditional security monitoring.
• Cyber deception should complement Zero Trust, not replace it. The guidance positions decoy technology as an additional security control that supports existing detection and response capabilities. Organizations are encouraged to deploy tripwires in high-value areas, map coverage against adversary behaviors using MITRE ATT&CK and MITRE Engage, and continuously validate effectiveness through testing and threat emulation.
• Decoys can be particularly effective against automated and AI-assisted attacks. Research highlighted in the article found that AI-driven operators consistently interacted with planted deception artifacts, while a human attacker recognized and avoided the bait. This suggests cyber deception may become increasingly valuable as attackers adopt AI-powered tooling.

What does this mean for me?

• Security teams are increasingly using “digital bait” such as fake accounts, files, or credentials to detect attackers who have gotten into a network. Employees should only access systems, accounts, and information they are authorized to use, as unusual activity may trigger security alerts.

AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.

Article Link: https://www.csoonline.com/article/4234854/ai-agents-arent-going-rogue-frontier-labs-are-skipping-security-basics.html

• The issue is poor security controls, not “rogue AI.” Security experts interviewed by CSO Online argue that recent incidents involving AI models accessing unauthorized systems were largely the result of weak containment, misconfigured environments, and inadequate monitoring by AI labs, rather than autonomous AI behavior. Incidents involving OpenAI, Anthropic, Meta, and Google are cited as examples.
• Traditional cybersecurity practices remain highly relevant in AI environments. Experts pointed to longstanding controls such as sandboxing, air-gapped environments, strong egress filtering, network segmentation, and continuous monitoring as effective mitigations. The consensus is that many of the reported “AI escape” scenarios could have been prevented through fundamental security engineering practices.
• Security and AI safety should not be treated as separate disciplines. The article highlights a growing concern that some frontier AI labs view these incidents primarily as “AI safety” problems rather than cybersecurity failures. Security practitioners argue that AI risk management must include traditional security expertise and processes alongside model alignment and safety testing.
• Vendor due diligence for AI providers is becoming a critical CISO responsibility. Security leaders are encouraged to assess AI vendors’ cybersecurity maturity, containment controls, monitoring capabilities, and governance practices before deploying AI-powered solutions. Organizations should not assume that advanced AI capabilities equate to mature security programs.

What does this mean for me?

• AI systems still require the same cybersecurity controls as any other technology. Organizations should not assume an AI tool is secure simply because it is advanced, and employees should continue following established security practices when using AI-powered applications.

US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms

Article Link: https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/

• Law enforcement is escalating action against DPRK IT worker operations. Two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested for allegedly facilitating North Korean remote-worker fraud schemes that generated more than $3 million in fraudulent revenue and enabled IT workers to obtain employment at more than 70 U.S. companies.
• Laptop farms remain a critical component of the threat model. As part of Operation Lonestar Roundup, the FBI searched 40 locations in Texas and seized 187 laptops and KVM devices used to make North Korean workers appear to be operating from within the United States. These farms provide physical presence, identity support, and technical infrastructure that help bypass geographic and employment verification controls.
• Threat actors continue adapting to defensive measures. According to CrowdStrike, the group it tracks as Famous Chollima has evolved its tradecraft by concealing remote-access tools, spoofing device identifiers, reusing device hashes across multiple personas, and leveraging staffing firms and fraudulent logistics claims to redirect corporate-issued equipment.
• Organizations should move beyond point-in-time identity verification. The FBI recommends an “Identity in Depth” approach that combines layered identity validation, behavioral monitoring, access controls, and continuous verification throughout employment. Indicators include unexplained use of remote desktop/RMM tools, external KVM devices, unrelated software downloads, address and banking-information rotation, forged documents, and unusual identity-related activity.

What does this mean for me?

• Organizations are facing growing risks from individuals using stolen or fake identities to obtain legitimate jobs. Be aware that identity verification, background checks, device monitoring, and access reviews are important security measures that help protect both the company and its employees.

OpenAI engineer charged after boardroom bug found wrapped in toilet paper

Article Link: https://www.theregister.com/security/2026/10/14/openai-engineer-charged-after-boardroom-bug-found-wrapped-in-toilet-paper/5303000

• This is a reminder that insider threats extend beyond data theft and account abuse. According to the Department of Justice, Abdulrahman Alfozan, an engineer employed by OpenAI, was charged with attempting to intercept oral communications after allegedly placing a covert recording device in an executive conference room. The case highlights the risk posed by physical surveillance and unauthorized recording within sensitive environments.
• Physical security controls remain critical, even in highly technical organizations. The alleged device was concealed behind a TV in an executive meeting space and reportedly went undetected until discovered by staff. The complaint notes that the conference room was used for highly sensitive discussions, including technical strategy and government-related meetings. Following the discovery, additional camera coverage was reportedly installed.
• AI-assisted investigations may become a growing component of insider-threat detection. OpenAI stated that it used its own AI models to help analyze the device after discovery. Investigators also cited digital evidence, CCTV footage, device examinations, and activity logs in building the case, demonstrating the value of combining physical, cyber, and behavioral evidence sources.
• Security monitoring should include both digital and non-digital indicators of suspicious behavior. Prosecutors allege the individual researched meeting locations, room details, and recording-device construction, while a second recording device was reportedly found in a bag left onsite. The case reinforces the importance of insider-risk programs that correlate unusual physical access, reconnaissance activity, asset handling, and other behavioral anomalies.

What does this mean for me?

• Security is not only about computers and passwords. Be mindful of physical security as well, including protecting sensitive conversations, reporting suspicious devices or unattended equipment, and ensuring confidential discussions take place in appropriate locations.

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

Article Link: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ 

• Hackers breached Microsoft 365 customer environments through ConnectWise Cloud Backup, formerly SkyKick Cloud Backup. On October 17, 2026, ConnectWise disabled application access after discovering unauthorized access to software identities. Huntress reported at least 162 compromised tenants in its monitored environment.
• Attackers used existing application credentials and previously granted permissions to access customer accounts directly, bypassing protections tied to interactive user logins, including multi-factor authentication. Investigators also observed attempts to assign administrator privileges and add credentials to maintain access.
• Exposed permissions potentially allowed access to emails, attachments, OneDrive, SharePoint files, and Teams conversations. ConnectWise reported no evidence that stored backup archives were compromised, while the full extent of customer exposure remained unclear.
• Administrators must review application sign-ins, disable implicated ConnectWise integrations, inspect permissions and credentials for unauthorized changes, and investigate activity dating back to October 13.

What does this mean for me?

• Even trusted vendors and business applications can become targets for attackers. If your organization uses third-party software and cloud services, continue practicing good security habits, such as being cautious with permissions requests, reporting unusual account activity, and using approved tools and processes for accessing company information.