Cybersecurity Today

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach
Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders urged to watch for telltale crash sequences. PHP also disclosed a third RCE (CVE-2026-115560) with no patch yet but high exploitation requirements and a mitigation to disable session upload progress. Separately, a Brotli decoder memory corruption bug (CVE-2026-111497) affects Node.js and other software, with fixes delayed into October releases. Finally, Capcom says criminals breached Capcom ID, exposing data tied to 11.7 million accounts and resetting impacted passwords.
00:00 Headlines Overview
00:35 Government Breach Details
01:13 Global Scanning Surge
03:11 Third PHP RCE
05:00 Wildfire Or Smoke
06:08 Patch Race Warning
06:53 Brotli Node To Shell
08:47 Capcom Account Breach
10:21 Wrap Up And Outro

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches
Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline.
It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues.
Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers.
00:00 Headlines And Intro
00:33 PHP To Shell Exploitation
02:07 Patch Now Impact Scope
02:47 Linux KSMBD Bugs Exposed
04:10 AI Disclosure Process Drama
05:25 GitLab Max Severity Patch
07:30 ConnectWise Breach AI Agents
09:24 Artex Spreads In Japan
11:18 GMO Haname VPS Malware
12:24 Closing And Sign Off

PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619)
In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks.
He explains the shared root cause involving corrupted memory after abnormal request termination, outlines the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), and notes no official updates for PHP 8.1 and older beyond limited source backports. Mitigations and Cloudflare WAF rules are described as partial, with patching urged by the UK NCSC.
The episode details AI-assisted discovery and coordination via OpenAI's Patch the Planet and tools from Wiz, how leaks on Hacker News accelerated disclosure, and reports of early in-the-wild exploitation attempts, outages, and expectations of rapid exploit development, web shells, and a long tail of downstream patching challenges.
00:00 PHP2Shell Emergency Alert
01:32 What The CVEs Do
02:05 Patches And Mitigations
03:40 AI Discovery And Leak
05:32 Exploit Chatter Spreads
06:46 Early Impact And Outages
08:22 Exposure By The Numbers
09:53 What Happens Next
11:50 Wrap Up And Thanks

Staples Gift Card Hack, Nikkei's Third Breach, Burger King Japan Leak, Broadcom Wi‑Fi "Foreverday," and Ledger Spy Implants
Host David Shipley covers a Chinese crime ring that breached Staples by abusing heap dump requests to hijack customer service sessions, issuing over 15,000 gift cards worth more than $5 million and redeeming thousands at retailers before merchandise was shipped to China; three Chinese nationals were sentenced and DOJ says the wider ring obtained over $100 million in gift cards.
The episode also details Nikkei's third breach in a month, where stolen credentials exposed 1.83 million cloud records, plus prior incidents involving compromised Google Workspace and Microsoft 365 accounts.
Burger King Japan reports attackers accessed its app server and stole 11 million customer records.
The show highlights an unpatched Broadcom WPS flaw enabling nearby root code execution on vulnerable routers, and Ledger-confirmed hardware wallet implants from a reseller designed to steal seed phrases over LTE.
00:00 Today's Cyber Rundown
00:30 Staples Gift Card Heist
02:20 Nikkei Breach Trio
03:42 Burger King Japan Leak
05:23 Broadcom WiFi Foreverday
07:27 Ledger Wallet Spy Implant
09:16 Wrap Up And Sign Off

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency
Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins.
A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts.
Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764).
Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts.
00:00 Top Stories Preview
00:34 ConnectWise Backup Breach
02:54 Bankruptcy Courts Outage
04:37 Phishing Markets Takedown
06:28 Romulus Malware Platform
08:54 BeyondTrust Zero Day
11:28 Japan Cyber Emergency
13:06 Wrap Up and Sign Off