PHP2Shell Gets a Federal Patch Deadline
While you were probably hoping for a quiet week, security teams must now scramble to investigate potential PHP2Shell compromises as CISA officially orders federal civilian agencies to patch the actively exploited flaws by Thursday. While researchers recorded successful remote code execution on a juicy honeypot setup, widespread compromises remain thankfully unconfirmed.
Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35—or newer—or pray your vendor has a backported fix. Website owners must force their hosts to confirm remediation, as merely updating content management plugins isn’t enough to patch the core engine. Review logs from at least Oct. 17 to catch earlier attack attempts, and take vulnerable systems offline if you can’t patch them yesterday.
Federal deadline or not, attackers aren’t waiting for your maintenance window.
Popcorn Time’s Updater Needed an Off Switch
In a heroic display of unsolicited IT support, Eye Security pushed over 2 million updates to remotely kill Time4Popcorn’s Windows and Mac updaters between November 2025 and March 2026. It turns out the abandoned piracy fork was blindly accepting unsigned code with full system privileges, effectively leaving millions of PCs sitting ducks for any attacker who scooped up the expired update domains.
The security firm successfully choked off 98% of the rogue requests, though Android devices were left to fend for themselves. Since the zombie app still harbors other glaring vulnerabilities, do yourself a favor and uninstall the old fork and verify its desktop updater is actually dead. (The unrelated, legal Popcorn Time project isn’t affected.)
Apparently, “I just stopped clicking on it” isn’t a valid cybersecurity strategy.
Node RCE Vulnerability Puts Applications at Risk
Researchers demonstrated a Node flaw, dubbed Node2Shell, that enables remote code execution through malicious Brotli-compressed data.
Applications using Express middleware or Node’s built-in fetch() API could be vulnerable even without developers explicitly implementing decompression functionality.
One risk here is incomplete remediation, as organizations may update Node while older, vulnerable runtime versions remain active in production environments.
Inventory all Node deployments and update vulnerable runtimes, including those in containers and legacy applications.
Black October Shows AI Making Old Flaws Exploitable
The PHP2Shell flaws behind cybersecurity’s “Black October” show how AI can simplify exploitation of older vulnerabilities.
Researchers demonstrated how AI-assisted techniques can adapt exploits across different PHP versions and system configurations.
Exploitation complexity may no longer be a reliable reason to assign a vulnerability a lower priority.
Identify vulnerabilities previously deprioritized due to exploitation complexity and test whether existing security controls can prevent exploitation.
Apple Fixes 163 Security Flaws in Major iOS Update
Apple patched 163 vulnerabilities, including WebKit and kernel issues that could expose sensitive data or enable malicious code execution.
The patches also address an Apple Intelligence flaw that could expose user data to remote attackers, with no known active exploitation reported.
Monitor BYOD devices accessing corporate resources, as delayed iOS updates could leave sensitive business data exposed.
Use mobile device management tools to identify outdated devices and enforce minimum OS versions for corporate access.
Good Smile Company Shuts Store After Data Breach
Good Smile Company confirmed a store breach that may have exposed customer contact details, purchase histories, and partial payment-card information.
Full card numbers and security codes were reportedly unaffected, while the store remains temporarily closed during the investigation.
Exposed purchase histories could help attackers craft convincing phishing messages disguised as legitimate order updates or payment requests.
Verify suspicious communications directly through the retailer’s official support channels rather than clicking links in unsolicited messages.
302ai Data Leak Exposes 17.6 Million Files
Researchers discovered 17.6 million publicly accessible files belonging to AI aggregator 302ai, totaling 22.72 terabytes of data.
The exposed files included corporate documents and more than 144,000 private AI chat logs.
Access to trusted AI models doesn’t guarantee that third-party aggregators handle data securely.
Audit employee use of AI aggregators and verify how vendors store and retain sensitive business data before approving their use.
How Safe Is Your Data?
Data breaches continue to expose sensitive information, while growing AI adoption creates new data protection risks.
How to strengthen data protection:
- Discover and classify sensitive data to identify confidential information and prioritize protection based on business risk.
- Deploy DLP tools to monitor sensitive information and prevent unauthorized transfers across cloud applications, endpoints, and AI tools.
- Encrypt sensitive data and enforce least-privilege access to protect information at rest and in transit while restricting access to authorized users.
Security teams should regularly assess sensitive data exposure and track mean time to detect (MTTD) and mean time to contain (MTTC) incidents.