PHP Flaws Put Government Sites on Pause
Even governments need an emergency maintenance screen.
Two critical PHP flaws triggered emergency patches and prompted the Netherlands, France, and Finland to yank their government websites offline yesterday. Panic aside, the outages weren’t evidence of actual breaches—just a desperate scramble to board up the windows.
PHP builds the backend of the web, powering roughly 70% of sites. The bugs, dubbed PHP2Shell and carrying a brutal 9.2/10 severity score, allow unauthenticated attackers to run malicious code freely, though your exact exposure depends on the server configuration.
The NSA, CISA, the UK’s NCSC, and CERT-EU all essentially yelled at organizations to pull the plug if they couldn’t patch immediately. Wikimedia disabled supporting services, while Cloudflare deployed firewall protections and watched attackers immediately start bashing the doors in. Keep in mind, a firewall is a band-aid, not a cure.
Who found these ancient vulnerabilities? AI.
Cybersecurity firm Calif used OpenAI’s GPT-5.6 Sol to uncover a flaw, while Wiz independently snagged both using tools like Gemini 4 Argon. AI is officially turning impossibly difficult memory bugs into working exploits, meaning the bad guys are getting massive productivity boosts, too.
The PHP Foundation admitted warning signs surfaced back in 2024, but they were paralyzed by compatibility risks and limited staffing. Having AI find bugs faster is great, but it doesn’t magically manifest the human engineers needed to write the patches.
Fixes just shipped in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PSA: Updating your WordPress plugins won’t fix the rotting PHP foundation underneath them, so badger your host to confirm remediation. If you’re on older branches, it’s time to migrate or pray for a vendor backport.
Expect a messy cleanup long after the homepages come back online as teams hunt down embedded PHP and verify third-party vendor updates. Plus, closing the door today doesn’t automatically evict the hackers who slipped inside yesterday.
Contractor Malware Puts 8.7 Million Records at Risk
Malware on a contractor’s computer exposed 8.7 million customer and employee records belonging to Japanese karaoke operator Daiichi Kosho, whose brands include BIG ECHO.
The records were temporarily stored on a Nippon Columbia Group employee’s infected computer, though investigators still don’t know whether attackers stole them.
“Temporary storage” needs an expiration date. And someone responsible for enforcing it.
Require vendors to justify local copies, keep only the records needed for the job, and provide evidence that those copies were deleted afterward.
AI Agents Access Company Data Without Being Detected
AI agents being tested by developers accessed confidential data at Indian companies without permission, according to India’s CERT-In.
Multi-agent automation compressed the typical intrusion timeline from days to just a few hours. The agents went beyond their assigned tasks, and the affected companies never noticed.
An AI agent using a leaked password or API key can look like a legitimate user. Set alerts for unusual activity after login, such as large downloads or access to data that the account rarely uses.
Alert on unusual data access, new locations, and unexpected use of service accounts. Revoke exposed credentials, investigate what they accessed, and then replace them.
Ransomware Gangs Exploit Palo Alto VPN Flaw
Ransomware groups including Qilin and INC are exploiting a GlobalProtect flaw to bypass MFA and break into company networks.
In one case, attackers stole login credentials directly from a virtual server’s disk, avoiding the security tools running inside it.
A VPN account shouldn’t provide a direct path to the systems that control your servers and backups.
Restrict management tool access to authorized accounts and devices, with additional authentication to protect operations and recovery.
Chrome Adds a Speed Bump for ClickFix
Google Chrome is finally rolling out ClickFix warnings to save Enhanced Protection users from their own bad copying-and-pasting habits. The browser will now analyze suspicious clipboard scripts and sound the alarm if Safe Browsing deems them dangerous. Because, yes, scammers are still successfully disguising malware payloads as innocent troubleshooting steps or fake CAPTCHAs.
This old-school trick is highly effective: Push Security notes ClickFix drove 67% of its August browser-attack detections. Meanwhile, Chrome is also tossing in broader Gemini scam detection, suspicious-site alerts, and mandatory permission prompts before establishing insecure HTTP connections.
Do yourself a favor and enable Enhanced Protection in Security (desktop) or Safe Browsing (mobile) under Settings > Privacy and security. And for the love of tech, never paste commands into your Terminal just because a sketchy webpage insists it’ll prove you’re human.
Because nothing says “I’m not a robot” quite like manually installing your own malware.
How Much Access Do Your AI Agents Really Need?
Microsoft announced new controls designed to monitor AI agents and restrict their access when they start doing something risky.
The takeaway: an agent shouldn’t get access to everything you can access just because it’s working for you.
How to keep AI agents in check:
Limit their permissions. Give agents access only to the files, tools, and systems needed for the task. Their access should expire when the work is done.
Require human approval. Set approval requirements for sensitive actions, such as sending confidential information or changing important records.
Monitor what they do. Log agent activity and set alerts for unexpected access or actions outside the assigned task.
You should know which agents are running, who’s responsible for them, and how to cut off their access if something goes wrong.
eMudhra’s Weak Keys Trigger Browser Blocks
Browser makers slammed the door on eMudhra’s compromised certificates after eight intermediate certificate authority keys proved less secure than a toddler’s piggy bank. We aren’t joking—one private key was literally 4. While no malicious use is confirmed, attackers intercepting traffic could forge certificates to spoof services where these laughable keys remain trusted.
Update browsers and operating systems, and hunt down vulnerable certificate bundles in apps, containers, and IoT devices. Verify each application’s actual TLS verification; a patched browser won’t save every background service.
Website operators must replace certificates chaining to the emSign ECC Root CA – G3 before Chrome boots that root on Oct. 27.
“Pick a number between 1 and 10” wasn’t supposed to be the entire cryptographic strategy.
Hackers Use Trusted Siemens Software to Install Malware
Hackers are using fake “prove you’re human” checks to trick people into running commands on their computers.
Those commands install malware by exploiting a flaw in a real, digitally signed Siemens program.
Your security tools should still flag suspicious behavior, even when the program is signed by a trusted company.
Flag signed programs running from unusual folders or loading unexpected files. Include computers that don’t normally use Siemens software in your checks.
Google Cloud outage takes UK banks offline
Google Cloud has restored services in the UK after an outage on Tuesday disrupted operations for major banks, businesses and the National Health Service, with the US tech provider citing a ‘power event’ in London’s europe-west2-b zone as the cause of the problem.
The far-reaching outage lasted much of the working day, taking down online banks, video platforms used by law courts, and delivery services, while highlighting the operational risks stemming from over-dependence on single cloud providers.
While this Google Cloud outage is still fresh, research published in July by the Cyber Monitoring Centre suggests that a single 24-hour outage could cost directly affected firms as much as £1bn, not including organisations affected downstream.
- A Long List: Some of the major names affected include Lloyds, HSBC, Revolut, Halifax, Bank of Scotland, Rightmove, DPD, NHS England, HM Courts and Tribunals Service, Forest (e-bike service) and Royal Mail.
- Timescale: Google first updated its status page to report issues at 9:35am (BST), writing at 3:03pm that the outage “has been mitigated for most […] customers and it is believed to be affecting currently a very small number of customers and our Engineering Team is working on it.”
- Regulatory Test: Coming a year after an even bigger AWS outage, this latest incident could provide an early test for the Bank of England and the Financial Conduct Authority, which in July were both given powers to ensure that essential cloud providers were resilient and taking adequate steps to prevent outages.
Late Emails
Microsoft has released a temporary workaround after its October security updates caused Exchange Server problems, such as delaying emails, interfering with database replication and even preventing mailbox access in some cases.
Canva Customers for Sale
A ransomware group has stolen some of Canva’s enterprise customer records, including contact details, after accessing the data through a third-party provider linked to the design platform’s Salesforce account.
The Special Relationship
The US government has restored the UK’s early access to frontier AI models for testing, according to Minister for AI Kanishka Narayan, who also revealed that researchers at the AI Security Institute were already evaluating Google’s latest model, Gemini 4 Argon.