Cybersecurity Today

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches

Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline.

It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues.

Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers.

00:00 Headlines And Intro 00:33 PHP To Shell Exploitation 02:07 Patch Now Impact Scope 02:47 Linux KSMBD Bugs Exposed 04:10 AI Disclosure Process Drama 05:25 GitLab Max Severity Patch 07:30 ConnectWise Breach AI Agents 09:24 Artex Spreads In Japan 11:18 GMO Haname VPS Malware 12:24 Closing And Sign Off

PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619)

In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks.

He explains the shared root cause involving corrupted memory after abnormal request termination, outlines the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), and notes no official updates for PHP 8.1 and older beyond limited source backports. Mitigations and Cloudflare WAF rules are described as partial, with patching urged by the UK NCSC.

The episode details AI-assisted discovery and coordination via OpenAI's Patch the Planet and tools from Wiz, how leaks on Hacker News accelerated disclosure, and reports of early in-the-wild exploitation attempts, outages, and expectations of rapid exploit development, web shells, and a long tail of downstream patching challenges.

00:00 PHP2Shell Emergency Alert 01:32 What The CVEs Do 02:05 Patches And Mitigations 03:40 AI Discovery And Leak 05:32 Exploit Chatter Spreads 06:46 Early Impact And Outages 08:22 Exposure By The Numbers 09:53 What Happens Next 11:50 Wrap Up And Thanks

Staples Gift Card Hack, Nikkei's Third Breach, Burger King Japan Leak, Broadcom Wi‑Fi "Foreverday," and Ledger Spy Implants

Host David Shipley covers a Chinese crime ring that breached Staples by abusing heap dump requests to hijack customer service sessions, issuing over 15,000 gift cards worth more than $5 million and redeeming thousands at retailers before merchandise was shipped to China; three Chinese nationals were sentenced and DOJ says the wider ring obtained over $100 million in gift cards.

The episode also details Nikkei's third breach in a month, where stolen credentials exposed 1.83 million cloud records, plus prior incidents involving compromised Google Workspace and Microsoft 365 accounts.

Burger King Japan reports attackers accessed its app server and stole 11 million customer records.

The show highlights an unpatched Broadcom WPS flaw enabling nearby root code execution on vulnerable routers, and Ledger-confirmed hardware wallet implants from a reseller designed to steal seed phrases over LTE.

00:00 Today's Cyber Rundown 00:30 Staples Gift Card Heist 02:20 Nikkei Breach Trio 03:42 Burger King Japan Leak 05:23 Broadcom WiFi Foreverday 07:27 Ledger Wallet Spy Implant 09:16 Wrap Up And Sign Off

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency

Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins.

A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts.

Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764).

Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts.

00:00 Top Stories Preview 00:34 ConnectWise Backup Breach 02:54 Bankruptcy Courts Outage 04:37 Phishing Markets Takedown 06:28 Romulus Malware Platform 08:54 BeyondTrust Zero Day 11:28 Japan Cyber Emergency 13:06 Wrap Up and Sign Off

ShinyHunters Arrests, Ransomware Negotiator Ethics, Refrigerators Turned Into Ovens and UnPatch Wednesday, Part Two?

A Cybersecurity Today panel with Michael Joyce, Laura Payne, and David Shipley discusses major recent stories: the ShinyHunters gang's alleged hack of FBI personnel data and a string of arrests including a Canadian cybersecurity executive, raising ethical and legal concerns around the ransomware negotiation industry and calls for vetting or licensing. They also cover allegations that MonsterCloud charged customers for "proprietary" decryption while actually paying ransoms and skimming large margins. The group examines cyber-physical attacks after French grocery stores reportedly had refrigeration systems driven to 50°C, destroying food, with debate over motives, exposed internet-connected devices, and the need for firmware and configuration strategies. The conversation touches on AI doomerism and the Hugging Face/OpenAI incident as misdirection versus basic security failures, then ends on Microsoft's record-breaking Patch Tuesday and the emerging reality of "Unpatch Wednesday," questioning the sustainability of monthly bulk patching.

00:00 Welcome and Panel Intro 00:45 ShinyHunters FBI Hack Fallout 03:53 Ransom Negotiation Ethics 10:15 MonsterCloud Decryption Scam 14:05 Fridge Hacks Destroy Food 17:15 Why Smart Fridges Exist 21:38 Firmware Risk and Strategy 22:57 Grocery Cybersecurity Reality 25:05 Practical Mitigations for Chains 26:28 Food Chain Cyber Lessons 27:23 Grocery Ransomware Fallout 29:01 Lockout Switch Fix 29:56 AI Botnet Doom Debate 32:48 Hugging Face Missed Alarms 36:19 Centralized vs Local AI 40:29 Patch Tuesday Chaos 42:09 Unpatch Wednesday Reality 46:41 Simpler OS Future 47:44 Wrap Up and Thanks

Zero-Click Spyware Ads, Palo Alto Firewall Zero-Day, Critical Drupal Flaw, and OpenAI Bugging Charge

Cybersecurity Today Host David Shipley reports on Citizen Lab findings that Israeli spyware maker Candiru, now reportedly rebranded as Integrity Labs, used targeted online ads bought through DiscoverTech's Controlium platform to profile and, in some cases, zero-click infect Al Jazeera journalists' devices, with ad-bid records showing broad reach across nearly 200,000 sites and apps and extensive profiling of sensitive networks; Google and IAB Europe have cut off DiscoverTech.

The episode also covers active exploitation of Palo Alto Networks PAN-OS management interface zero-day CVE-2026-0322, the company's patches and mitigation guidance, and CISA adding it to the KEV catalog. The show details Drupal's critical Field UI RCE flaw CVE-2026-1080-97, noting many sites run unsupported branches with no fix.

Finally, we cover charges that an OpenAI engineer planted encrypted recording devices in an executive conference room.

00:00 Top Stories Preview 00:27 Zero Click Spyware Ads 02:08 Ad Industry Fallout 03:09 Palo Alto Firewall Zero Day 04:17 How to Patch and Mitigate 05:13 Drupal Critical RCE Risk 06:35 No Fix for Many Sites 07:26 OpenAI Meeting Room Bugging 09:46 Wrap Up and Listener Notes

French Supermarket Freezers Turned to Ovens, Ahold Delhaize Outage, Microsoft's 1,411-Fix Patch Tuesday, AI Worm Debate, and Drones Hit Yandex Cloud

Cybersecurity Today host David Shipley reports on a wave of attacks that pushed refrigeration controllers at hundreds of French supermarket stores up to 50°C, sparking fires and spoiling food, with ANSSI investigating and outdated Danfoss-related firmware and known flaws cited.

He also covers Ahold Delhaize pulling systems offline after a cyber incident disrupting stores and online services across Europe and the U.S.

Microsoft's October Patch Tuesday sets a new record with 1,411 fixes, including critical RCEs and one Windows Shell bug under active attack, amid concerns about patch quality and a new "Risk Cohorts" triage approach.

The episode examines Anthropic's warning about self-replicating AI worms on IoT versus pushback from Marcus Hutchins.

Finally, Ukrainian drones strike three Yandex data centers, disrupting Yandex Cloud and services across Russia.

00:00 Top Stories Teaser 00:33 Freezers Turned Ovens 02:58 Food Supply Chain Hits 03:40 Exposed Danfoss Systems 03:56 Ahold Delhaize Outage 06:02 Record Patch Tuesday 07:29 Patch Quality Concerns 08:47 AI Worms on IoT 10:01 Hutchins Pushes Back 12:18 Ukraine Drones Hit Yandex 14:50 Wrap Up and Sign Off

FBI Arrests Canadian Ransomware Negotiator; MonsterCloud CEO Charged; Qilin Leader Extradited David Shipley covers major cybercrime and safety headlines: the FBI arrests Canadian ransomware negotiator Eduard Dubrovsky in the Shiny Hunters investigation, with charges filed and the complaint sealed; prosecutors also charge MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransoms while claiming he could decrypt without payment and marking up client bills. A suspected Qilin ransomware leader visiting Japan is detained, extradited to Germany, and arrested over a ransomware warrant as the gang continues listing victims. In extremist-crime news, 764 figure Prasan Nepal ("Trippy") pleads guilty to conspiracy to sexually exploit a child, with sentencing set for March 2027. The episode also highlights a domestic abuse survivor who says her ex used a BMW app to stalk and harass her, and points to survivor resources. 00:00 Today's Cyber Headlines 00:30 FBI Arrests Ransomware Negotiator 02:27 Shiny Hunters Crackdown Expands 03:18 MonsterCloud Accused of Paying Ransoms 05:10 Ransom Negotiation Industry Under Fire 05:28 Qilin Leader Extradited to Germany 07:02 Extremist Network 764 Guilty Plea 09:38 BMW App Used for Stalking 11:13 Wrap-Up and Listener Thanks

AI Agents, Security Debt, and Governance: Dave Lewis on the Real Risks of AI in Cybersecurity

Host David Shipley interviews Dave Lewis of 1Password about why AI's biggest cybersecurity risk is less about the models and more about longstanding security debt, weak password hygiene, loose permissions, and poor governance. Lewis argues organizations are rushing AI adoption, bypassing basic controls, and lacking clear AI security governance, which increases blast radius and unintended consequences.

He describes how agents pursue "end of job" goals in non-linear ways, sometimes escalating privileges or seeking sensitive data like credit card details, and warns against giving agents static credentials or "keys to the kingdom."

The discussion covers real-world failures such as default credentials, misuse of internal LLMs with HR data, fraud and deepfakes, legal systems struggling to catch up, and concerns about data control, emphasizing the need for humans in the loop and stronger governance.

00:00 Introduction 00:52 Meet Dave Lewis 02:02 Cyber Beyond Vulnerabilities 04:37 AI Hype and Governance 06:42 Security Debt Meets AI 11:50 Agents Escalate Privileges 13:46 Genie Effects and Credentials 17:07 Rethinking Security Tools 19:18 Fraud Deepfakes and Swarms 22:37 Who Controls Data and Access 23:48 Democratizing AI Security 33:40 Titanic Moment for AI 36:32 1Password Expands to Governance 38:18 Career Advice and Closing

OpenAI Fires Safety Researchers, FTC Probes AI Labs, ChatGPT Linked to Violence, and Connected Cars Share Your Data Host David Shipley covers multiple cybersecurity and AI accountability stories:

OpenAI fired three safety researchers for allegedly sharing confidential infrastructure details with an outside safety group amid broader reports of risky agent behavior and unauthorized web scraping, while US regulators launch an FTC probe into Anthropic, OpenAI and others over consumer harms tied to rogue agents.

A Mother Jones investigation says ChatGPT helped the Tumbler Ridge shooter bypass safeguards, as families and the BC government file lawsuits and related cases allege chatbot links to suicides;

Researchers also find most major automakers broadly share connected-car data with advertisers and tech firms, and Water ISAC urges President Trump to heed CISA on Iran-linked water-sector attacks. Shipley closes with listener feedback and warnings about AI agents impersonation and shopping risks.

00:00 Headlines and rundown 00:31 OpenAI safety team firings 01:32 Agents scraping and breaches 02:43 Quick listener request 03:11 FTC probes AI labs 04:54 ChatGPT and Tumbler Ridge 06:57 AI linked self-harm cases 08:17 Connected cars data sharing 10:09 Water sector urges CISA 12:03 Listener feedback on agents 13:40 Wrap up and next episode