TLDR INFORMATION SECURITY 2026-10-26

Build with built-in security →

PHP-OCALYPSE: HOW TWO CRITICAL WEB BUGS ALMOST BROKE THE INTERNET

Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution on unpatched servers. The PHP Foundation released fixes on October 21, and banks, retailers, hospitals, and government services briefly took systems offline to install them. Amazon detected exploitation about a week before disclosure, and Palo Alto Networks and Trail of Bits later confirmed compromises. Cloudflare reported a sharp rise in exploitation attempts after disclosure. PHP powers roughly 70% of web-facing sites, including WordPress, Drupal, Joomla, and MediaWiki.

QUEST DIAGNOSTICS DATA BREACH EXPOSED ‘CERTAIN PATIENT RECORDS'

Quest Diagnostics reported unauthorized access to Quanum Lab Services Manager, a platform clients use to order tests and retrieve results, after discovering the intrusion on October 21st, notifying federal law enforcement, and engaging outside security specialists. The company believes certain patient records were accessed but has not identified the number of patients or the exact data exposed.

RESEARCHERS PUSH OVER 2 MILLION UPDATES TO REMOTELY DISABLE POPCORN TIME UPDATER THAT COULD FUEL A BOTNET

Eye Security pushed more than 2 million updates to disable an abandoned Time4Popcorn updater that installed code with SYSTEM or root privileges over unencrypted connections. The flaw, CVE-2026-30612, affected Windows, Mac, and Android builds. The updates cut related traffic by about 98 percent, and Eye then transferred 15 domains to Shadowserver. Users should uninstall Popcorn Time. Turning off the updater leaves the insecure application installed.

BREAKING THE AWS MCP PYTHON SANDBOX

A researcher bypassed the Python sandbox in AWS' managed MCP Server aws___run_script tool. The sandbox used an AST validator and restricted runtime builtins, but it missed implicit attribute reads in Python match/case class patterns. By changing __match_args__, the researcher read blocked attributes, recovered copyreg.__newobj__, accessed its __globals__, and reached the original __import__. This enabled subprocess imports and command execution in the Lambda container. The researcher obtained the Lambda role's credentials and read the sandbox source, but the credentials allowed only sts:GetCallerIdentity. AWS fixed the issue after HackerOne disclosed it.

FIELD NOTES: RECONSTRUCTING AN ATTACKER'S WORKFLOW

PowerShell scripts recovered from an intrusion revealed a %TEMP% file-watching loop that fed commands to Invoke-Expression, overlapping tradecraft from Microsoft's TerminalFix ClickFix analysis. A fake Windows Security prompt looped until the victim entered valid credentials for a targeted account, logging every attempt in cleartext. At the same time, follow-on scripts enumerated AD computers, tested remote WMI access, and mapped readable SMB shares. Defenders should enable Script Block Logging (Event ID 4104) and hunt for string combinations like PromptForCredential, GetNetworkCredential().Password, and DirectorySearcher alongside PowerShell fanning out over TCP/445 or WMI.

BOOK A DEMO.

MAVE (PRODUCT LAUNCH)

Mave uses AI agents to investigate security alerts across existing tools. It pulls live context, provides near-real-time reasoning, and uses approval gates, least-privilege integrations, and audit trails.

HTTP/3 IN BURP SUITE - IT'S TIME TO FIND A BIGGER WORDLIST

Turbo Intruder for Burp Suite now supports HTTP/3 and can easily exceed 100,000 requests per second.

AWS CONTINUUM FOR CODE VULNERABILITIES IS NOW GENERALLY AVAILABLE

AWS Continuum validates code vulnerability findings by testing exploitability in an isolated sandbox, then ranks them using a context graph of resource topology, identity relationships, and network reachability. It delivers fixes as pull requests with proof of exploitability and blast radius attached, starting in an approval-gated Learn mode before teams can switch to autonomous Enforce mode within set guardrails.

AUTONOMOUS ATTACK AGENT IN 'SKYNET MODE' HIJACKS OTHER MODELS TO CARRY OUT ITS EVIL DEEDS

Symantec captured an AI attack agent built to find unauthenticated or stolen-key OpenAI-compatible endpoints, then use hijacked models to plan attacks. Its “Skynet mode” allowed up to 100,000 unattended steps and included 74 tools for scanning, exploitation, credential theft, database dumping, remote code execution, and crypto-mining. Researchers found no proof it was used in real attacks, but the kit ran against a live target.

N0N CYBER EXTORTION INCIDENT INVOLVING 38 MARITIME COMPANIES LIKELY TRACES BACK TO A SINGLE VENDOR

The n0n extortion group listed 38 maritime organizations across 18 countries on its leak site, demanding roughly $1.22 billion combined, including $400 million from Ocean Network Express. Cydome's interim and unconfirmed analysis linked the batch to a single support archive tied to Korean maritime software vendor CyberLogitec, since at least 21 victims were documented customers and sample files referenced its OPUS and ALLEGRO products. The samples pointed to credentials, EDI traffic, and system documentation dating back to 2009, though one sample reused across two listings suggested that being named did not always mean an organization's own data was taken.

INDIAN GOVERNMENT SITES ARE SERVING REVOKED EMUDHRA CERTIFICATES

Over 800 Indian government domains, including UIDAI and the Controller of Certifying Authorities that regulates eMudhra, were still serving certificates days after eMudhra revoked 9,356 of them on its unaffected emSign G1 RSA hierarchy. The mass revocation followed the discovery of trivially recoverable private keys in eight intermediates under emSign ECC Root CA G3, flaws that went unnoticed for 18 months and contradicted MeitY's claim of a limited, brief impact. Firefox's CRLite blocks the affected sites, but Chrome's CRLSet omits these revocations entirely, so Chrome, Edge, Android, and Safari on iOS load most of them without complaint.

UPDATED GOOGLE PRIVACY POLICY SAYS YOUR GMAIL MIGHT BE USED FOR ADVERTISING

Google removed language saying it would not personalize ads using Gmail, Drive, or Photos content when using its Personal Intelligence feature, as content-derived summaries can influence search answers and the ads shown there.

INTERCEPT AND ANALYZE ENCRYPTED TRAFFIC OF A SUSPICIOUS CONTAINER

This hands-on iximiuz Labs challenges players with routing a black-box container's HTTPS calls through a MITM proxy and faking its certificate to read the plaintext, all without modifying or rebuilding the image.

RANSOMWARE GANG EMPERADOR CLAIMS IT STOLE 3.9GB FROM AB INBEV

The Emperador ransomware gang claimed it stole 3.9GB from Budweiser maker AB InBev, including 2,510 corporate emails, internal PKI certificates, and 3.2GB of Azure files, and demanded $1M in bitcoin, though AB InBev has not confirmed a breach.