TechCapsules

AI is making cyber attacks too easy. Here’s what you can do…

A pair of critical PHP vulnerabilities dubbed “PHP2Shell” were disclosed this week, exposing servers to takeover and data theft. PHP powers roughly 70 % of websites, including major platforms such as WordPress, Yahoo, Etsy and Wikipedia. After the flaws were announced, threat actors rapidly employed AI tools to scan for and exploit the bugs, generating thousands of attempts on Cloudflare’s network within minutes and escalating to millions within hours. The PHP Foundation issued a patch on October 21, but it only covers recent PHP releases, leaving countless legacy installations unprotected. Governments temporarily shut down affected sites, and IT teams have been racing to apply fixes. The episode illustrates how AI can accelerate vulnerability discovery and mass exploitation at unprecedented speed.

💡 AI’s ability to weaponize dormant code flaws turns routine patch cycles into urgent, large‑scale crises, forcing organizations to rethink security automation.

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista…

The U.S. Cybersecurity and Infrastructure Security Agency added two critical vulnerabilities to its Known Exploited Vulnerabilities list: CVE‑2026‑110447 in Collabora Online’s CODE Server and CVE‑2026‑114625 in Arista VeloCloud Orchestrator. Reports show active exploitation, with attackers using the Collabora flaw to install web shells on Nextcloud servers for credential and wallet reconnaissance. The Arista flaw requires network access and an authenticated session, with attackers identified from two Japanese IPs. Federal agencies must patch by October 26, 2026.

💡 The rapid weaponization of these flaws underscores the urgency for organizations to prioritize patching, as attackers can now infiltrate widely used collaboration and networking platforms with minimal effort.

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell…

PHP issued an informational advisory on October 23 warning of a new remote code execution (RCE) vector, CVE‑2026‑115560, that affects web applications with a rare configuration. The flaw requires the session.serialize_handler setting to be switched from php_binary or php_serialize to php at runtime, before session_start(), while session upload progress remains enabled. Because this setup is uncommon, the PHP project will not release an emergency patch; instead it advises administrators to disable session.upload_progress.enabled until the next routine release. The advisory follows the October 21 emergency updates that patched two critical PHP2Shell flaws (CVE‑2026‑109618 and CVE‑2026‑109619) in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No exploitation of the new issue has been reported, and the earlier PHP2Shell exploits have seen a surge in attempts but have not yielded successful code execution.

💡 Disabling session upload progress provides an immediate, low‑cost mitigation for a vulnerability that could otherwise let attackers execute code on servers with a specific, but plausible, configuration.

Symmatrics Appoints Andrew Hallman to Strategic Advisory Board

Symmatrics, a cybersecurity firm developing One-Time Pad Symmetric Key (OTPSK) encryption for AI‑resistant and quantum‑secure protection, announced the addition of former senior CIA and ODNI official Andrew Hall Hallman to its Strategic Advisory Board. Hallman, now Vice President and Strategic Account Executive for the Intelligence Community at Leidos, brings more than three decades of intelligence and security experience, including tenure as Deputy Director of the CIA for Digital Innovation and acting Principal Deputy Director of National Intelligence. The company says Hallman’s background will guide its efforts to safeguard governments, enterprises, and critical infrastructure as AI‑driven attacks and quantum computing threaten traditional cryptography. Symmatrics serves sectors such as national security, defense, finance, healthcare, and critical infrastructure, and other high‑risk organizations worldwide.

💡 Hallman’s deep intelligence background gives Symmatrics unprecedented credibility in selling government‑grade, post‑quantum encryption, accelerating adoption among agencies that can afford cutting‑edge security.

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers from Group‑IB and NyxLab have detailed a intrusion campaign that exploits exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The operation, attributed to the threat actor k0t—also known as CryptoFeel, Member19 and QazWsxShop—has compromised network edge devices worldwide, granting persistent remote access and enabling data exfiltration. Investigators say the group, active since October 2025, acts as a broker linked to ransomware outfit Qilin, buying exploit code and search‑engine

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE…

Ruby released versions 4.0.9, 3.4.12 and 3.3.13 that patch three bugs in its Onigmo regular‑expression engine, the flaws that underpinned four critical GitLab remote‑code‑execution vulnerabilities disclosed between September 23 and October 21. The bugs allow memory corruption when Ruby compiles a pattern supplied by an attacker, and any application that builds a Regexp from untrusted input is vulnerable. GitLab’s bug‑bounty researcher joaxcar reported the issues, which received CVE scores of 9.9 and 10.0. Ruby’s advisory advises upgrading to the new releases or, if that is not possible, avoiding dynamic Regexp compilation; timeout and pattern‑length limits do not mitigate the risk. Ruby will not back‑port fixes to the end‑of‑life 3.2 series. Developers are urged to audit codebases for Regexp usage immediately.

💡 Exploitable regex compilation opens a direct path to code execution on any Ruby‑based service, forcing rapid upgrades across a broad ecosystem.