TechCapsules

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell…

PHP issued an informational advisory on October 23 warning of a new remote code execution (RCE) vector, CVE‑2026‑115560, that affects web applications with a rare configuration. The flaw requires the session.serialize_handler setting to be switched from php_binary or php_serialize to php at runtime, before session_start(), while session upload progress remains enabled. Because this setup is uncommon, the PHP project will not release an emergency patch; instead it advises administrators to disable session.upload_progress.enabled until the next routine release. The advisory follows the October 21 emergency updates that patched two critical PHP2Shell flaws (CVE‑2026‑109618 and CVE‑2026‑109619) in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No exploitation of the new issue has been reported, and the earlier PHP2Shell exploits have seen a surge in attempts but have not yielded successful code execution.

💡 Disabling session upload progress provides an immediate, low‑cost mitigation for a vulnerability that could otherwise let attackers execute code on servers with a specific, but plausible, configuration.

Symmatrics Appoints Andrew Hallman to Strategic Advisory Board

Symmatrics, a cybersecurity firm developing One-Time Pad Symmetric Key (OTPSK) encryption for AI‑resistant and quantum‑secure protection, announced the addition of former senior CIA and ODNI official Andrew Hall Hallman to its Strategic Advisory Board. Hallman, now Vice President and Strategic Account Executive for the Intelligence Community at Leidos, brings more than three decades of intelligence and security experience, including tenure as Deputy Director of the CIA for Digital Innovation and acting Principal Deputy Director of National Intelligence. The company says Hallman’s background will guide its efforts to safeguard governments, enterprises, and critical infrastructure as AI‑driven attacks and quantum computing threaten traditional cryptography. Symmatrics serves sectors such as national security, defense, finance, healthcare, and critical infrastructure, and other high‑risk organizations worldwide.

💡 Hallman’s deep intelligence background gives Symmatrics unprecedented credibility in selling government‑grade, post‑quantum encryption, accelerating adoption among agencies that can afford cutting‑edge security.

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers from Group‑IB and NyxLab have detailed a intrusion campaign that exploits exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The operation, attributed to the threat actor k0t—also known as CryptoFeel, Member19 and QazWsxShop—has compromised network edge devices worldwide, granting persistent remote access and enabling data exfiltration. Investigators say the group, active since October 2025, acts as a broker linked to ransomware outfit Qilin, buying exploit code and search‑engine

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE…

Ruby released versions 4.0.9, 3.4.12 and 3.3.13 that patch three bugs in its Onigmo regular‑expression engine, the flaws that underpinned four critical GitLab remote‑code‑execution vulnerabilities disclosed between September 23 and October 21. The bugs allow memory corruption when Ruby compiles a pattern supplied by an attacker, and any application that builds a Regexp from untrusted input is vulnerable. GitLab’s bug‑bounty researcher joaxcar reported the issues, which received CVE scores of 9.9 and 10.0. Ruby’s advisory advises upgrading to the new releases or, if that is not possible, avoiding dynamic Regexp compilation; timeout and pattern‑length limits do not mitigate the risk. Ruby will not back‑port fixes to the end‑of‑life 3.2 series. Developers are urged to audit codebases for Regexp usage immediately.

💡 Exploitable regex compilation opens a direct path to code execution on any Ruby‑based service, forcing rapid upgrades across a broad ecosystem.

Google Chrome will let you know if a website ‘doesn’t seem right’…

Google is updating Chrome with new Safe Browsing alerts that warn users about suspicious or dangerous sites when Enhanced Protection mode is on. A pop‑up in the address bar will say “this site doesn’t seem right” for pages showing deceptive patterns, while a full‑screen red warning will appear for sites Google is confident are malicious. The changes roll out to desktop and Android versions and also add protection against ClickFix, a social‑engineering trick that forces users to copy and run harmful commands. In addition, Gemini, Google’s on‑device AI, now generates scam, spam and unwanted‑notification warnings and lets users override false positives. These features aim to reduce phishing, malware and command‑execution attacks while browsing and improve overall online safety for millions.

💡 Turning subtle phishing cues into unmistakable visual blocks forces attackers to confront a higher barrier, prompting faster user reliance on built‑in security.

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft revealed that the China‑aligned threat actor Storm‑0940 exploited the ARTEX AI framework to compromise the ConnectWise Cloud Backup supply chain. Using ARTEX, the group performed rapid scanning, password spraying, and OAuth abuse, targeting over 2,250 tenants at 2,900 attempts per minute. The attack, active since 2021, reached privileged cloud access within hours, affecting sectors from aerospace to finance. The incident underscores the growing use of AI‑driven tools for automated, high‑speed cyber intrusions.

💡 The case shows how AI accelerates credential abuse, shrinking detection windows and enabling attackers to pivot quickly across cloud environments. It signals a new era where automated tools can turn routine supply‑chain vulnerabilities into global, multi‑sector breaches.