TechCapsules

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell…

PHP issued an informational advisory on October 23 warning of a new remote code execution (RCE) vector, CVE‑2026‑115560, that affects web applications with a rare configuration. The flaw requires the session.serialize_handler setting to be switched from php_binary or php_serialize to php at runtime, before session_start(), while session upload progress remains enabled. Because this setup is uncommon, the PHP project will not release an emergency patch; instead it advises administrators to disable session.upload_progress.enabled until the next routine release. The advisory follows the October 21 emergency updates that patched two critical PHP2Shell flaws (CVE‑2026‑109618 and CVE‑2026‑109619) in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No exploitation of the new issue has been reported, and the earlier PHP2Shell exploits have seen a surge in attempts but have not yielded successful code execution.

💡 Disabling session upload progress provides an immediate, low‑cost mitigation for a vulnerability that could otherwise let attackers execute code on servers with a specific, but plausible, configuration.

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers from Group‑IB and NyxLab have detailed a intrusion campaign that exploits exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The operation, attributed to the threat actor k0t—also known as CryptoFeel, Member19 and QazWsxShop—has compromised network edge devices worldwide, granting persistent remote access and enabling data exfiltration. Investigators say the group, active since October 2025, acts as a broker linked to ransomware outfit Qilin, buying exploit code and search‑engine

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE…

Ruby released versions 4.0.9, 3.4.12 and 3.3.13 that patch three bugs in its Onigmo regular‑expression engine, the flaws that underpinned four critical GitLab remote‑code‑execution vulnerabilities disclosed between September 23 and October 21. The bugs allow memory corruption when Ruby compiles a pattern supplied by an attacker, and any application that builds a Regexp from untrusted input is vulnerable. GitLab’s bug‑bounty researcher joaxcar reported the issues, which received CVE scores of 9.9 and 10.0. Ruby’s advisory advises upgrading to the new releases or, if that is not possible, avoiding dynamic Regexp compilation; timeout and pattern‑length limits do not mitigate the risk. Ruby will not back‑port fixes to the end‑of‑life 3.2 series. Developers are urged to audit codebases for Regexp usage immediately.

💡 Exploitable regex compilation opens a direct path to code execution on any Ruby‑based service, forcing rapid upgrades across a broad ecosystem.

Google Chrome will let you know if a website ‘doesn’t seem right’…

Google is updating Chrome with new Safe Browsing alerts that warn users about suspicious or dangerous sites when Enhanced Protection mode is on. A pop‑up in the address bar will say “this site doesn’t seem right” for pages showing deceptive patterns, while a full‑screen red warning will appear for sites Google is confident are malicious. The changes roll out to desktop and Android versions and also add protection against ClickFix, a social‑engineering trick that forces users to copy and run harmful commands. In addition, Gemini, Google’s on‑device AI, now generates scam, spam and unwanted‑notification warnings and lets users override false positives. These features aim to reduce phishing, malware and command‑execution attacks while browsing and improve overall online safety for millions.

💡 Turning subtle phishing cues into unmistakable visual blocks forces attackers to confront a higher barrier, prompting faster user reliance on built‑in security.

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft revealed that the China‑aligned threat actor Storm‑0940 exploited the ARTEX AI framework to compromise the ConnectWise Cloud Backup supply chain. Using ARTEX, the group performed rapid scanning, password spraying, and OAuth abuse, targeting over 2,250 tenants at 2,900 attempts per minute. The attack, active since 2021, reached privileged cloud access within hours, affecting sectors from aerospace to finance. The incident underscores the growing use of AI‑driven tools for automated, high‑speed cyber intrusions.

💡 The case shows how AI accelerates credential abuse, shrinking detection windows and enabling attackers to pivot quickly across cloud environments. It signals a new era where automated tools can turn routine supply‑chain vulnerabilities into global, multi‑sector breaches.

Black Kite Adds Quantum Readiness Checks for Third-Party Vendors

Black Kite has launched Quantum Readiness controls within its Cyber Rating platform to evaluate third‑party vendors’ preparedness for post‑quantum cryptography. The new checks scan for hybrid key exchange, certificate signature readiness, and assets lacking migration plans, and feed results into the SSL/TLS Strength category. The feature aims to help organizations identify supply‑chain gaps, track vendor progress, and meet looming regulatory deadlines such as NIST’s 2030 deprecation of RSA and EU’s 2026 cryptographic roadmap.

💡 By exposing which vendors are already adopting quantum‑safe encryption, the tool forces supply chains to confront an imminent threat that could compromise data long before quantum computers become mainstream.