Attackers are exploiting two critical PHP flaws
On October 21, 2026, the PHP project shipped emergency security releases for CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both let an attacker run their own code on a server just by sending it crafted web requests. No login needed. Both score 9.2 on CVSS 4.0.
What makes this more than a routine patch cycle is the timing. Vulnerability details leaked online before the coordinated disclosure, and Amazon’s threat intelligence team observed an exploitation attempt on October 17, four days before any fix existed (Tenable’s FAQ has the full timeline). CISA added both flaws to its Known Exploited Vulnerabilities catalogue on October 26.
The footprint is large. Any PHP installation that serves web requests is in scope: Apache with mod_php (the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That covers WordPress, Drupal, Magento and Laravel sites, along with internal tools and customer portals that quietly run PHP underneath.
What to do:
-
Find every place PHP runs. Websites are the obvious ones. Also check container base images, internal admin panels, sites an agency hosts for you, and any vendor appliance with a web management interface (several appliance makers have issued their own advisories).
-
Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart your PHP workers. Running workers keep the old code in memory until they restart.
-
Disable session upload progress (session.upload_progress.enabled=0). On October 23, PHP warned of a third, narrower flaw, CVE-2026-115560, that the October releases don’t fix. This setting is the interim mitigation.
-
Review from October 17 onward, not from the day you patched. Shells, downloads or new scheduled tasks launched by your web server process are the red flags.
-
Plan your upgrade path. PHP 8.1 and earlier only received minimal source backports for this incident, and PHP 8.2 reaches end of life on December 31, 2026.
Who owns your AI agents?
A chatbot answers questions. An agent takes actions: it reads files, runs commands, sends messages and calls other systems, usually with the same credentials as the person who set it up. Without a named owner, that’s an insider with broad access and no manager.
Bitdefender’s advisory on OpenClaw, a popular open source agent framework, shows what this looks like in practice. Its telemetry found employees installing agents on corporate machines with a single command, often granting full disk or terminal access because that’s what makes the agent work. And the community skills that extend OpenClaw turned out to be a supply chain problem: Bitdefender’s initial scans flagged almost 900 malicious skills, nearly 20% of the packages reviewed. One campaign hunted for agent configuration files holding API keys for AI and cloud services, which are often stored in plain text, and sent them to the attacker.
OpenClaw is one example. Coding assistants with terminal access, browser agents and automations wired into email or CRM raise the same question. Your team is almost certainly experimenting. The issue is whether anyone knows which agents exist and what they can reach.
What to do (the OWASP AI Agent Security Cheat Sheet is a good vendor neutral reference):
- Build an inventory. Ask teams, check endpoints, and review the third party apps and OAuth grants connected to your Google Workspace or Microsoft 365 tenant.
- Give every agent a named owner and add agents to your offboarding checklist, so none outlive the person who set them up.
- Scope access tightly. Only the tools and data each agent needs, ideally under its own identity with short lived credentials.
- Keep a human on high impact actions like payments, deletions, external emails and permission changes.
- Log what agents do, so you can reconstruct events if something goes wrong.
Most of this is people and process, not tooling. A short acceptable use policy naming approved agents does more than another security product. And if you’re pursuing ISO/IEC 42001 or fielding customer questions about AI use, an owned inventory is the evidence buyers and auditors ask for.
Meta’s $25 billion penalty is a lesson about promises
On October 21, 2026, Judge Francis Mathew of the New Mexico district court ordered Meta to pay $25 billion in civil penalties in a case rooted in the Cambridge Analytica scandal, where a third party app harvested data from as many as 87 million Facebook users. New Mexico sued in 2021 under its Unfair Practices Act. In September, a jury found more than 43 million violations, and the judge set the penalty using the Act’s $5,000 per violation maximum, according to CNBC. Meta says it expects to win on appeal, so the figure may change. The court’s findings are public.
The dollar figure is the least useful part for a growing business. Two details matter more.
This wasn’t a hack. A third party with legitimate access used data in ways people never expected. That’s a data governance failure, not a perimeter failure.
And the court weighed what the company said against what it did. It found Facebook hadn’t carried out the full investigation it publicly promised after the scandal. The gap between promise and follow through became part of the liability.
Privacy regulators in Canada, Australia, the UK and EU, and a growing list of US states work the same way: they read your privacy notice and your public statements, then check whether practice matches. So start with a map of where personal information goes, who you share it with, and how long you keep it. Review every vendor, integration and OAuth app that can read customer or employee data, and cut access that’s no longer needed. Then read your privacy notice and your answers to customer security questionnaires against what really happens.
Where you’ve promised to investigate, fix or delete something, keep a record that you did.
Where to start
Each of these comes down to ownership: someone accountable for patching, for agents, for privacy commitments. That’s the part we take on for growing teams. We run the security, privacy and compliance program alongside your people, so your team can stay focused on the business.
