The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. The two unauthenticated RCE flaws were discovered by Calif, Wiz, and OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said. Both flaws stem from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and both can be exploited to achieve remote code execution. CVE-2026-109618 can be used to gain remote code execution as the web worker account by exploiting a chain of weaknesses that trigger out-of-memory corruption, while the CVE-2026-109619 stale global state vulnerability enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.
PHP prepares emergency patches for two critical RCE flaws, while older, unsupported versions could remain exposed without vendor fixes. The U.S. government ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. The order also reaches third-party tools and services built with DeepSeek implementations, which is the part most organizations should notice. The notice doesn’t explain exactly what counts as a “DeepSeek implementation.” Agencies will need to ask suppliers whether their products fall under the ban. “The Department of Homeland Security is publishing notice of the Secretary of Homeland Security’s issuance of an order (1) excluding information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in applicable regulations, from federal civilian agency procurements; and, (2) removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” reads the order. Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018. DHS published it in the Federal Register on October 20 as document 2026-21447, under docket DHS-2026-0628. The order cites national-security concerns. According to reporting on the notice, DHS said DeepSeek’s models could transfer sensitive data to China and may contain malware or other security weaknesses. “In a notice made public on Monday, the Department of Homeland Security also barred agencies from acquiring DeepSeek products and services, including those developed by affiliated entities.” South China Morning Post reports, “The notice said that using the company’s products “may result in the transfer of sensitive data to the PRC if used by US government employees or vendors”, adding that the models “themselves may contain malware or other security vulnerabilities”.” DeepSeek’s own privacy policy says it collects, processes, and stores personal data in the People’s Republic of China. That does not prove wrongdoing, but it explains why U.S. agencies treat data residency and foreign legal access as material risks. The ban doesn’t apply to private companies or ordinary users, but government contractors may also be affected. They generally can’t use covered products or services for federal contracts unless they receive a waiver. The goal is to catch hidden uses of DeepSeek, including AI models built into apps, services and development tools. Agencies need to check their systems, while suppliers must disclose which AI models they use, where the models process data and whether information leaves the customer’s environment. The ban took effect when issued, but existing contracts are covered only after the contracting officer formally updates them. Agencies can request an exception, but they must provide a strong justification. DHS signed the order on July 24 but didn’t publish it until October 20, 87 days later. The rules don’t set a deadline for public release, but they require officials to notify the company and relevant congressional committees and review the order at least once a year. This delay meant affected organizations had to comply before they could read the public explanation or see the signed order. China pushed back. Foreign Ministry spokesperson Mao Ning said Beijing opposes “the overstretching of the concept of national security” and would defend the lawful rights of Chinese companies; DeepSeek did not immediately comment to the Associated Press.[apnews] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP).
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management: "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." The vendor says it believes the threat actor accessed its customer database, which included details about the customer and billing, order history, as well as more sensitive information:
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0. The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team warned.
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. The company lists programming languages such as COBOL, Fortran, and Visual Basic as a few examples where it has seen significant improvements. OpenAI says COBOL supports more than 40% of online banking systems, 80% of in-person credit card transactions, and 95% of ATM transactions, while Fortran is still used in areas such as weather forecasting and nuclear reactor safety analysis. "These languages have less code and documentation available for models to learn from than languages like Python and JavaScript, yet support critical infrastructure and essential services around the world," OpenAI explained in a blog post. To measure progress, OpenAI created MultiLangBench, which asks models to build a SQLite-compatible database engine from scratch across 20 programming languages.
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
Confirm this action.
Leaving now will discard your changes.