PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed...
AndyC
Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.
The Harness Is the Hard Part of Agentic Pentesting
The Hacker NewsOct 21, 2026AI Penetration Testing / Web Security An AppSec team can point an AI agent running on...
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections...
Amazon Bee Frontier and Bee Eclipse Raise Workplace Consent Concerns
Amazon’s new Bee Frontier and Bee Eclipse AI devices can turn conversations into transcripts, summaries, and to-do lists. But their...
ChatGPT Can Now Do More in Chrome, but There’s a Security Trade-Off
ChatGPT can now do more than tell you what to do online; it can take over parts of the work...
Critical flaws strike PHP as disclosure embargo is broken
Key points PHP maintainers are urging users to prepare for patches addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2...
Another model: Canada integrates defence acquisition and industry funding
Australia should use Canada’s new defence procurement model to test whether its forthcoming Defence Delivery Agency (DDA) will have enough...
Is the ad a scam? How to tell before you click
Social Media You can trust a social media platform and still get scammed by an ad running on it Phil...
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21,...
Cloudflare warns fixing botched eMudhra certs goes beyond browsers
Key points Weak keys in eight eMudhra intermediate certificates, generated in an April 2025 key ceremony, allowed attackers to forge...
Before an AI agent acts, name who’s responsible
Every AI system that can use an organisation’s data and systems needs a named human owner, a defined approval boundary...
Australia is a regional maritime power. It should act like it
As Australia seeks to rebuild much of its aged naval fleet, it should also look to rebuild how it perceives...
Extreme beliefs? Fine – but keep it peaceful
We don’t yet know whether politics motivated the Monday attack that left independent member of parliament Helen Haines critically injured...
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An...
Why Incident Response Demand Will Grow Faster than Expected
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to...
