NCSC CTO, Ollie Whitehouse, has warned of a a vulnerability patch wave. Frontier AI is increasingly able to identify vulnerabilities at great speed and scale, necessitating that all organisations address their latent technical debt.
To read the blog:
NCSC relays its CTO Ollie Whitehouse warning of an AI-driven vulnerability patch wave.
MàJ ⚠️Vulnérabilités PHP.
🟡 Le risque se déplace des sites web vers de très nombreux produits tiers intégrant des versions de PHP. Ces équipements doivent également faire l’objet de mises à jour dès que possible.
+ d'infos dans l'alerte du @CERT_FR :
➡️
ANSSI update to its PHP alert: the risk is moving from websites to the many third-party products that embed PHP.
We added #PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to our Known Exploited Vulnerabilities Catalog. Visit & apply mitigations to protect your org. #Cybersecurity #InfoSec #RCE
CISA adds the PHP2Shell CVEs to the Known Exploited Vulnerabilities catalog, confirming exploitation.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
Cohere on Alibaba's Qwen3.8-Flash-Next during a sandboxed defensive task. Full report: cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
PHP Attacks Update: As others, we have been observing a lot of AI slop PHP attempts against our honeypot sensors the last week, but so far no confirmed exploitation. We have refrained from CVE-2026-109618/619 tagging in scans, due to lack of reliable, safe large scale methods.
Counterpoint to the "exploited in the wild" headlines.
Today, the ministerial meeting on cybersecurity. The Prime Minister instructed us to include, in the emergency package to be compiled by around next week, stronger measures such as white-hat hackers who also use high-performance AI to find system vulnerabilities. The whole government will tackle unauthorized access.
Translated from Japanese; posted after the cabinet-level cybersecurity meeting, Oct 26.
In the 4 days since php2shell was published: 1,448 more CVEs published. No published exploit code for any in Metasploit or Exploit-DB. VulnCheck added 25 on its KEV list. 24 are old bugs. CISA added just 1 to its KEV list, the only new bug anyone has seen adversaries exploit. Nothing in the record shows AI or anything else driving up how many vuln adversaries exploit, or how fast.
Counting what changed in the four days after PHP2Shell was published.
Nowadays wars are not fought only with weapons. A country can also be weakened by attacking its economy. And as India becomes economically strong, we must also protect our banking system from cyber looters and cyber terrorists.
Translated from Hindi; posted by @PMOIndia at the inauguration of the RBI Data Centre and Cybersecurity Training Institute, Bhubaneswar.
I've not seen any proof of an in the wild victim exists for #PHP2SHELL
I've seen claims but zero proof.
That doesn't mean it hasn't occurred....
[...] the insane parts I believe are MORE of a THREAT than the actual technical exploitation parts!
Counterpoint: no proof yet of a real (non-honeypot) victim. Excerpt of a long post; the rest covers patching, backports and the week's hype.
ok, this might be the first publicly documented, validated PHP2Shell RCE in the wild.
Honeypot report of 35 confirmed shells on PHP 8.4.26 mod_php test servers, Oct 24 15:35 to 18:57 UTC.
This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.
Post in his own thread pointing to the 0x4D31 honeypot write-up.
The only way out is through.
They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it.
There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks.
The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous.
There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited.
The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with.
The only way out is through.
Long X post arguing defenders need the same AI tools as attackers. Lead from the Oct 24 PM sweep; exact text from X.
Updated Nov 5, 01:42 UTC. Refreshes on its own.