PHP2Shell is no longer a scanning-only story. A researcher’s honeypots logged 35 confirmed shells against PHP 8.4.26 on Apache mod_php on 24 October, and the flaws are still not in CISA’s KEV catalog. Fortinet has quietly shipped critical fixes for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with details due on 10 November. Meanwhile Wiz says a campaign called Gheist is using stolen GitHub tokens to print repository secrets into Actions logs.

Do today

  • PHP: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, mod_php hosts first, and set session.upload_progress.enabled=0 until the next bugfix release. (PHP security advisories)
  • FortiOS, FortiManager, FortiAnalyzer: move to FortiOS 7.6.8, 7.4.13, 7.2.14 or 8.0.2 (and the matching FortiManager and FortiAnalyzer builds) before advisories go public on 10 November. (Fortinet hardening release)
  • GitHub: search your organisations for ci-sync-XXXXXX branches and runs deleted right after they finished, then rotate every secret those repositories can reach. (Wiz on Gheist)
  • Tailscale SSH: replace tag- and identity-wide SSH grants with source-to-destination pairs, and turn off SSH port forwarding where you can. (Tailworm report)
  • TLS certificates: Chrome removes emSign ECC Root CA - G3 tomorrow, so check every webhook and hook endpoint that Okta, Auth0 or other SaaS platforms call. (Okta advisory)
  • Collabora CODE and VeloCloud Orchestrator: today is the federal KEV deadline for both. (CISA KEV feed mirror)

AI and agent security8 stories

  • A planted AGENTS.md in Downloads hijacks coding agents — Forever Security found a malicious AGENTS.md in a real customer’s Downloads folder. The file told the coding agent to register an MCP server that installs function-color, a known malicious npm package. In Forever’s tests, OpenAI Codex ran the payload in more than 90% of attempts by editing the machine-wide ~/.codex/config.toml. A CLAUDE.md variant got Claude Code to write an attacker-controlled ANTHROPIC_BASE_URL about half the time, and achieved code execution in the same session about a fifth of the time. Forever’s telemetry suggests about half its customers start coding agents in Downloads. Our take: a website can drop a file into Downloads without asking, so treat instruction files the way you treat executables, and alert on unexpected changes to agent config files. (Forever Security research)
  • VirusTotal: most malicious agent skills contain no code at all — VirusTotal looked at 35,878 AI agent skills and flagged 6,637 as malicious. Of those, 62% carry their payload as plain-language instructions in the documentation, not as code. A smaller set hides those instructions behind hundreds of blank lines, inside HTML comments or in invisible Unicode tag characters, and some tell the agent to write to persistent memory files so the effect outlives the skill. VirusTotal calls its counts lower bounds. Our take: review the raw file rather than the rendered page, normalise it before scanning, and make memory and config files (MEMORY.md, AGENTS.md, CLAUDE.md) writable only with explicit approval. (VirusTotal blog)
  • Aokigahara infostealer has a dedicated module for AI tool sessions — Check Point describes Aokigahara, possibly a rebrand of the Kamidere or Stygian stealer. Alongside the usual browser, wallet and VPN theft, an “aisessions” handler collects credentials and session data for Claude Code and Claude Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Kiro, Amazon Q and JetBrains AI Assistant. It also takes Git, SSH and AWS, Azure and Google Cloud config. Check Point doesn’t say how it is delivered, and says it looks to be under active development. Our take: AI tool tokens now belong in the same incident-response rotation list as cloud keys. Check Point publishes hashes, C2 domains and a YARA rule. (Check Point Research)
  • “Web Hole”: lapsed domains still rank in agents’ search results — AIR Security ran about 2,000 agent-style queries and found 36 results whose domains were unregistered and available to buy. Whoever registers one could serve content to every agent that fetches it. They also found sites that address AI agents directly, sites that show agents different content than humans, and a GitHub repository whose README carried malicious commands. The research focuses on Claude’s WebSearch and WebFetch tools and reports no vendor response. Our take: anything an agent fetches from the open web is untrusted input, so keep approval gates on actions that follow web research. (AIR Security research)
  • Anthropic publishes the safeguards behind Claude Duet — Anthropic has documented the controls on Claude Duet, a research-preview agent that acts on connected accounts while the user is away. Sensitive actions need user approval plus a separate automated intent check that runs outside the model. Some actions, such as trading securities and moving money between accounts, are blocked even with approval. Passwords and sign-in tokens never reach the model, because they are injected by a separate browser VM and proxy. Purchases use single-merchant virtual cards. Anthropic acknowledges approval fatigue and says its sensitive-data classifier can miss things during the preview. Our take: the design to copy is credential isolation plus out-of-model policy checks. User approval prompts alone won’t hold. (Anthropic Claude Duet security page)
  • mem0 memory layer: SQL injection through stored memories (CVE-2026-115324) — mem0ai’s Databricks vector store builds insert and update statements by string interpolation. An attacker who can influence memory text, metadata or message names can therefore run SQL on the configured Databricks warehouse. Versions 0.1.117 up to 1.0.8 are affected, and 1.0.8 fixes it. The attack path is indirect prompt-to-storage, so the high attack-complexity rating may understate it for agents that save user content verbatim. Our take: agent memory stores are a data path from untrusted users into back-end databases, so give them the same treatment as any other input sink. (GitHub advisory GHSA-7587-9684-52r6)
    CVSS 9.2 (v4.0, GHSA) EPSS 0.0032 KEV no
  • Meta suspends Muse chat sharing after passive DNS exposed private conversations — Claroc found that shared Muse AI conversations got their own hostname on cf.metaaiusercontent.com, built from the chat title and a random ID. Passive-DNS services recorded those hostnames, which made shared chats discoverable without the link. One query returned more than 6,800 share hostnames. Examples included loan applications, revenue reviews and executive-search preparation. Claroc reported it on 8 October, and Meta suspended the feature after press inquiries. By 20 October the shares Claroc rechecked no longer opened, but the hostnames stay in passive-DNS history. Our take: “unlisted link” sharing is not access control, and that applies to any AI tool your staff use. (Claroc write-up)
  • Unitree Go2 robot: command injection in its GPT chat module (CVE-2026-115995) — VulDB has published a remote OS command injection in the set_volume function of gpt_thread.py, part of the Go2 robot’s chat_go module. It affects firmware 1.1.11.0 through 1.1.11.4, and the record says Unitree confirmed it internally and that 1.1.11.5 fixes it. The rating assumes user interaction. VulDB’s CNA scoring has no independent corroboration, and NVD has deferred analysis. Our take: LLM-driven voice and chat features on robots and other devices are attack surface. Update fleets and keep them off untrusted networks. (NVD CVE-2026-115995)
    CVSS 9.6 (v3.1, VulDB) EPSS 0.0138 KEV no

Application security7 stories

  • Wasmtime: the ARM64 sandbox escape that Dependabot won’t flag (CVE-2026-115893) — CVE-2026-115889 was covered here on Saturday. Its companion, CVE-2026-115893, affects any ARM64 Wasmtime engine on default settings: a large br_table can send execution to the wrong target. The flaw dates back to 2020. Patched builds are 36.0.19, 48.0.7 and 49.0.4, and the earlier ARM64 fixes in 36.0.7, 42.0.2 and 43.0.1 do not cover it. GitHub’s advisory database had a reviewed entry for CVE-2026-115889 but not for this one, so Dependabot may stay silent. Our take: Wasmtime is a library, so every embedding binary needs a rebuild, not just the CLI. The 24.x LTS line is out of support and gets no fix. (Wasmtime advisory GHSA-mghf-wjfp-p5xm, GHSA-897f-g5gm-fmxm)
    CVSS 9.9 (v3.1, Bytecode Alliance) EPSS 0.0043 KEV no
  • 953 Magento stores carry a cloaked loader in their CMS blocks — Sansec traced a campaign active since July 2025 that stores JavaScript loaders in Magento’s cms_block table. Since 23 October the loader serves its payload only to visitors that look like real browsers. Sansec says the current loader domain, deepveindrilling[.]com, appeared on 83 stores, 60 of them already infected by earlier waves. Some stores were first breached through PolyShell (CVE-2026-48356) or SessionReaper (CVE-2025-54236), and some patched stores were infected anyway. Sansec has not yet captured the final payload. Our take: removing the script doesn’t evict the attacker. Rotate database, admin and integration credentials, and search cms_block and cms_page for the loader markers Sansec lists. (Sansec research)
  • New Miasma worm variant adds a wiper that fires on token revocation — SafeDep found 18 npm packages published between 19 and 25 October from three operator accounts, with three still live on 26 October. Press counts of 15 packages count only the removed ones. The payload steals SSH, registry, cloud, Kubernetes and AI tool credentials and exfiltrates them to public GitHub repositories on the victim’s own account. It spreads through the victim’s packages, PyPI, RubyGems, repositories and known_hosts. SafeDep says that if the stolen GitHub token is revoked, a persistence service deletes the home directory, and it lists aiarmor[.]website as a fallback endpoint. SafeDep found no victims beyond the operator’s test accounts. Our take: isolate the host before you revoke tokens, or response becomes data loss. (SafeDep analysis)
  • SleeperWidget: 250 browser extensions activate only when installed from an ad — Microsoft’s Edge team describes at least 250 related listings across the Edge, Chrome and Firefox stores. They pose as map, recipe and package-tracking tools that mostly work as advertised. When installed through a paid-ad landing page, a server-side flag turns on URL reporting, ad injection and affiliate-tag rewriting. The reviewed builds shipped with the flag off, which is how they passed store review. Microsoft says it has removed listings, shared indicators with Google and Mozilla, and blocked more than a million client IDs. Our take: enforce an extension allowlist on managed browsers, because store review can’t catch behaviour switched on by a server. (Microsoft Edge security blog)
  • Prime Mover WordPress plugin: unauthenticated object injection through comments (CVE-2026-115806) — Wordfence reports that Prime Mover – Backup and Migration through 2.2.1 unserializes data from its search-and-replace routine without class restrictions. An unauthenticated visitor can plant a serialized object in a comment, and it fires when an administrator next runs an export or restore. A gadget chain in the bundled Freemius library makes it exploitable with no other plugin installed. The NVD record doesn’t state a fixed version, so the fix is unconfirmed. Our take: if you run this plugin, disable it until a fixed release is confirmed, and don’t run migrations on sites that accept public comments. (NVD CVE-2026-115806)
    CVSS 9.8 (v3.1, Wordfence) EPSS 0.0055 KEV no
  • YesWiki: unauthenticated SQL injection in the Bazar search API (CVE-2026-116207) — Field names passed to YesWiki’s public Bazar entries search API end up inside a backtick-quoted alias that is escaped only with mysqli_real_escape_string. That lets anyone read data such as password hashes, or tie up database threads. Versions 4.6.0 to before 4.7.0 and 5.0.0-alpha1 to before 5.0.0-alpha4 are affected. VulnCheck scores it 9.1 on CVSS v3.1 but 8.8 on v4.0. Our take: upgrade to 4.7.0, and treat password hashes on any internet-facing instance as exposed. (NVD CVE-2026-116207)
    CVSS 9.1 (v3.1, VulnCheck) EPSS not yet scored KEV no
  • PHP rebuilds its Windows binaries for the Brotli flaw (CVE-2026-111497) — PHP has published Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1. The runtime versions are unchanged, and the -1 suffix marks the dependency rebuild. PHP says the vulnerable decoder is only reachable through cURL with automatic HTTP response decompression, which is off by default. Our take: this is low urgency for most Windows PHP hosts, but version scanners keyed on 8.x.y won’t tell the old build from the new one, so check the suffix. (PHP announcement)

Exploited and critical CVEs5 stories

  • PHP2Shell: confirmed code execution in the wild, still no KEV entry — A honeypot write-up from the 0x4D31 project documents 35 shells across three targets on 24 October. Each was a /bin/sh spawned by an Apache worker on PHP 8.4.26 under mod_php, after memory-disclosure requests that defeated ASLR. Follow-up commands were reconnaissance and callback checks, with no second stage seen. Earlier reporting had found only scans and broken exploits. EPSS has pushed both CVEs to the top percentile, but neither is in CISA’s KEV catalog yet, so don’t wait for it. Scores differ: PHP rates the pair 9.2 on CVSS v4.0, and NVD rates CVE-2026-109618 9.8 on v3.1. Separately, CVE-2026-115560 is still unpatched and only reachable in an unusual session-handler configuration, and PHP’s mitigation is session.upload_progress.enabled=0. Our take: the reported successes are against mod_php. Upgrade those hosts first, and give PHP 8.1 and earlier only the minimal backports PHP lists. (honeypot evidence report, PHP advisories, NVD CVE-2026-109618)
    CVSS 9.8 (v3.1, NVD) CVSS 9.2 (v4.0, PHP) EPSS 0.9998 KEV no
  • Fortinet ships critical fixes now, details on 10 November — Fortinet’s security hardening release fixes critical and high-severity flaws that it found with AI-assisted code review. Fixed builds: FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiMail 8.0.2, 7.6.7 and 7.4.9 (7.2 users must move to 7.4); FortiAuthenticator 8.0.4 and 6.6.11. Advisories with CVEs follow on 10 November. Fortinet itself warns that attackers can diff patches faster with the same tools. No exploitation is reported. Our take: treat this as a patch-before-disclosure window. Internet-facing FortiOS and FortiManager go first, and admin interfaces should not be reachable from the internet in the meantime. (Fortinet hardening release)
  • PHP2Shell: CyFirma reports suspected North Korean staging, moderate confidence — CyFirma’s advisory (version 3, 24 October) describes a campaign listing 216 PHP hosts that appear unpatched or partly mitigated, with 21 new scan-node IPs. It rates the campaign activity as high confidence but the Lazarus link only moderate, based on language and tradecraft rather than infrastructure or malware overlap. The 216 figure comes from intercepted operator chatter that CyFirma could not verify, and some scan nodes may be compromised victim hosts. Our take: use the scan IPs for retro-hunting, not blocking decisions, and read the attribution as a lead. (CyFirma advisory)
  • CISA KEV: no additions since 23 October; two deadlines fall today — The KEV feed is still at catalog version 2026.10.23. Federal remediation deadlines for the Collabora Online built-in CODE server command injection (CVE-2026-110447) and the Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) are today. The two Plex SSRF bugs and Siemens Software Center fall due on 3 November. Our take: confirmed PHP2Shell exploitation makes a KEV addition likely, so if you prioritise by KEV alone, add PHP manually. (CISA KEV feed mirror)
    KEV yes (CVE-2026-110447, CVE-2026-114625) EPSS 0.0103 (CVE-2026-114625)
  • Oray Pugongying X5 Pro routers: five CRLF injections, public exploit, no vendor response — VulDB published CVE-2026-116231 through CVE-2026-116235 against firmware 7.6.1. The bugs sit in the ser2net, SNMP, dnsmasq, IPsec and L2TP handlers and let injected newlines rewrite configuration files. Each record says an exploit is public and that Oray did not respond to early contact. All need low-privileged access, and CVSS ranges from 9.1 to 9.9 on v3.1 but 8.6 on v4.0 for CVE-2026-116231. Our take: with no fix in sight, keep management interfaces of these routers off the internet and limit who holds even low-privilege accounts. (NVD CVE-2026-116231)
    CVSS 9.9 (v3.1, VulDB) EPSS not yet scored KEV no

Cloud and infrastructure6 stories

  • Gheist: stolen GitHub tokens used to print Actions secrets into logs — Wiz has tracked Gheist since 15 September and recovered more than 13,500 planted branches from more than 850 compromised accounts. With a stolen token, the tool pushes a ci-sync- branch containing a sync-check workflow. The workflow dumps every secret base32-encoded to get past log masking. The tool then downloads the log through the API and deletes the run. Data leaves through GitHub itself, so there’s no attacker server to block. GitHub’s approval hold protects public repositories, but Wiz has seen successful theft in private repositories and on GitHub Enterprise Server. A newer variant also loots self-hosted runners and probes cloud metadata. Our take: require reviewers on environments with production secrets, and scope OIDC trust policies to protected branches. (Wiz research)
  • Tailworm: unpatched Tailscale SSH flaws reach root on peer nodes — Researcher Erica Windisch tested Tailscale 1.104.2 and headscale 0.29.5 and reports 11 findings. Race conditions in Unix-socket forwarding, which runs as root, let an allowed SSH user reach root-owned sockets and capture enrollment keys. A separate issue in the experimental conn25 app connector lets an entitled user egress to arbitrary destinations, including cloud metadata. Tailscale has published no bulletin or CVE. The researcher calls the disclosure “reported but not coordinated”, and no one has reproduced the results publicly. Our take: until fixes land, use per-pair SSH grants, disable forwarding (on headscale 0.29.5 you can’t, so every SSH grant there is root), and delete compromised nodes at the control plane. (Tailworm report, Tailscale security bulletins)
  • eMudhra distrust: Chrome removal tomorrow, Okta and Auth0 already enforcing — Okta has removed trust in emSign ECC Root CA - G3 and the eight affected intermediates in production, and Auth0’s rollout is in progress. Only outbound calls to customer servers are affected, such as Inline and Event Hooks, Auth0 Actions, custom database and federated connections. Those calls will fail if your endpoint chains to emSign. Tailscale fixed its own trust store in 1.104.2 (TS-2026-013). Chrome removes the root on 27 October. Our take: inventory the inbound endpoints that SaaS platforms call into you, since that’s where these failures show up. (Okta advisory, Tailscale TS-2026-013)
  • GoDaddy mass-revokes about 378,000 certificates after CP/CPS mismatches — GoDaddy told Mozilla it found discrepancies between issued certificates and its Starfield certificate policy documents, suspended issuance and triggered its mass revocation plan. It identified 403,643 certificates, revoked 378,067 (the rest expired), missed the 18 October deadline, and reported completing revocation on 22 October. Our take: automate certificate renewal and monitor revocation status, not just expiry. (Mozilla Bugzilla 2083191)
  • Quad9 will stop serving France on 24 November — Quad9 says it will withdraw its free protective DNS from French users rather than enforce a court-ordered block for broadcaster beIN. It argues it can’t geolocate users without collecting data, and that global blocking would apply French law everywhere. It has appealed. Quad9 says ISPs, mobile networks and public-sector networks use it. Our take: if any network or device configuration in France points at 9.9.9.9, pick and test a replacement resolver before 24 November. (Quad9 announcement)
  • Exchange Online: service-side fix for a stack overflow (CVE-2026-96185) — Microsoft has published a stack-based buffer overflow in Exchange Online that lets an authenticated attacker run code over the network. Microsoft rates it 7.5 with high attack complexity. CISA’s SSVC entry records no exploitation. It is a cloud-service CVE with no customer patch to apply. Our take: no action is needed, but these disclosures help when assessing your exposure to the provider. (NVD CVE-2026-96185)
    CVSS 7.5 (v3.1, Microsoft) EPSS 0.0054 KEV no

Crypto and Web35 stories

  • Bloom trading bot: about $947,000 in SOL taken through a third-party module — Bloom says an RCE flaw in a third-party module let an attacker drain 49 wallets belonging to nine users, about 9,408 SOL. It says no private keys were compromised and that it will reimburse affected users in full. Press reports put the loss at about $954,000, probably the same SOL valued at a different price. Bloom hasn’t named the module. Our take: custodial trading bots concentrate signing power on their own servers, so a supply-chain RCE becomes a wallet drain. Size exposure accordingly. (Bloom statement)
  • NEM token on BNB Chain: about $821,920 drained through LP accounting — SlowMist reports that the NemTokenV2 contract counted transfers into its liquidity pair as sell volume without checking that a swap had settled. The attacker repeated a transfer-skim-flush loop 42 times to drain the pair’s NEM reserve, then sold into the inflated price for USDT. The figure is SlowMist’s estimate, and the project hasn’t published a post-mortem. Our take: fee-on-transfer and “sell tax” tokens that inspect pair transfers are a recurring bug class. Audits should model skim and sync calls. (SlowMist alert)
  • WAX bridge: negative fee let withdrawals debit nothing, about $90,500 lost — SlowMist says WAX’s eth.token withdraw function didn’t check that the maximum fee was non-negative. Setting the fee to minus the withdrawal amount reduced the debit to zero while still paying out the full withdrawal. On-chain records show payouts on Solana and Ethereum. WAX hasn’t published its own figure. Our take: signed-integer fee fields on bridges deserve explicit bounds checks and invariant tests. (SlowMist alert)
  • Yapeswap: zero-quorum governance hands over the fee role, about $21,900 lost — SlowMist reports that Yapeswap’s WorkersUnion governance had a zero quorum. That let a proposal backed by about 0.000055% of voting power transfer YapeFactory’s feeToSetter role. The attacker then installed a registry that returned fake vaults, diverting deposits that pairs still counted as farming assets. The loss is small, but the pattern matches the X100 and Arkadiko governance takeovers covered this week. Our take: check quorum and timelock settings on every governance contract that can reassign privileged roles. (SlowMist alert)
  • Argent-style smart wallet: deadline underflow plus replay, about $59,800 lost — SlowMist describes a two-flaw chain in an Argent-style wallet system on Ethereum. An unrestricted setter let the attacker pick a recovery period that wrapped the deadline into the past, so a guardian-signed recovery finalised in the same transaction and changed the owner. The execution module then accepted the same signed payload 19 times in one transaction and nine in another, which the attacker used to trade a thin MARK/WETH pool. SlowMist doesn’t name the affected deployment. Our take: anyone running a fork of older smart-wallet modules should check recovery-period bounds and nonce handling. (SlowMist alert)

Incidents and industry6 stories

  • HomeToGo: customer data accessed at subsidiary SECRA — HomeToGo SE issued an ad hoc market disclosure on 24 October. It says attackers gained unauthorised access to customer data and personal information at SECRA Bookings GmbH, its channel-management software subsidiary. The headline calls it exfiltration, but the body describes only access. HomeToGo says the incident appears confined to SECRA, containment is complete, and regulators and affected parties will be notified. It can’t yet quantify the financial impact. Our take: channel managers hold booking and guest data for many property operators, so SECRA’s downstream customers should expect notifications. (HomeToGo ad hoc disclosure)
  • &ST HD: about 2.5 million customers’ records may be exposed — The Japanese apparel group disclosed unauthorised access to a business server that may have exposed about 2.5 million customers and 10,000 business partners. The number of employees affected is still under review. It says payment card data is not currently believed to be involved, and it has isolated the server and reported to police and Japan’s privacy regulator. The disclosure was updated on 26 October. The total is still unclear, so these are early figures. Our take: expect targeted phishing against the group’s customers to follow. (&ST HD disclosure summary)
  • Dutch police hold two over AI-voiced bank helpdesk fraud with NFC card relay — Police arrested a 23-year-old and a 25-year-old on 6 October, and a court extended their detention by 90 days on 20 October. Victims got an AI-generated call about suspicious account activity and were passed to a fake bank employee. They were then talked into installing an app and holding their card to the phone, which relayed the card’s NFC data to a “pinner” at a nearby ATM. Police count about 170 victims and €380,000 in losses, and they have taken the servers offline. Our take: this is a social-engineering problem, but banks can help by flagging sideloaded NFC-relay apps and contactless ATM withdrawals that follow a helpdesk-style call. (Politie press release)
  • uCreator: commercial Android kit steals Telegram 2FA passwords and clones WeChat — Researcher Ovi analysed uCreator, a rentable platform behind tampered Telegram and WeChat builds distributed through sideloading, fake store pages and third-party stores. On Telegram it captures the two-step password before hashing, can hide the attacker’s session from the device list, and can change the linked number. On WeChat it uses app virtualisation to clone accounts. Ovi links the operation to Hunan-based companies but calls a shared owner unproven. Doctor Web had earlier reported the related Baohuo backdoor on more than 58,000 devices. Our take: on managed Android fleets, block installs from unknown sources, because a messaging app installed from outside the official store is the warning sign. (Ovi’s analysis)
  • ABC wipes staff devices exposed to “AdFection” spyware ads — Australia’s public broadcaster is wiping a small number of staff devices that loaded ads from the campaign Citizen Lab exposed on 15 October. In that campaign, an ad-tech intermediary linked to spyware vendors delivered zero-click exploits through ordinary ad slots. The ABC says it found no compromise and no evidence any staff member was identified or tracked. Its reporting says more than two dozen Australian organisations saw the ads. Our take: ad blocking on corporate endpoints and gateways is now a recommended control against targeted spyware, not just a privacy preference. (ABC report)
  • Singapore police: fake social media ads push Android banking malware — The Singapore Police Force counts at least 62 cases and S$989,000 in losses since April. Ads for senior programmes, fitness classes and recycling schemes push victims to sideload an APK. Callers posing as officials or bank staff then pressure victims while the malware makes unauthorised transactions. Our take: the same lure-plus-call model is behind the Dutch case above. Banks’ real-time defences are increasingly what decides whether money leaves the account. (Singapore Police Force advisory)

Bottom line

  1. PHP2Shell now has confirmed working shells against mod_php, and EPSS reflects it before KEV does. If your patch queue waits for a KEV listing, override it for PHP today.
  2. Fortinet’s patch-now, details-later release and Wasmtime’s missing Dependabot alert have the same lesson: defenders who act on vendor fixed-version tables beat those waiting for CVE records and scanner signatures.
  3. Agent instruction files, skills, memory stores and web results are all inputs that can carry commands. Review them raw, restrict who can write them, and keep approval gates on agent actions.