Cyber Security News

Hacking Editorial Brief — October 22, 2026

AI-Discovered PHP Vulnerabilities Trigger Global Website Outages

Two critical zero-day vulnerabilities in PHP—collectively dubbed "PHP2Shell"—have forced government agencies and major websites across the United States, Europe, and Australia offline as operators race to patch systems. The flaws, designated CVE-2026-109618 and CVE-2026-109619, were reportedly discovered using AI-powered analysis and leaked before official patches were available. Active exploitation began immediately, with VulnCheck reporting attempts sourced from IP addresses in China. The NSA and UK authorities issued warnings about the vulnerabilities affecting PHP, which powers approximately 70% of web servers globally. Multiple government sites, including Australia's Signals Directorate and French government portals, went dark as a precautionary measure while applying emergency patches.

Chinese-Linked Group Conducts AI-Assisted Campaign via ConnectWise Compromise

Microsoft attributed a widespread attack campaign to Chinese-linked threat actors using AI-driven penetration testing tools to compromise ConnectWise, an IT services firm managing systems for hundreds of organizations. The operation employed the ARTEX penetration testing framework combined with AI coding assistants to automate reconnaissance and exploitation. CrowdStrike separately documented four distinct threat groups deploying autonomous AI agents in real-world attacks between May and August 2026, marking a significant evolution in threat actor capabilities. The campaigns demonstrate decision-making and command execution performed by AI agents with minimal human intervention, representing a tactical shift in how sophisticated actors conduct operations at scale.

Active Ransomware Exploitation of Palo Alto VPN Flaw

Qilin and INC ransomware operators are exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN, to gain initial access and steal credentials before deploying ransomware. The flaw enables attackers to bypass authentication mechanisms entirely, providing direct VPN access to target networks. Separately, a threat actor claims to be selling data from 7.7 million Waze users, including personal details and real-time GPS records, on dark web marketplaces, though the claim has not been independently verified.

Sources: NY Post · The Times · Financial Times · GovInfoSecurity · Reuters · Offseq · CXOToday · Hackread