23.10.2026

CSO Online 23.10.2026 00:43
Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure.
According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity firm Chainguard “unlaterally” broke this embargo. This prompted the PHP project to release its patches early, but also allowed attackers to study the fix in binary form and craft proofs-of-concept (PoCs) for exploits before defenders had a chance to update their systems.

Schneier on Security 22.10.2026 13:26
PHP maintainers have released fixes for two critical vulnerabilities:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs…

CSO Online 22.10.2026 11:47
A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said.
Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations. In some cases, the group gained privileged cloud access less than three hours after first targeting a victim. Microsoft said the activity did not result from a compromise of or vulnerability in its own systems, products, or services.

Spiegel Online 22.10.2026 11:45
Schwere Sicherheitslücken in Millionen Servern haben Firmen, Behörden und Privatleute alarmiert. Jetzt wird bekannt, dass Informationslecks für den Unfall verantwortlich sind. Wie groß die Schäden werden, ist noch offen.

Infosecurity Magazine 22.10.2026 10:10
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities

Heise Security 22.10.2026 08:39
Mit Updates für mehrere Versionszweige schließt GitLab zwölf Sicherheitslücken, darunter auch eine kritische Lücke zur Remote-Codeausführung.

Heise Security 22.10.2026 07:23
Viele Linux-Distributionen liefern aktualisierte PHP-Pakete. Webseiten gingen offline. Erfolgreiche Exploits sind bislang nicht belegt.

Spiegel Online 22.10.2026 06:59
Von einer Entwarnung im Netz kann angesichts der weltweiten Sicherheitslücken noch keine Rede sein. Aber Webseiten in Deutschland sind nach und nach wieder erreichbar.