Websites go dark as critical PHP flaws trigger emergency updates
Government and business websites have been taken offline as operators race to patch two critical PHP flaws uncovered with AI-assisted research. Attackers could seize vulnerable servers without logging in. |
The FBI renewed its warning. The NSA recommends taking affected systems offline if they cannot be updated immediately. Fixes for the original two flaws are available.
SoftBank suspended emergency alerts while addressing PHP vulnerabilities. Today, PHP also disclosed a separate risk under an unusual configuration and issued additional guidance.
AI agents are inside major U.S. bank accounts
AI agents are accessing accounts at major U.S. banks, with some attempting actions that appear to go beyond users’ instructions, according to Axios. |
Customers often supplied their login credentials. Banks are restricting agent access and blocking transactions as they work to control the risks.
Banks say they have no evidence of rogue-agent hacks affecting customer funds or accounts. Access through a customer’s password can still violate bank rules.
Two AI platforms disclose security incidents
Railway and LiteLLM disclosed separate incidents this week, putting customer credentials and AI infrastructure under scrutiny. |
Railway says attackers accessed internal systems and exposed encrypted secrets belonging to some customers. It recommends that customers who signed up before October 21 rotate stored keys.
LiteLLM’s release pipeline was compromised. Version 1.107.0 distributed credential-stealing malware and remote-access tools before the affected packages were removed.
Cybersecurity stocks rally as risks rise
Security stocks gained as the PHP emergency put protection spending in focus. October 23 intraday changes versus the previous close are shown below. |
These are intraday readings, not closing returns.
Quick Hits
Node.js patches serious flaws. October 21 updates fix code-execution and server-identity-check flaws. Fixed releases include 22.23.4, 24.22.1, and 26.12.1. Read more →
Eight website certificate keys compromised. Google blocked affected eMudhra keys that could enable forged HTTPS certificates to impersonate websites. Its public warning was issued October 20. Read more →
Quest patient data accessed. Quest confirmed unauthorized access to its Quanum lab system and patient information. The scope remains under investigation; Quest says the incident is unrelated to PHP. Read more →
Hidden comments can hijack coding agents. BeyondTrust’s October 21 research demonstrated hidden instructions that could manipulate Copilot into exposing credentials after a user assigns it a malicious comment. Read more →
Plex confirms active attacks. An October 19 update warned that outdated servers were being used for miners and proxy software. The patches were released earlier. Read more →
PingCAP discloses stolen data. Its October 19 notice described stolen credentials, copied internal data and source code. Investigators found no evidence that data stored in TiDB was impacted. Read more →
Japan plans AI attack simulations. Japan announced a team on October 23 to use AI to simulate cyberattacks and identify weaknesses as organizations responded to PHP flaws. Read more →
Wall Street prepares contingency plans. Banks are planning how to protect accounts and keep operations running after major AI-related incidents, Axios explained October 23. Read more →
Know someone responsible for a website or AI product? Send them this briefing.