Daily Security Feed - 2026-10-22

Security Feed Digest (2026-10-22)

Hacker News: Best

• Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case — Wed, 21 Oct 2026 17:45:13 +0000
• EA is shutting down BioWare — Wed, 21 Oct 2026 17:29:33 +0000
• Today’s PHP security release, and how we’re strengthening security — Wed, 21 Oct 2026 15:48:56 +0000
• The No Kings Takedown Is Why You Shouldn’t Rent Your Megaphone from Zuck — Wed, 21 Oct 2026 14:01:25 +0000
• DuckDB 2.0.0 LTS “Cinnamon Teal” — Wed, 21 Oct 2026 14:01:22 +0000
• Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor — Wed, 21 Oct 2026 14:00:26 +0000
• PHP 8.2.35 — Wed, 21 Oct 2026 13:45:33 +0000
• PHP2Shell: AI uncovers critical RCE in PHP — Wed, 21 Oct 2026 13:43:19 +0000
• Eight Bits of Trust: eMudhra’s CA keys cracked in milliseconds — Wed, 21 Oct 2026 09:08:08 +0000
• The 1.5°C goal of the Paris Agreement is no longer viable — Wed, 21 Oct 2026 09:07:49 +0000
• The Future of CSS — Wed, 21 Oct 2026 01:47:28 +0000
• Muse exposes users’ personal and business secrets when they share conversations — Wed, 21 Oct 2026 00:45:59 +0000
• Security advisory: Critical remote code execution vulnerabilities, update now — Tue, 20 Oct 2026 20:15:50 +0000
• Show HN: SimCity, but with Permits — Tue, 20 Oct 2026 18:29:09 +0000
• What shall I teach my son? — Tue, 20 Oct 2026 17:25:07 +0000
• Google open-sources TorchTPU, a native PyTorch back end for TPUs — Tue, 20 Oct 2026 16:40:24 +0000
• Sixteen years after Deepwater Horizon, deep sea life shows few signs of recovery — Tue, 20 Oct 2026 15:59:06 +0000
• eMudhra intermediate CA compromise — Tue, 20 Oct 2026 13:58:33 +0000

Krebs on Security

• Widespread PHP Flaw May Cause Many Site Outages Today — Wed, 21 Oct 2026 15:26:07 +0000

BleepingComputer

• Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks — Wed, 21 Oct 2026 18:16:26 -0400
• Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected — Wed, 21 Oct 2026 17:43:27 -0400
• Lazarus hackers use post-quantum cryptography for malware delivery — Wed, 21 Oct 2026 16:31:48 -0400
• CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers — Wed, 21 Oct 2026 14:34:42 -0400
• OpenAI agents disabled safety monitoring, one lied about it — Wed, 21 Oct 2026 12:26:53 -0400
• PHP ships emergency patches for critical PHP2Shell flaws — Wed, 21 Oct 2026 10:07:05 -0400
• ClickFix has never been bigger, and AI tools are its most convincing lure yet — Wed, 21 Oct 2026 10:00:10 -0400
• Microsoft PowerToys adds CursorHide, Button Lock mouse tools — Wed, 21 Oct 2026 08:20:34 -0400
• Microsoft says October updates didn’t actually fix VPN issues — Wed, 21 Oct 2026 06:14:53 -0400
• CISA: SafePay ransomware hit over 600 critical infrastructure orgs — Wed, 21 Oct 2026 04:36:24 -0400

Darkreading

• TiDB Breach Exposes Flawed Cloud Security Assumptions — Wed, 21 Oct 2026 21:15:39 GMT
• Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security — Wed, 21 Oct 2026 20:14:42 GMT
• Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens — Wed, 21 Oct 2026 20:03:14 GMT
• ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry — Wed, 21 Oct 2026 19:19:17 GMT
• OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors — Wed, 21 Oct 2026 16:50:15 GMT
• Optiv Launches CyberBOT Cybersecurity Awareness Training Program — Wed, 21 Oct 2026 15:44:48 GMT
• Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk — Wed, 21 Oct 2026 15:29:09 GMT
• Decades-Old Windows Utility Powers Modern ClickFix Attack — Wed, 21 Oct 2026 13:00:00 GMT

The Hacker News

• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases — Thu, 22 Oct 2026 00:27:34 +0530
• LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — Wed, 21 Oct 2026 23:31:57 +0530
• OpenAI’s GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So — Wed, 21 Oct 2026 22:03:47 +0530
• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge — Wed, 21 Oct 2026 19:30:00 +0530
• Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands — Wed, 21 Oct 2026 18:45:09 +0530
• China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors — Wed, 21 Oct 2026 17:35:00 +0530
• Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports — Wed, 21 Oct 2026 17:23:34 +0530
• PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t — Wed, 21 Oct 2026 16:06:53 +0530
• The Harness Is the Hard Part of Agentic Pentesting — Wed, 21 Oct 2026 16:02:40 +0530
• Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections — Wed, 21 Oct 2026 16:00:27 +0530
• PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — Wed, 21 Oct 2026 14:35:17 +0530
• Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites — Wed, 21 Oct 2026 14:31:12 +0530
• U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases — Wed, 21 Oct 2026 13:34:17 +0530
• State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web — Wed, 21 Oct 2026 13:14:22 +0530
• CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws — Wed, 21 Oct 2026 12:56:49 +0530
• Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion — Wed, 21 Oct 2026 11:35:15 +0530

데일리시큐 - 최근인기기사

• [긴급] PHP ‘PHP2Shell’ 치명적 취약점 2건…인증 없이 원격 코드 실행 위험 — 2026-10-21 23:41:39
• 지멘스 소프트웨어 센터 취약점 실제 공격에 악용, 정상 프로그램으로 악성코드 실행 — 2026-10-21 00:08:33
• KISA, 국내 정보보호 기업 일본 시장 진출 지원…도쿄서 ‘K-시큐리티 비즈니스 데이’ 개최 — 2026-10-21 08:31:14
• [김승주 교수 칼럼] AI 시대의 보안 취약점 점검, 정부와 민간의 역할을 나눠야 한다 — 2026-10-21 17:59:29
• 랜섬웨어 조직 킬섹 국제 공조 수사로 서버 차단 및 용의자 검거 — 2026-10-21 14:39:43
• 시스코, ‘2026 스플렁크 옵저버빌리티 현황 보고서’ 발표…AI 에이전트 비용 통제와 신뢰 확보 과제 대두 — 2026-10-21 14:53:54
• 솔트웨어, 데이터브릭스-데이터독과 AI 에이전트 공동 세미나 개최 — 2026-10-21 14:07:35
• [긴급] PHP2Shell 취약점에 웹서버 보안 비상…긴급 설정 점검과 업데이트 필수 — 2026-10-22 08:14:55
• 코헤시티, 2026년 파트너 어워드 수상 기업 발표…국내 총판에 에티버스 선정 — 2026-10-21 13:49:09
• 강준현 의원, 개인정보 유출 조사 전 자료 은닉·폐기 ‘제재 공백’ 지적 — 2026-10-22 08:40:44