Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected. ‍The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 10:00 EDT / 07:00 PT. If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. Be prepared to take action.

Passkeys make authentication safer by resisting phishing attacks and eliminating shared secrets like passwords that attackers can steal from a website to access your accounts. By removing the secrets from servers, they reduce the risk of data breaches. However, advances in quantum computing threaten to increase the risk of those data breaches yet again by breaking the cryptography passkeys currently use.

The two registers hold different objects, run on different clocks and answer to different people. Where they are treated as one list at different levels of detail, items get counted twice and others fall between them. ‍ A vulnerability register holds findings on assets and numbers in the thousands. A cyber risk register holds loss scenarios and numbers in the tens. Neither is a summary of the other. ‍

Most governance platform comparisons written for financial services lead with the EU AI Act high-risk regime. For a bank deploying credit scoring today, that is the obligation furthest from biting, and the ones already in force get less attention than they deserve. ‍ The criteria below follow the provisions rather than the subject areas, with dates attached, because the sequence they arrive in decides what a platform has to do first. ‍

South Africans who fall victim to cybercrime now have more support available. MiDO Academy, The Cyber Helpline (UK) and Amazon Web Services (AWS) launched the pilot of The Cyber Helpline in South Africa, a free, confidential service providing practical guidance and compassionate support to individuals affected by online fraud, investment and employment scams, hacked accounts, phishing and smishing, social media fake profiles, sextortion, online harassment, identity theft, malware and ransomware incidents.