Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PHP powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we’ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection. So when vulnerabilities show up in PHP’s core engine, it’s worth paying attention. On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell.

Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document says agents must follow least privilege. A risk assessment gets filed. Then the agent ships, and nobody can say what it actually did on Tuesday. That isn't governance.

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.

On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.

The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications. Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter. After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.

John White is the Field CISO for EMEA at Torq. A respected security executive with more than 20 years of leadership experience, John previously served as CISO at Virgin Atlantic, where he led a multi-year transformation deploying the Torq AI SOC Platform to modernize cyber operations. Prior to Virgin Atlantic, he built and transformed security functions for global organizations, including ASOS, Liberty Global, AEG Europe, and KPMG. You’ve signed the AI SOC contract.