Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The banks aren’t being hacked, at least not in the way the headlines imply. They’re being out-authenticated. No breach of JPMorgan’s, Morgan Stanley’s, Bank of America’s, Citi’s, or Wells Fargo’s core systems has been publicly reported. Instead, Axios reported on October 22—and Reuters corroborated—that AI agents in bank accounts (major U.S. banks) are being detected and blocked.

Two days after PHP shipped emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the project is back with another RCE advisory: CVE-2026-115560. Looks like PHPoclypse is going to stick around till the weekend. In this blog, we break down what CVE-2026-115560 actually is, the narrow configuration that makes it exploitable, and the one-line mitigation you can apply before the weekend.

TL;DR: On October 22, 2026, Zero Day Initiative accidentally posted six unpatched Linux kernel vulnerabilities to the public LKML. Two are CVSS 9.0 SMB RCEs; three are local privilege escalation. No mainline patches exist yet. Monitor your distribution and unload exposed modules.

PHP2Shell is a pair of critical flaws in the PHP interpreter itself, each with a CVSS v4.0 score of 9.2. Both let an unauthenticated attacker run code on a web server with a single crafted web request, or a pair of them, before any application code runs. Because the bug lives in PHP, not in WordPress, Drupal or Magento, every reachable PHP endpoint on an affected server is exposed, including login pages, static forms, and health checks. Every PHP release from the last decade is affected (back to 5.4).

1Password Privileged Access was named an Honorable Mention in the 2026 Gartner Magic Quadrant for Privileged Access Management.

Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta. This new PQ GeoKey Manager is a cornerstone of Cloudflare’s data sovereignty solutions, making sure that a customer's decryption keys are only accessible in their chosen geography. GeoKey Manager implements this by wrapping each decryption key such that it can only be decrypted by Cloudflare servers that are located in the allowed geography.

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.