Here are today’s top cybersecurity stories for Wednesday, October 21, 2026.
PHP Issues Emergency Patches for Two Critical PHP2Shell Remote Code Execution Flaws
PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two runtime flaws rated 9.2 on CVSS v4.0. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Cloudflare reported early exploit attempts and deployed firewall rules, and BambooHR took its service offline in the United States, Canada, and Ireland as a precaution. The Hacker News
Widespread PHP Flaw Prompts Site Outages and Mass Patching
Krebs on Security reports nearly 70 percent of websites need core software updates after the PHP disclosure. Wiz expects mass exploitation to install web shells. Government websites in Europe went offline after the disclosure. Krebs on Security
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Attackers accessed the TeamUpdraft website over the weekend of October 17 and 18 and reached UpdraftCentral connection keys. Patchstack observed signed plugin upload commands sent to connected sites for about 18 hours. TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13, which disconnect older UpdraftCentral connections. The Hacker News
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
A researcher known as kaba found 333 Tor exit relays redirecting SSH traffic to 12 interception servers. At the peak on October 4, the affected relays held 7.46 percent of Tor exit capacity. The Tor Project removed the relays from the consensus by October 5. The Hacker News
NIST, CISA, and NSA Publish Ten Practices for Rogue AI Agent Incidents
The agencies released voluntary guidance across five stages: prepare, detect, respond, recover, and report. The practices cover credential revocation, blast radius analysis, and notification of government and the public. SecurityWeek
US Orders DeepSeek Removed From Federal Civilian Systems
A DHS order requires civilian agencies to remove DeepSeek products and bars new purchases from the developer. China defended DeepSeek after the order. The Hacker News
Google Chrome Adds ClickFix Warnings for Enhanced Protection Users
Chrome detects when an Enhanced Protection user copies a suspicious command. It sends sanitized content to Safe Browsing and shows a warning before the user runs a command judged dangerous. The Hacker News
State Bank of India Confirms Data Leak After 3,897 Customer Records Appear on the Dark Web
SBI identified 3,897 customer records with personal information within a dataset of about 375,000 records. The bank has not determined the source and hired an independent firm from CERT-In’s approved auditor panel. Account numbers, passwords, and card details are not listed in the filing. The Hacker News
CISA Adds Six Exploited Vulnerabilities to the KEV Catalog
The additions cover four Plex Media Server flaws chained in Plex2Shell attacks, a Siemens Software Center DLL sideloading flaw, and a SiteGuard Server Edition command injection flaw. Three have a federal deadline of October 23, and three have a deadline of November 3. CISA
Accenture, Dragos, and SANS Launch $10 Million Initiative to Defend Small US Utilities
The first phase covers up to 500 small utilities. It offers free security tools, equipment, deployment help, and training. SecurityWeek
Chinese AI Model Writes More Hackable Code When Told It Is for a US Contractor
When asked to write code for a US defense contractor, the model produced code 19 percent more likely to be hackable. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
