Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

We gave four AI coding tools the same prompt and asked each one to build the same application. Emergent, Replit, Lovable, and Base44 all shipped something that ran, and none of them knew a pentest was coming. We then pointed our autonomous pentest agents at all four builds, and 137 confirmed vulnerabilities came back. One finding turned up in every app, which is a CORS misconfiguration.

We built an application on Replit from a single prompt, gave it no special instructions about security, and then pentested it the way an attacker would. Replit had no advance notice that any of this was happening, and there is no vendor relationship between us. The app worked, which is worth saying first, because nothing about the build looked wrong from the outside.

CISOs are hired for their technical depth and then judged on everything else: can they get a budget approved? Can they calm an executive team at 2 a.m. while the incident is still unfolding? Can they convince a product lead to delay a launch without making an enemy? Almost no one is trained for this second job, and yet, it’s the one that decides whether a security program succeeds. This article will highlight ten crucial Chief Information Security Officer (CISO) skills.

TL;DR: On October 22, 2026, Zero Day Initiative accidentally posted six unpatched Linux kernel vulnerabilities to the public LKML. Two are CVSS 9.0 SMB RCEs; three are local privilege escalation. No mainline patches exist yet. Monitor your distribution and unload exposed modules.

Two days after PHP shipped emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the project is back with another RCE advisory: CVE-2026-115560. Looks like PHPoclypse is going to stick around till the weekend. In this blog, we break down what CVE-2026-115560 actually is, the narrow configuration that makes it exploitable, and the one-line mitigation you can apply before the weekend.

The banks aren’t being hacked, at least not in the way the headlines imply. They’re being out-authenticated. No breach of JPMorgan’s, Morgan Stanley’s, Bank of America’s, Citi’s, or Wells Fargo’s core systems has been publicly reported. Instead, Axios reported on October 22—and Reuters corroborated—that AI agents in bank accounts (major U.S. banks) are being detected and blocked.

You might not run PHP yourself. That doesn’t mean you’re safe from PHP2Shell, which is why we created the PHP2Shell Security Checklist. Your SaaS provider might use PHP. Your hosting provider might manage PHP runtimes on your behalf. A third-party application could bundle PHP inside a container or software package you didn’t know existed. This is what makes PHP2Shell a supply-chain security concern.

When a new PHP vulnerability is disclosed, the first question is simple: Is your PHP runtime affected, and what should you do? To help simplify the process, Astra has launched a free PHP2Shell Checker that lets you enter a public URL, check the PHP version it exposes against the listed fixed releases, and understand what to investigate next. Check your PHP exposure for free →

PHP powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we’ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection. So when vulnerabilities show up in PHP’s core engine, it’s worth paying attention. On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell.

From PHP vulnerabilities to supply-chain compromises, security teams are being forced to make difficult decisions about patching, exposure, and business continuity. Here’s the response from security leaders on critical incidents and the learnings on the front lines. Some days in cybersecurity are busier than others, and then there are days when everything seems to go wrong at once…like October 21.