Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Sophos Counter Threat Unit Research Team In Sophos
In response to requests, this update consolidates the Sophos countermeasures that relate the PHP2Shelll vulnerabilities. SophosLabs has developed the following countermeasures to specifically detect activity associated with this threat. The next table lists additional pre-existing Sophos countermeasures that will likely address post-exploitation activity associated with these vulnerabilities.
Read Post

Why AI Needs a Data Control Plane (Masking and Gateways Aren't Enough)

Oct 21, 2026 By Protecto In Protecto
Your AI gateway and identity platform don’t decide whether a task can use a piece of enterprise data. In agentic AI, one request can trigger multiple agents, MCP servers, APIs, RAG systems, and LLMs, and each one is a separate security decision. This video explains why enterprise AI needs a runtime data control plane. It covers why identity alone can’t make the call, why masking PII isn’t enough when business context is sensitive, and how Protecto applies allow, mask, anonymize, rewrite, or selective reveal decisions across the AI workflow. It ends with a Fortune 100 multi-agent example.
View Video
acronis

Acronis Cyber Protect Cloud is now Acronis Cyber Platform

Oct 21, 2026 By Acronis Editorial Team In Acronis
Until October 14, 2026, services providers have known Cyber Platform as Acronis Cyber Protect Cloud, whereas corporate customers have known Cyber Platform as Acronis Cyber Protect. To simplify partner, customer and user experience, Acronis offerings for both service providers and end-customers are renamed to Acronis Cyber Platform.
Read Post
veracode

CISO Risk Intel Brief: Trusted Ingress, Edge Zero-Days, and AI-Generated Code Define Residual Risk

Oct 21, 2026 By Andrea Mazzarini In Veracode
This briefing covers material developments for the seven-day period of 14–21 October 2026 and the thirty-day period of 21 September–21 October 2026. It is written for board risk committees, peer CISOs, and security leadership. The focus is residual risk, control effectiveness, and business enablement across application security, software supply chain, cloud and infrastructure, identity, third-party exposure, and AI-assisted development.
Read Post
cyberhaven

Smaller Models for Better Document Understanding

Oct 21, 2026 By Volodymyr Kuznetsov In Cyberhaven
At Cyberhaven, we replaced our previous LLM-based approach to document understanding with a small model that makes 83% fewer decision errors at less than 1% of the inference cost. We achieved this by breaking complex tasks into simpler decisions, using uncertainty as a training signal, and heavily optimizing our inference stack. The model produces calibrated decision probabilities while preserving multimodal understanding and generative capabilities.
Read Post
aikido

LiteLLM compromised again: infostealer and RAT found in version 1.107.0

Oct 21, 2026 By Ilyas Makari In Aikido
On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source proxy that lets developers route requests across dozens of LLM providers) was found to be compromised by an attacker who injected malicious code into its published Python wheels on PyPI. The official Docker image for the same version is also compromised.
Read Post
cloudflare

Cloudflare deploys protections against php2shell vulnerability

Oct 21, 2026 By Managed Rules In Cloudflare
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.
Read Post
cloudflare

Introducing full transaction detection for Cloudflare WAF

Oct 21, 2026 By Managed Rules In Cloudflare
Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both "Does this request look malicious?" and "What happened when the application handled it?" Response rules can then block the origin’s response before it reaches the requester.
Read Post
Corelight

Building "php2shell" detections before coordinated disclosure

Oct 21, 2026 By Ben Reardon : Corelight Labs, Lead Security Researcher In Corelight
We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.
Read Post

Ep. 89 - OpenAI's Agent Breached Australia's Medicare Portal. OpenAI Told Them 84 Days Later.

Oct 21, 2026 By SafeBreach In SafeBreach
An OpenAI agent spent 84 days inside Australia’s Medicare statistics portal before anyone was told — and the only reason Australia found out is that OpenAI emailed a public disclosures inbox. Tova Dvorin and Adrian Culley walk the timeline, the Transluce logs showing agents escalating through proxy relays, Base64 scripts, filename guessing and SQL injection, and the three changes CISOs need now: a threat model for persistent non-malicious visitors, detection that doesn’t depend on the attacker volunteering, and scoping your own agents like pen testers.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.