Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

TL;DR: On October 22, 2026, Zero Day Initiative accidentally posted six unpatched Linux kernel vulnerabilities to the public LKML. Two are CVSS 9.0 SMB RCEs; three are local privilege escalation. No mainline patches exist yet. Monitor your distribution and unload exposed modules.

Two days after PHP shipped emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the project is back with another RCE advisory: CVE-2026-115560. Looks like PHPoclypse is going to stick around till the weekend. In this blog, we break down what CVE-2026-115560 actually is, the narrow configuration that makes it exploitable, and the one-line mitigation you can apply before the weekend.

The banks aren’t being hacked, at least not in the way the headlines imply. They’re being out-authenticated. No breach of JPMorgan’s, Morgan Stanley’s, Bank of America’s, Citi’s, or Wells Fargo’s core systems has been publicly reported. Instead, Axios reported on October 22—and Reuters corroborated—that AI agents in bank accounts (major U.S. banks) are being detected and blocked.

You might not run PHP yourself. That doesn’t mean you’re safe from PHP2Shell, which is why we created the PHP2Shell Security Checklist. Your SaaS provider might use PHP. Your hosting provider might manage PHP runtimes on your behalf. A third-party application could bundle PHP inside a container or software package you didn’t know existed. This is what makes PHP2Shell a supply-chain security concern.

When a new PHP vulnerability is disclosed, the first question is simple: Is your PHP runtime affected, and what should you do? To help simplify the process, Astra has launched a free PHP2Shell Checker that lets you enter a public URL, check the PHP version it exposes against the listed fixed releases, and understand what to investigate next. Check your PHP exposure for free →

PHP powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we’ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection. So when vulnerabilities show up in PHP’s core engine, it’s worth paying attention. On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell.

From PHP vulnerabilities to supply-chain compromises, security teams are being forced to make difficult decisions about patching, exposure, and business continuity. Here’s the response from security leaders on critical incidents and the learnings on the front lines. Some days in cybersecurity are busier than others, and then there are days when everything seems to go wrong at once…like October 21.

Vulnerability: Missing Authorization Leading to Store-Wide Customer Data Exposure via Exported Wallet Transaction File Vulnerable Version: < 2.8.0 Patched Version: 2.8.0 CVE: CVE-2026-94244 CVSS: 4.3 (Medium) AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE: CWE-862 (Missing Authorization) → CWE-200 (Sensitive Information Disclosure) On 02/09/2026, a security researcher at Astra Security found a Missing Authorization vulnerability in Wallet System for WooCommerce, a popular WordPress plugin by WP Swings that

Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page on biliingtop that captured their card details before forwarding them to the real Shopify checkout.