Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, a pair of critical runtime vulnerabilities known as PHP2Shell. One day later, we described how our self-evolving CVE mitigation agent turned the patch into reviewed IPS protection in minutes. This report follows what happened next, including how quickly attackers moved, what their attempts looked like, and how Cato’s cloud-delivered IPS protection blocked them on inspected customer traffic.

Eight eMudhra intermediate certificate authority (CA) private keys were compromised after being generated with insufficient randomness. Attackers could use these keys to forge certificates and impersonate legitimate websites or services to clients that still trust them. An attacker able to intercept a connection could potentially read or modify sensitive traffic.

AI is becoming part of everyday work. Employees rely on services such as ChatGPT and Claude to research, create, and solve problems, while developers increasingly use AI-powered tools like Cursor and coding agents in their development workflows. As employees increasingly rely on AI to work more productively, the AI experience is becoming a critical part of the digital experience IT teams are expected to support.

When an auditor or an RFP asks how your organization handles AI risk, the OWASP Top 10 lists are often a core part of the checklist behind the question. Cato AI Security is built to address the risks on two lists.

AI used to live in a browser tab. Today it also runs inside the apps employees use every day, like Copilot in Word, in dedicated apps like ChatGPT and in coding agents such as Claude Code, Codex and Cursor. Coding agents work differently from chat apps. A chat app answers a question and waits. A coding agent is given tools and takes actions on its own, with the developer’s access. So every endpoint is becoming an agentic endpoint.

CERT-FR’s October 13 update reports compromises of refrigeration controllers, naming Danfoss AK-SM and AK-SC alongside Copeland/Dixell XWEB systems. The entry methods remain unconfirmed. CERT-FR warns that attacks are probably continuing and recommends removing public exposure, checking configurations, and securing remote access. Compromised operational technology (OT) can disrupt cooling, compromise stored products, and threaten cold-chain continuity.

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.

Effective security operations require more than isolated alerts. Analysts need context from across the environment to understand what happened, assess its significance, and decide what to do next. That is why accessing insights and telemetry from across your networking and security stack is critical to teams using a SIEM tool.

When a user says, “the application is slow,” IT has to answer a much harder question: where did the problem actually begin? The issue could be on the endpoint, local network, ISP, the network path, enterprise infrastructure, or application provider itself. That investigation often takes time because teams have to reproduce intermittent problems, collect evidence from separate tools, and hand cases between endpoint, network, and application owners.