← Saturday 24 Octobernote 8 of 12
CybersecuritySat 24 Oct 2026 · 8 of 12

Mirai Botnet Targets Newly Patched PHP2Shell Vulnerabilities

Verified · 17/17 supported1 cited · 1 min read

securityweek.com reports that researchers linked PHP2Shell attack attempts to the Mirai botnet and demonstrated an ASLR bypass, but no successful in‑the‑wild compromise has been confirmed . securityweek.com reports that emergency patches for the PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) were released on October 21, one day earlier than planned after the CVE identifiers leaked online . securityweek.com reports that the two critical bugs allow unauthenticated remote code execution and have a CVSS v4.0 score of 9.2 . securityweek.com reports that precautionary shutdowns affected many organizations, with European government, school and hospital websites going dark on October 21 and the UK government reporting 32 services unavailable and four partially unavailable . securityweek.com reports that Amazon detected the first exploitation attempt on October 17, that attack activity surged after the patches were released, and that a security firm built an exploit that bypasses a key memory protection (ASLR) .

Why it matters. securityweek.com reports that the surge in attack activity and precautionary shutdowns left many public services temporarily unavailable, affecting users of government, school and hospital websites .

Earlier on Cybersecurity

Fri 23 Oct 2026Corey Thuen’s “evil bit” hiring philosophy at Gravwellsecurityweek.com reports that Corey Thuen is the founder and CEO of Gravwell, a firm that develops data analytics and vulnerability detection using big data experts and hackers. securityweek.com reports that Thuen hires hackers based on an “evil bit,” an adversarial mindset that can identify ways to exploit products. securityweek.com reports that he believes the “evil bit” is largely innate and not easily taught. securityweek.com reports that Thuen previously worked for the US government evaluating systems in power substations, part of critical infrastructure. securityweek.com reports that he references the old‑school hacking ethos that all information should be free and questions who defines morality.Thu 22 Oct 2026Google adds server‑side Gemini analysis and dual‑level warnings to Chrome securitysecurityweek.com reports that Google announced new Chrome protections against scams and social engineering, including new site warnings, server‑side Gemini analysis, and detection of ClickFix commands. securityweek.com reports that the Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode introduced in 2020, and that more than 1 billion Chrome users had turned it on last year. securityweek.com reports that Google claims Enhanced Protection makes users ten times safer than Standard Protection against phishing, social engineering, notification abuse, and other scams, based on average safety warnings per user group. securityweek.com reports that Chrome’s Safe Browsing site warnings now have two levels—a full‑page red “dangerous site” warning for high‑confidence malicious pages and a “suspicious site” warning for lower‑confidence verdicts. securityweek.com reports that Gemini‑powered scam detection has moved to Google’s servers, while the on‑device version launched last year was limited to Enhanced Protection users and focused on tech‑support scams.Wed 21 Oct 2026US Agencies Issue Ten Voluntary Practices for Rogue Super‑Intelligence Agent Incidentssecurityweek.com reports that NIST, CISA and NSA released ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI (super intelligence) agent incidents. securityweek.com notes that the guidance, titled “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation,” uses the term super intelligence (SI) rather than AI to align with executive order 14434. securityweek.com explains that the ten practices are organized into five stages: prepare, detect, respond, recover, and report. securityweek.com adds that the report includes definitions for AI agents, AI control incidents, and AI control near‑misses. securityweek.com says the preparation stage lists activities such as asset and risk inventories, defense‑in‑depth, least privilege, zero‑trust controls, credential management, and supply‑chain risk management.
Next · CybersecuritySelf‑Rebuilding Heartbreaker macOS Ransomware Remains Undetected →