Two themes ran through this week. First, speed: PHP shipped emergency fixes for two critical flaws, and within days exploitation was underway. Second, trust: attackers are hiding inside the platforms, certificates, and help desk processes we treat as safe by default. Here’s what working and aspiring security pros need to know.

Critical Threats

PHP2Shell: Emergency PHP Patches, and Exploitation Is Already Here

PHP released an out-of-cycle security update at 14:00 UTC on October 21 for two critical remote code execution vulnerabilities, each rated 9.2 on CVSS v4.0. The PHP security team held back technical details ahead of the release. By the end of the week, Krebs on Security was reporting that a large share of websites (nearly 70%, by its account) need urgent updates to fix flaws that let attackers take full control of affected servers, that exploits already exist and are being used, and that many sites may show “404” or “Page Not Found” errors while admins patch.

Why it matters: this is how the patch window closes now. A pre-announced fix with no details still gave defenders a few hours’ warning, and the teams that used it had a short list of PHP hosts and a plan ready before 14:00 UTC. If you can’t quickly answer “where do we run PHP, and who owns it?”, fix that first. If you’re early in your career, practicing fast asset discovery and emergency patch coordination is one of the most practical skills you can build.

Read more at The Hacker News → · Krebs on Security →

BlackX UEFI Bootkit Uses Baton Drop to Get Past Secure Boot

A new UEFI bootkit called BlackX was used in an espionage campaign in early 2026. It exploited the Baton Drop vulnerability to bypass Secure Boot, then loaded a malicious driver designed to disrupt security products from Kaspersky and Avast.

Why it matters: Secure Boot only helps if the boot chain it trusts can’t be abused, and Baton Drop is an existing flaw, not a new one. Code that runs before the OS can take your endpoint protection offline before it ever starts. Keep firmware and boot components current, watch for unauthorized boot-level changes, and treat a security agent that suddenly stops reporting as a signal worth investigating, not just a ticket.

Read more at BleepingComputer →

Vulnerabilities & Patches

Browsers and Platforms Block Compromised eMudhra Certificates

Google, Mozilla, Apple, and the Go project moved quickly to block certificates from eMudhra, an Indian certificate authority, after its keys were compromised. These certificates are what HTTPS relies on to prove a site is who it claims to be. How the keys were compromised remains unknown.

Why it matters: when a CA’s keys are compromised, anything signed with them can no longer be trusted, and the browser and platform vendors are the ones who pull the plug. If any of your services, clients, or appliances rely on eMudhra-issued certificates, expect connection failures and plan replacements now. It’s also a good reminder to know which CAs your environment actually depends on.

Read more at Dark Reading →

Tools & Strategy

Talos: Attackers Are Using Legitimate Platforms as Their Delivery Pipeline

Cisco Talos has observed adversaries misusing more than 25 legitimate business platforms over the past year, including collaboration, file-sharing, and payment services. These services already carry users’ trust, which helps malicious content slip past defenses that would flag a less reputable source.

Why it matters: “it came from a known SaaS domain” is no longer a reason to allow something. Detections need to look at behavior and context (who shared it, what it does after it lands) rather than only domain reputation. For analysts, learning to investigate activity that starts on trusted platforms is quickly becoming core work.

Read more at Cisco Talos →

Skip the Malware, Call the Help Desk

Dark Reading reports that threat actors are increasingly skipping traditional malware and simply calling help desks to politely ask for access. AI is making those approaches more convincing.

Why it matters: the help desk is an identity system, and it needs controls like one. Strong identity verification before resets, multi-factor authentication that can’t be talked around, and a culture where questioning an unexpected request is expected all matter more than another malware signature. If you’re coming into security from IT support, your knowledge of how help desks actually work is a real asset here.

Read more at Dark Reading →

Tools I use: A quick aside from me, not part of the news. Writing up stories like these in your own words is one of the best ways to build a public security portfolio, and the hard part is posting consistently. I use Hypefury to queue threads and recycle evergreen write-ups so I stay consistent during busy weeks. (Affiliate link: it supports CybersecurityOS at no cost to you.)

Industry News

Feds Suspect a Ransom Negotiator Ran a ShinyHunters Extortion Site

U.S. federal investigators found that executives at two ransomware negotiation firms had unusually close ties to the ShinyHunters hacking group. One U.S. executive allegedly helped ShinyHunters run a website used to pressure victims into paying ransoms.

Why it matters: when a firm is negotiating on your behalf, it has your data, your timeline, and your bargaining position. Vet incident response and negotiation partners before you need them, know who has access to what during an incident, and keep that relationship in your third-party risk program.

Read more at Krebs on Security →

Tools I use: If writing about security is part of how you’re building your career, an email list is something you own outright. CybersecurityOS runs on Kit, and it’s what I’d point anyone to for starting a newsletter. (Affiliate link: it supports CybersecurityOS at no cost to you.)

Also This Week

• Microsoft says October Windows 11 updates didn’t actually fix the Always On VPN issue it had marked resolved
• OpenAI plans to run frontier model training without live internet access as it resumes RL training of its most advanced models

That’s the week. Know where your PHP runs, check your boot chain, and stop treating “trusted” as a synonym for “safe,” whether it’s a SaaS domain, a certificate, or a caller on the help desk line. We’ll see you next Sunday. Follow along for daily updates in between.