No time to PHP around.

Critical PHP flaws threaten millions of websites. Weak certificates from an Indian authority spark a global security scramble. Investigators probe a U.S. consulting executive’s alleged ties to ShinyHunters. SafePay ransomware hits at least 600 critical infrastructure organizations. Researchers find troubling security biases in Chinese AI-generated code. A $10 million initiative bolsters cybersecurity for small U.S. utilities. An American pleads guilty to stealing from thousands of servicemembers and veterans. Leo Scott, Managing Director of DataTribe, is talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge. Two pallets of GPUs never make it to baggage claim.

Today is Wednesday October 21st 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

PHP vulnerabilities put millions of web sites at risk. 

PHP is a widely used, open-source programming language that powers the behind-the-scenes functionality of websites. It runs on web servers, handling tasks like processing forms, managing user accounts, interacting with databases, and generating web pages. Popular platforms including WordPress, Drupal, and Joomla rely on PHP. Because it’s so widely used, a serious PHP vulnerability can potentially affect millions of websites.

Now, PHP administrators are bracing for two potentially critical vulnerabilities that could put millions of websites at risk. PHP maintainers have announced plans to release patches for two flaws, each carrying a severity score of 9.2 out of 10.

The warning follows leaked, but unverified, details of an exploit tool called PHP2Shell, reportedly capable of executing code on servers running popular platforms including WordPress, Drupal, Joomla, and Magento.

Security firm watchTowr says it has confirmed the vulnerabilities are real, while researchers at Sansec warn that widespread attacks could begin within minutes of the patches becoming available.

One researcher estimates that 1.3 million internet-connected hosts may be affected.

Administrators are being urged to inventory their PHP applications, prepare backups, and arrange emergency maintenance windows. Patches are scheduled for release at 14:00 UTC, though maintainers warn they could arrive earlier if exploitation is detected.

Given PHP’s enormous footprint, the potential consequences extend across much of the web.

An Indian cert authority unlocks a global security headache. 

Security teams worldwide are scrambling to contain a potentially massive Internet security problem after researchers discovered eight digital certificates with private keys so weak that attackers could use them to impersonate virtually any website.

The certificates belong to India-based certificate authority eMudhra. They’re intermediate certificates, meaning they can be used to issue other certificates that browsers and applications automatically trust.

Normally, cracking their encryption would be practically impossible. But these keys were astonishingly weak, containing as little as three to eight bits of entropy. One researcher described the situation as “bonkers.”

Major browsers and several applications have already blocked the certificates, and there’s currently no evidence they’ve been maliciously exploited. But cleaning up the broader Internet could take years.

Cryptography expert Filippo Valsorda compares the challenge to the 2014 Heartbleed vulnerability, warning that this recovery could be even more complicated. Linux systems, embedded devices, forgotten servers, and Internet of Things equipment may require individual updates.

The immediate concern involves attackers intercepting encrypted communications, particularly VPN connections. Exploitation requires positioning oneself between communicating parties, something that’s easier for attackers controlling local networks or possessing sophisticated surveillance capabilities.

Most modern browsers have implemented protections, although Microsoft’s Edge on Windows 10 reportedly remained vulnerable in some circumstances.

The incident exposes a fundamental weakness in Internet trust: even the strongest encryption depends on the security of the organizations issuing certificates.

And when one of those organizations gets the fundamentals spectacularly wrong, the cleanup becomes everybody’s problem.

Investigators believe an executive at a major U.S. consulting firm helped operate ShinyHunters. 

Federal investigators examining the ShinyHunters hacking group are scrutinizing executives at two ransomware negotiation firms over their alleged relationships with the cybercriminals.

According to KrebsOnSecurity, investigators believe an executive at a major U.S. consulting firm helped operate ShinyHunters’ extortion website, which pressured nearly 100 victims to pay ransoms.

Authorities have also arrested Canadian cybersecurity executive Edward Dubrovsky on extortion-related charges. Investigators reportedly uncovered communications linking him and other negotiators to ShinyHunters after Dutch police arrested a suspected group member and accessed his Signal messages.

The investigation raises troubling questions about conflicts of interest in the ransomware negotiation business. Some firms reportedly collect fees based on the size of ransom payments, creating financial incentives that may favor the criminals over their victims.

The allegations remain under investigation.

SafePay ransomware has compromised at least 600 critical infrastructure organizations worldwide. 

The SafePay ransomware group has compromised at least 600 critical infrastructure organizations worldwide since emerging in August 2024, according to a joint advisory from U.S., German, and British authorities.

SafePay has become one of 2026’s most active ransomware operations, targeting organizations across four continents.

The group gains access through stolen credentials, brute-force attacks, vulnerable VPNs, and exposed network devices. Once inside, attackers escalate privileges, move laterally using legitimate administrative tools, disable security software, and steal sensitive data before encrypting systems.

SafePay employs double extortion, demanding cryptocurrency payments in exchange for decryption tools and promises not to publish stolen information.

The group also reportedly calls victims directly to pressure them into paying.

Authorities are urging organizations to strengthen defenses against SafePay’s increasingly widespread operations.

New research raises questions about the security of code generated by Chinese AI models. 

The United States has banned Chinese AI startup DeepSeek from federal civilian agency systems, citing national security concerns. The Department of Homeland Security says DeepSeek’s China-based infrastructure could expose sensitive American data to Chinese authorities.

Beijing condemned the restrictions and warned of possible retaliation, adding another complication to already strained U.S.-China technology relations.

Meanwhile, new research raises questions about the security of code generated by Chinese AI models.

Cybersecurity startup Hirundo tested Alibaba’s Qwen3-Coder and found it produced significantly more vulnerable applications for American defense contractors than Chinese ones. Seventy percent of applications generated for U.S. contractors were exploitable, compared with 59 percent for Chinese contractors.

Applications built for a Hong Kong democracy advocacy group were also more likely to leak secrets.

Hirundo says the discrepancies disappeared after researchers modified the model to remove what they characterize as Chinese Communist Party political alignment.

The findings suggest that AI coding assistants may introduce security risks influenced by their training and underlying model behavior.

A $10 million initiative looks to help smaller U.S. utilities defend against cyberattacks. 

Accenture, Dragos, and the SANS Institute are launching a $10 million initiative to help smaller U.S. utilities defend against cyberattacks.

The new nonprofit Community Cyber Resilience Foundation will initially provide free cybersecurity technology, hardware, deployment assistance, and training to as many as 500 water, wastewater, electric, and natural gas utilities.

The announcement follows a surge in cyberattacks affecting more than 100 American water systems across over a dozen states.

Eligible utilities must have annual revenues below $100 million, a threshold covering more than 50,000 organizations nationwide.

Participants will receive access to Dragos security technology, Accenture implementation support, and SANS operational technology training.

The initiative aims to address a growing cybersecurity divide between large infrastructure operators and smaller utilities struggling with limited budgets, aging equipment, and staffing shortages.

An American pleads guilty to an identity theft scheme targeting U.S. service members. 

A 45-year-old American has pleaded guilty to orchestrating an identity theft scheme that targeted thousands of U.S. servicemembers and veterans.

Robert Wayne Boling Jr. operated from the Philippines, using stolen personal information to access victims’ bank accounts and steal money and veterans’ benefits between 2014 and 2019.

Prosecutors say Boling obtained sensitive records from a former U.S. Army medical records contractor stationed in South Korea.

The operation relied on dozens of money mules in the United States who received stolen funds and transferred portions of the proceeds to the Philippines.

Boling was deported to the United States and arrested in May. Two accomplices have already been sentenced, while two others remain fugitives.

Boling faces up to 40 years in prison for conspiracy to commit wire fraud and money laundering.

Two pallets of GPUs never make it to baggage claim. 

A Brazilian electronics distributor is looking for nearly half a million dollars’ worth of missing graphics cards, and it’s taking its search to Instagram.

Oderço says two pallets of high-end Nvidia RTX 5090 GPUs arrived at São Paulo’s Guarulhos International Airport, then apparently vanished.

After getting nowhere with official inquiries, the company turned to social media, saying nothing like this has happened in its 38-year history.

The missing shipment is valued at roughly $470,000, although the company hasn’t disclosed exactly how many cards disappeared, or when.

The timing is particularly unfortunate. RTX 5090s are already in short supply, with retail prices reaching thousands of dollars per card.

Whether the shipment was stolen, misplaced, or swallowed by some bureaucratic black hole remains unclear.

For now, Oderço is hoping the internet can help locate its missing hardware.

Which is perhaps fitting, considering how many people have already been searching the internet for an RTX 5090.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music and sound design by Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.