The apps are only the beginning.

Attackers target critical PHP flaws, and former CISA director Chris Krebs weighs in on AI’s role in the vulnerability surge. Railway confirms a cyberattack. HPE patches critical ArubaOS flaws. Quest Diagnostics investigates a disruptive intrusion. Capcom reports a data breach. China-linked hackers put AI-powered attacks on autopilot. And researchers uncover a Microsoft 365 campaign that hijacks authentication tokens to bypass MFA. Our guest is Anudeep Parhar, COO at Entrust, sharing his thoughts on AI kill switches. eMudra throws in the certificate towel.

Today is Friday, October 23rd 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Attackers ramp up attempts to exploit critical PHP vulnerabilities. 

Attackers are ramping up attempts to exploit two critical PHP vulnerabilities known as PHP2Shell, but researchers have yet to confirm a successful compromise in the wild.

The flaws allow unauthenticated remote code execution and prompted emergency patches on October 21. Sophos identified attempts to deploy Potassium, a Mirai botnet variant, although the attack it examined was unsuccessful.

Researchers say exploitation is proving more difficult than initially feared, largely because successful attacks require specific server configurations or ways around memory protections.

VulnCheck has developed an exploit that bypasses one such protection, while an exposed attacker server revealed custom exploitation tools and unsuccessful attempts against dozens of targets.

Meanwhile, patching remains a challenge. Qualys estimates roughly 110 million PHP instances run unsupported versions that won’t receive fixes.

Security researchers have identified 426 mobile apps connecting to servers running PHP versions potentially affected by the critical PHP2Shell vulnerabilities.

NowSecure analyzed more than 15,000 Android and iOS apps, finding that 170 connected to servers running outdated PHP versions that no longer receive official security updates.

The vulnerabilities affect backend servers, not the mobile apps themselves, and could allow attackers to execute malicious code remotely without authentication.

Importantly, researchers caution that identifying a potentially vulnerable PHP version doesn’t establish whether a server remains unpatched or exploitable.

The findings also highlight the risks of third-party dependencies. One advertising provider’s server was contacted by 151 different apps.

NowSecure recommends developers work with their infrastructure providers to verify patching, upgrade unsupported PHP installations, and investigate potential exploitation.

Former CISA director Chris Krebs weighs in on AI and PHP. 

Former CISA director Chris Krebs says artificial intelligence is fueling an unprecedented surge in software vulnerability discoveries, creating what some are calling “Black October” for cybersecurity.

Appearing on CNBC, Krebs said AI-powered tools are uncovering security flaws at a pace that threatens to overwhelm organizations’ ability to patch them.

He pointed to the recently disclosed PHP2Shell vulnerabilities as an example. While attackers have attempted exploitation, Krebs said no successful compromises have been confirmed.

His biggest concern isn’t necessarily large enterprises, which generally have the resources to respond quickly. It’s smaller businesses, rural hospitals, utilities, and managed service providers that lack dedicated security teams.

Krebs warned that vulnerabilities in third-party services could expose entire networks, while legacy systems can complicate patching.

He expects the situation to get worse before it improves, as AI continues uncovering vulnerabilities faster than organizations can address them.

Cloud development platform Railway has confirmed a cyberattack. 

Cloud development platform Railway has confirmed a cyberattack that may have exposed customer passwords, API keys, and other secrets stored in encrypted environment variables. The company believes the breach affected a subset of customers but is urging all users to revoke and rotate their credentials as a precaution. Railway temporarily suspended new builds and deployments while investigating. The number of affected customers, the attack’s root cause, and the systems compromised remain unknown.

Railway suspects the incident is part of a broader campaign targeting AI inference providers. Earlier this week, AI coding tool OpenCode reported a similar attack that exposed credentials belonging to more than one percent of its customers. Railway says it plans to publish a detailed post-mortem.

Hewlett Packard Enterprise patches critical vulnerabilities in ArubaOS.

Hewlett Packard Enterprise has released security updates addressing 72 vulnerabilities in ArubaOS, including eight maximum-severity flaws that could allow attackers to bypass authentication or remotely execute malicious code.

The vulnerabilities affect multiple versions of ArubaOS 8 and 10, which power enterprise wireless networking equipment, including access points, controllers, and gateways. All eight maximum-severity flaws can be exploited remotely without authentication, using relatively simple attacks that require no user interaction.

HPE is strongly urging customers to install the patches, citing the number and potential impact of the vulnerabilities. The company also recommends restricting access to management interfaces through network segmentation and firewall controls.

So far, HPE says it has found no publicly available exploit code or evidence that attackers are exploiting these vulnerabilities in the wild.

Quest Diagnostics is investigating a disruptive cyberattack. 

Quest Diagnostics is investigating a cyberattack that may have exposed patient information and disrupted access to medical test results.

The company discovered unauthorized access to its Quanum Lab Services Manager platform, which healthcare providers use to order tests and retrieve results. Quest took the system offline Thursday and temporarily paused several other systems as a precaution.

The company believes some patient data was accessed but hasn’t determined what information was compromised. Quest says its other operations weren’t affected and is working with law enforcement.

Healthcare providers can use paper requisitions while the system is unavailable. Quest expects to restore service Friday.

The company says the attack is unrelated to recently disclosed PHP vulnerabilities. No threat actor has claimed responsibility.

Capcom discloses a data breach. 

Japanese gaming giant Capcom has disclosed a data breach affecting nearly 11.8 million records associated with its CAPCOM ID service.

The compromised information includes email addresses, account identifiers, and login activity. Attackers also changed passwords on 196 accounts, which Capcom has since reset.

The company says it has no evidence that customers’ original passwords were compromised, and credit card information remains unaffected.

Capcom has contained the unauthorized access and notified Japanese authorities. Customers are being warned to watch for phishing attempts impersonating the company.

Megaman, please call your office. 

A China-linked threat actor is using Artex to automate cyberattacks. 

Microsoft says a China-linked threat actor is using an open-source AI penetration testing framework called Artex to automate cyberattacks against hundreds of organizations.

The group, tracked as Storm-0940, used the tool in an October campaign targeting ConnectWise customers, accelerating reconnaissance, password spraying, and abuse of OAuth applications.

Microsoft observed more than 151,000 failed login attempts, along with successful authentication using compromised ConnectWise application identities.

The attackers attempted to access more than 2,250 Microsoft 365 tenants, sometimes progressing beyond authentication to modify credentials, manipulate directory settings, and establish persistent access.

In one burst of activity, the group targeted more than 300 accounts across eight organizations at over 2,900 attempts per minute.

Microsoft says the campaign illustrates how AI-assisted automation can dramatically accelerate established attack techniques, giving defenders less time to respond.

Researchers uncover a campaign that compromises Microsoft 365 accounts by stealing and replaying authentication tokens.

Security researchers at Huntress have uncovered a ten-week campaign that compromised Microsoft 365 accounts at 79 organizations by stealing and replaying authentication tokens.

Attackers used adversary-in-the-middle phishing and other techniques to capture legitimate login sessions, allowing them to bypass multifactor authentication without needing victims’ passwords.

Huntress observed at least 497 successful sign-ins alongside more than 200,000 failed attempts. Once inside, attackers registered 48 rogue devices, replaced victims’ authentication methods, and created hidden inbox rules to conceal suspicious communications.

In one case, a compromised account was used to send a payroll-related email to an outside contact.

The attacks relied partly on infrastructure belonging to a German hosting provider.

Huntress recommends properly configured Conditional Access policies and warns that password resets alone won’t eliminate persistent access. Organizations must also revoke sessions and remove unauthorized devices and authentication methods.

eMudra throws in the certificate towel. 

From our “you can’t fire me, I quit!” desk, Indian digital trust company eMudhra is getting out of the global SSL/TLS certificate business following a security incident that attracted considerable scrutiny.

The company says it revoked the affected certificate authorities within 14 hours, with no infrastructure compromise, data breach, or affected customer certificates issued.

But eMudhra’s chairman says the resulting social media attention was disproportionate, particularly for a business representing just one percent of company revenue.

Add rising compliance costs and competition from free certificates, and the board decided it was time to pursue other opportunities.

eMudhra promises a smooth transition, including free replacement certificates for affected customers.

Its other digital trust services remain unaffected.

And so, after careful consideration, eMudhra has decided that SSL certificates just aren’t its thing anymore.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.