It keeps

 

getting worse by the day.

CISA confirms PHP2Shell under attack 

as researchers clock successful exploits

10/27/26 

"The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week."

"CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild."

(So now it has:

"observed successful exploitation in the wild")

"Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That's bad news given how much of the web still relies on PHP, and just how many sites could be left exposed."

"Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed."

"CISA's confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door."

"CISA's confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency."

Thats when I got a lump in my throat

when I was reading this yesterday:

"the activity it observed amounted to scanning"

That is worse than it actually being active and exploiting

because what that means is:

WHAT WE ARE SEEING NOW

IS JUST THE SCOUT TEAM.

Monday, October 26, 2026

LOVE WARNS...Gonna kinda be a recurring theme....

Chain-reaction chaos...Banks AI, Cyber security...etc

"Major banks found unauthorized AI agents inside customer accounts, some trying to take actions customers never asked for. And Anthropic's deputy chief information security officer, Jason Clinton, warned that as bad as the past several days had been, cyber threats will get "a lot worse before they get better." Salesforce CEO Marc Benioff quickly agreed, writing on X: "Code red." As Madison Mills reported for Axios, 

the AI companies and the banks are scrambling for "day after" planning, fully anticipating a bigger cyber hit in coming months. 

People at top AI companies tell me the chances are far north of 50%."

"CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached."

(That means its so bad 

they dont wanna tell you

how bad it is.)

"And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long."

Cause that was just 

all over everybodys social media

and news feeds yesterday right?

I dont go looking for them

they just fall in my lap.