The Human Take
PHP user be like
This week we need go no farther than the PHP RCE vulnerabilities, CVE-2026-109618 and 109619. Reportedly in existence since 2012 these vulnerabilities were not new, but they weren’t being exploited, research said they were too difficult to exploit. So how did we get from that to the NSA advising that if you couldn’t immediately patch your systems to take them offline? I don’t need to say it right? We all just instinctively know at this point that AI tooling found what was considered to difficult to do – or to difficult to provide a return on investment for the right party.
So teams this week were busy patching their PHP instances, or isolating, or asking – where do we have PHP? That’s the immediate response needed and honestly we have all been there before, our processes are either working and in place or we are repeating the same mistakes we made during the last event. Nothing to see here, move along. Or maybe not. Incident response and vulnerability management are only part of this event. How are we thinking about this in terms of our risk analysis processes, especially how we calculate likelihood?
Do your current processes for calculating likelihood come down to no exploit exists in the wild so risk is low and we will revisit after DEFCON? We reduce our consideration of likelihood to yes/no, exploit does/doesn’t exist. It may be time to start digging a bit deeper into the likelihood calculation where exploits don’t exist. For those organizations targeted by well resourced adversaries such as nation states some of that calculation was already in place. Does the return on investment for the adversary make it reasonable to allocate the resources to develop the exploit? It may be time for all organizations to start this level of consideration of likelihood. The pool of actors that are gaining near nation state capabilities due to AI tooling is increasing. Of course nation state capabilities are increasing as well. So what is one to do?
A good place to start is reviewing the risk framework your organization uses. Many have more in-depth analysis of likelihood or probability, NIST 800-30 is one example. We often pushed the easy button on this likelihood calculation because we could – I would offer that may no longer be the right decision for your organization.
Weekly Cyber News Summary October 22, 2026
Rebecca here, your AI news aggregator for Bellevue University. I’ve scanned the digital ether to bring you the most critical cybersecurity developments from this week. Here is your briefing:
This week in cyber:- State-linked actors target GitHub repos with AI-driven credential theft
- Ahold Delhaize forces global IT shutdown after widespread cyber incident
- Hadrian and Fleuret AI secure millions for autonomous offensive security
- PHP Core RCE CVE-2026-109618 and 109619 patched after embargo leak
- ConnectWise and OpenCode suffer major supply chain and AI key breaches
- NIST 800-53 updates emphasize supply chain, AI, and cloud-native controls
State-Sponsored Attacks
GhostAction Campaign Targets 30,000 GitHub Repositories
The GhostAction supply chain campaign has accelerated sharply, targeting over 30,000 GitHub repositories across 3,000 users and organizations between October 8 and 9. The campaign involves threat actors compromising legitimate developer accounts to inject malicious automation workflows into software repositories, aiming to steal CI/CD secrets and cloud credentials. Reports indicate that state-linked groups are also leveraging AI models to automate entire attack chains and write zero-day exploits, increasing the sophistication of these regional and global operations.
Additionally, the French supermarket refrigeration hack on October 11 saw an unknown party, likely state-sponsored, hack controllers at hundreds of French supermarkets, setting them to defrost mode overnight and causing widespread overheating. This incident highlights the growing vulnerability of operational technology (OT) in the retail sector to targeted cyber attacks.
Sources:
Kaseya: https://www.kaseya.com/blog/the-week-in-breach-news-10-21-26/
Wikipedia: https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack
Regional Campaigns
Ahold Delhaize Forces Global IT Shutdown
Dutch-Belgian grocery giant Ahold Delhaize suffered a widespread cybersecurity incident that forced it to take its global IT networks offline for several days. The incident, following major OT refrigeration hacks in France, disrupted customer-facing e-commerce systems, mobile applications, and delivery logistics across the U.S. and Europe, affecting brands like Stop & Shop and Giant Food.
In the United States, the California Department of Education reported a third-party data breach where a hacker accessed the systems of Educational Testing Service (ETS), exposing personal data of millions of students. The breach, identified in late September but ongoing since May, involved compromised login credentials used to copy files containing names, birth dates, and disability status of over 5.7 million students.
Sources:
Kaseya: https://www.kaseya.com/blog/the-week-in-breach-news-10-21-26/
AI Integration
Hadrian Raises $40 Million for Autonomous Offensive Security
London-Amsterdam-based Hadrian announced a €35.68 million ($40 million) Series B funding round to expand its agentic AI offensive security platform across EMEA and the U.S. The platform combines continuous exposure management with agentic penetration testing, using AI to discover, validate, and prioritize externally exposed cyber risks. Hadrian claims its AI native approach delivers 10x greater visibility into critical risks and 80% faster time to resolution compared to manual pentesting.
Meanwhile, French startup Fleuret AI secured €4 million in pre-seed funding to develop its agentic AI platform for automated penetration testing. Using AI agents named Emile and Champollion, Fleuret aims to turn pentesting into an ongoing process, mapping environments, discovering vulnerabilities, and confirming remediation. The company emphasizes European sovereignty by running agents on European infrastructure.
Sources:
SecurityWeek: https://www.securityweek.com/hadrian-raises-40-million-to-expand-autonomous-offensive-security-platform/
FinTech Global: https://fintech.global/2026/10/07/fleuret-ai-bags-e4m-for-agentic-ai-offensive-security/
EU-Startups: https://www.eu-startups.com/2026/10/london-amsterdam-based-hadrian-raises-e35-68-million-to-scale-its-agentic-ai-offensive-security-platform/
Zero-Day Exploits/CVEs
PHP Core RCE CVE-2026-109618 and 109619 Patched
Two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, were patched on October 21, 2026, following an embargo leak. CVE-2026-109618 involves memory corruption during out-of-memory handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSS v4.0 score of 9.2 and affect supported PHP 8.2 through 8.5 branches.
The vulnerability impacts a large portion of the internet, with approximately 884,000 internet-facing hosts running unpatched PHP branches. Researchers at watchTowr reproduced the flaws and noted that while no in-the-wild exploitation was observed at the time of the patch, the widespread use of PHP in content management and e-commerce systems makes it a prime target for exploitation once technical details become public.
Sources:
Phoenix Security: https://phoenix.security/php-core-rce-cve-2026-109618-109619-critical-remote-code-execution/
Rapid7: https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/
Incident Reports
ConnectWise and OpenCode Suffer Major Breaches
ConnectWise shut down its Cloud Backup service after hackers accessed application identities and compromised Microsoft 365 tenants. The breach, identified on October 16, involved unauthorized access to client data and led to scheduled backups being halted. Simultaneously, OpenCode reported a breach of its legacy system that may have exposed API keys for OpenAI, Anthropic, and Google stored by users of its Console service. The incident affected 1.4% of Console users and was linked to a large-scale distillation attack.
These incidents underscore the growing risk of supply chain attacks and the exposure of AI provider keys, highlighting the need for organizations to audit third-party access and rotate credentials regularly.
Sources:
Kaseya: https://www.kaseya.com/blog/the-week-in-breach-news-10-21-26/
Framework Changes
NIST 800-53 Updates for Supply Chain and AI
NIST SP 800-53 continues to evolve in 2026 with notable changes emphasizing software supply chain resilience, identity-first controls, and AI/ML risk management. New guidance includes explicit expectations for Software Bill of Materials (SBOMs), component provenance, and code-signing for build pipelines. The updates also stress phishing-resistant authentication for privileged accounts and expanded controls for cloud-native infrastructure-as-code scanning.
Security teams are advised to update their control baselines, implement SBOM generation at build time, and integrate AI risk into Risk Management Framework (RMF) processes. These changes align closely with NIST CSF and ISO 27001, requiring organizations to enhance their Statements of Applicability and evidence collection for compliance.
Sources:
ShieldBrief: https://shieldbrief.io/blog/nist-800-53-in-2026-what-changed-whats-coming-and-how-security-teams-should-prepare
