This week
It’s been a busy week. Lots of stuff is going on, and even checking things takes time. I hope you’ve had a chance to take some time this weekend.
- Scramble to patch critical PHP vulnerabilities
- Certificate authority’s trivial private key
- ICO reprimand for use of ‘Password1’
- FCA mandates reporting AI incidents and near-misses
Interesting stats
86.6% accuracy on low reasoning with GPT-6.1 (5.4% GPT-5.6) for COBOL migration evaluations, increasing to 97.7% on high reasoning, says OpenAI, potentially opening the doors for easier migration of legacy languages that power many ATMs and other financial services systems
600 organisations have been breached by the SafePay ransomware gang since August 2024, according to the FBI and German law enforcement
$4.4 million is the size of the average insurance claim in 2025 for businesses with >$1B revenue, 2x what it was in 2024, and 5.7x up on 2021, while the frequency of claims was 10/100 in 2025, down from 14/100 in 2024, according to the US National Association of Insurance Commissioners.
Five Four things
-
Pretty huge problem? Earlier this week, the ‘Internet was set on fire’ by word that there were two critical vulnerabilities in PHP, the popular programming language. Web admins and hosting providers scrambled to patch the issues — CVE-2026-109618 and CVE-2026-109619, dubbed *PHP2Shell — as reports started circulating of active exploitation by a variety of threat actors and national CERTs, and Cydea issued advisories. So while stories about websites being taken offline grab headlines, this is a good thing. Those sites know that they’re vulnerable and are doing something about it! The PHP programming language is believed to be behind over 70% of the world’s websites (though partly due to the popularity of WordPress, which accounts for 43% of sites alone). This can, and probably will, crop up in many other places. Time will tell whether the ‘messy’ vulnerability disclosure put organisations at risk, or got the attention the matter needed to avoid extensive carnage. But as the dust settles (and the world carried on turning), what’s interesting is that the PHP team has known about one of the vulnerabilities since 2024, when it was discovered during an external security audit. Disagreement over maintaining backwards compatibility, coupled with the “lack of a known path” to exploitation, repeatedly stalled fixes. With AI being pointed at popular code bases like this, I doubt it will be the last scramble we face.
-
4, 56, 66, 115, 155, 156, 230, 237: No, not the Lost numbers. These are the private keys of eight intermediate certificates belonging to eMudhra, an Indian root certificate authority (CA). These are, well, very weak keys to use as a CA, since knowing them lets you generate and sign your own certificates for sites and apps. While a typical CA may use private keys with 116 digits and 384 bits of entropy, eMudhra’s setup produced keys with between 3 and 8 bits of entropy. I love the idea that the research that found this was jokingly seeing if they could brute-force a key, milliseconds later thinking, “wow, that was quick!” eMudhra says the keys stem from a “flaw in one step of the ceremony procedure” that generated them back in April 2025. Presumably something was misconfigured, or truncated in some way, and nobody noticed the long string of 000s. While browser-based attacks will likely no longer work, as all major browser vendors have blocked the offending certificates, there’s a long tail of devices, like IoT and some embedded Linux variants, that may remain vulnerable as they ship with root certificates and aren’t routinely updated. eMudhra announced it’s withdrawing from the certificate business following the debacle, adding the services accounted for only around 1% of the company’s revenue.
-
Password1: The ICO has reprimanded Ogi Networks Ltd (ONL) and Data Cymru (the Local Government Data Unit — Wales) for a breach affecting 3,330 people, many of whom were children. The Breach occurred on 1st November 2024 and was possible because of a litany of basic cyber hygiene failures: an account called “Test2”, created in 2012, with the password “Password1” allowed the ransomware gang access to systems, and administrator passwords were the same across systems, allowing them to pivot. The service had been provisioned 12.5 years earlier, before GDPR, hence the limited enforcement action. No contract was in place containing the necessary data protection terms; clearly, no effective user access reviews took place; and multi-factor authentication was not enabled on the remotely accessible systems.
-
The UK’s Financial Conduct Authority says incident reporting rules “must extend to significant AI failures and near-misses”. Jessica Rusu, FCA Chief Data, Information and Intelligence Officer, made the remarks at a Bloomberg policy event, reinforcing customer-centricity, the importance of governance, and operational resilience. Rusu also explained how the FCA was changing to become an ‘agentic regulator’.
In brief
-
OpenAI agents disabled alerts to security staff and removed a monitoring system designed to detect misbehaviour, and lied to OpenAI staff about the second incident. This is less about malice — the instructions and privileges afforded to the agent were interpreted as permission to weaken the security arrangements — but highlights the so-called ‘misalignment’ between the model and human intent. It’s best to preserve the integrity of monitoring systems by not allowing the subject to alter the system itself.
-
Earlier this month, 333 Tor exit nodes were compromised for three days and modified to redirect SSH traffic to twelve attacker-controlled servers, and block encrypted mail ports. Tor users who ignored warnings that their server’s SSH details had changed, or configured mail to retry on unencrypted ports, may have had their credentials or plaintext mail intercepted. The attackers’ identity is unknown.
-
Multi-national grocery company Ahold Delhaize suffered disruption at most of its US and European brands after taking IT systems offline following a cyberattack earlier this month. While websites and apps were offline, physical stores remained open and “the investigation hasn’t uncovered any evidence to suggest the miscreants stole any “sensitive customer, associate, or partner data”.
-
Sticking with retail, in 2023, a Chinese criminal gang gained access to internal Staples IT systems and issued over 15,000 gift cards valued at more than $5 million. In some cases, within an hour of issuance, gang members would arrive at Target or Sephora stores to redeem the gift cards, buying goods that would then be shipped back to China. Court documents show they ultimately used 4,630 gift cards totalling around $425,000.
-
Staffing and recruitment business Bullhorn took its platform offline “to contain the [cyber incident] while we investigate further”. The company has engaged CrowdStrike and advised that API tokens, client secrets, and non-SSO passwords will need to be rotated. It sounds like a comprehensive compromise, and a lot of personal data may be exposed, given more than 10,000 customers use its staffing and hiring products.
-
LiteLLM says its release pipeline was compromised and used to distribute infostealer malware via the project’s PyPI package and Docker images. Security tooling spotted the issue within 6 minutes.
-
No silver lining: Railway, an ‘all-in-one’ cloud platform designed for developers, is urging all users to rotate API and cloud keys following a cyberattack. Zeabur, a similar developer platform, has announced it will shut down its services in December following a second incident in as many months. This second incident, caused by leaked credentials stored in plaintext, allowed attackers to steal 3.2 million environment variables from over 321,000 customer accounts. “The admin tokens had no expiry, had not been rotated since they were created in January 2024, and were not included in the post-August [first incident] rotation,” the company explained in a statement.
-
Japanese media giant Nikkei is not having a good month, disclosing its third data breach, this time exposing 1.83 million records. Nikkei says 1.68 million of those records contained no identifiers, while 150,000 contained at least one of full name, email, postal address, phone number, or date of birth.
-
Microsoft says the Chinese Storm-0940 threat group is behind the supply-chain attack against ConnectWise, which resulted in disruption to the firm’s Cloud Backup service. Microsoft says the campaign used the ARTEX agentic AI pen testing framework to automate and accelerate its password-spraying campaign, which peaked at over 2,900 failed logon attempts a minute and 151,000 total observed attempts.
-
GitLab has patched a maximum-severity unauthenticated remove code execution vulnerability affecting all versions of its software dating back twelve years (CVE-2026-110264; 10/10; advisory).
-
HPE has patched eight maximum-severity authentication bypass and code execution vulnerabilities amongst thirty-two critical issues in its ArubaOS software used on Aruba networking equipment (various CVEs; 10/10; advisory).
-
Google has updated its privacy policy, allowing it to show personalised ads based on your files, email, and photos where “you choose to make data from [Drive, Gmail, or Google Photos] available”. For example, allowing Google’s Gemini AI assistant access to your inbox would allow that data to be used to show targeted ads within Gemini.
-
The European Union has opened an investigation into Booking.com to understand if the travel broker is doing enough to prevent scams on its platform. Fake listings have become increasingly common as the platform has grown in popularity, as have attacks against legitimate properties, where attackers compromise hotels and demand additional charges from customers; these attacks can be very convincing because attackers have all the booking information.
-
New Mexico says Facebook-owner Meta must pay $25 billion for privacy violations relating to the Cambridge Analytica scandal that occurred 10 years ago. Meta plans to appeal the court ruling.
-
Web traffic and bot protection company Blackwall has raised $100 million Series C at a $2.2 billion valuation, expanding its bot protection solutions sold via channel partners.
And finally
- Interpol’s Operation Serengeti III has led to the arrest of 1,462 suspected cybercriminals and seizure of $105 million. The operation, which involved collaboration between twenty African countries and the US, targeted gangs conducting ransomware and business email compromise attacks.