Security
Leaked PHP2Shell flaws patched as exploitation begins
Two critical PHP vulnerabilities leaked before coordinated disclosure, and attack attempts began days before the patches landed on 21 October.
Still
Crunchy.
YESTERDAY, STILL WORTH KNOWING
PHP flaws leak and exploitation begins, Meta is ordered to pay New Mexico $25bn, eMudhra quits certificates, BioWare closes, and datacenters dominate US midterm ads.
PHP flaws leak, patching scrambles
Two critical vulnerabilities in PHP, the software that processes most web requests, were patched on Wednesday 21 October 2026 after technical details leaked online ahead of planned coordinated disclosure. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 out of 10 on the CVSS severity scale and, according to CERT-EU, could be exploited without authentication. Both are memory-handling errors in the PHP runtime itself, so updating website code or plugins does not fix them; administrators must update PHP or ask their hosting provider to. PHP developer Gina Peter Banyard said patching is the only mitigation.
Amazon says it observed an exploitation attempt on 17 October, four days before the patches, and that the flaws are now being broadly exploited in the wild. Cloudflare reported attackers mutating payloads to try to bypass its firewall rules. With PHP estimated to power around 70 percent of websites, Wordfence warned every WordPress site is exposed. The NSA and the UK's National Cyber Security Centre urged organisations to patch immediately or take systems offline, and some European governments reportedly did just that: Belgian, Dutch, Finnish, French and German sites were among those taken down, along with UK councils including Edinburgh, Bristol and Oxford. Games were caught up too: Final Fantasy 14 temporarily disabled new logins, Umamusume: Pretty Derby went fully offline, with its developer saying no exploitation had occurred, and Path of Titans developer Alderon Games took the dinosaur MMO down for up to three days, saying no data had been compromised. The flaws, hidden for over a decade, were found by researchers at Calif and Wiz with help from AI tools, and OpenAI called them one of the most impactful security issues in recent memory.
Meta's $25bn bill and a certificate authority bows out
A New Mexico judge has ordered Meta to pay $25bn after a jury found the company misled consumers in a lawsuit stemming from Cambridge Analytica, the British consulting firm that harvested data from as many as 87 million Facebook users. Judge Francis Mathew found state law warranted more than $219bn, based on over 43 million violations, but Meta had urged a $3.45bn cap. The verdict lands amid a costly stretch: Meta recently agreed a $17bn settlement over allegedly addictive products harming children, and its quarterly net income came in well below expectations because of a $9.9bn settlement payment, even as revenue rose 26% to $64.6bn.
Indian certificate authority eMudhra is quitting the SSL/TLS certificate business after researchers found eight of its intermediate certificates had trivially weak private keys, one literally the number 4, potentially letting attackers impersonate websites. Chairman V. Srinivasan said the unit contributes only about 1 percent of revenue; Google is investigating whether its remaining certificates should stay in the Chrome Root Store.
BioWare closes and datacenters become campaign targets
BioWare, the influential RPG studio behind Dragon Age and Mass Effect, closed suddenly, with roughly 400 EA staff losing jobs and Eurogamer reporting Mass Effect 5 cancelled. Former staff and rivals paid tribute, with Warren Spector calling the closure 'utter bullshit', while former executive producer Mark Darrah suggested EA might sell or 'bury' BioWare's intellectual property.
Guardian reporting finds over 150 US midterm campaign commercials targeting datacenters or the AI industry, with the tech industry and its leaders spending over half a billion dollars influencing 2026 elections. At least 20 governor candidates are calling for datacenter moratoriums, per MultiState, and a Pew poll found only 4% of US adults think datacenters will be good for the environment or home energy costs.