No time to PHP around.

The briefing opens with the risk surrounding PHP, the widely used open-source language behind server-side functions on sites and platforms such as WordPress, Drupal, Joomla, and Magento. PHP maintainers say they plan to issue emergency patches for two potentially critical flaws, each rated 9.2. The warning follows leaked but unverified details about an exploit called PHP2Shell, reportedly capable of executing code on affected servers. Watchtower says it confirmed the vulnerabilities are real, while Sansec researchers warn that attacks could begin within minutes after the patches are released. One researcher estimates that 1.3 million internet-connected hosts could be affected. Administrators are urged to inventory PHP applications, prepare backups, and schedule emergency maintenance windows before the patches arrive. The segment presents the vulnerability as a potential web-wide incident because of PHP’s enormous footprint, rather than as a problem limited to a single vendor or product.

Researchers found eight intermediate digital certificates belonging to India-based certificate authority eMudra whose private keys were extraordinarily weak, containing only about 3 to 8 bits of entropy. Because intermediate certificates can issue additional certificates trusted automatically by browsers and applications, attackers could potentially use them to impersonate almost any website. One researcher called the situation “bonkers.” Major browsers and several applications have blocked the certificates, and the briefing says there is no current evidence that attackers exploited them maliciously. The broader cleanup may nevertheless take years because vulnerable certificates could exist on Linux systems, embedded devices, forgotten servers, and Internet-of-Things equipment. Cryptography expert Filippo Valsorda compared the recovery effort with Heartbleed in 2014 and suggested this could be even more complicated. The immediate concern is interception of encrypted traffic, particularly VPN connections, if an attacker can position themselves between communicating parties. Most modern browsers have protections, although Edge on Windows 10 reportedly remained vulnerable in some circumstances. The incident is used to illustrate that Internet-wide encryption depends not only on cryptography but also on the certificate authorities trusted to issue credentials.

Federal investigators looking into the Shiny Hunters hacking group are examining executives at two ransomware-negotiation firms. According to Krebs on Security, authorities believe an executive at a major U.S. consulting firm helped operate the group’s extortion website, which pressured nearly 100 victims to pay ransoms. Canadian cybersecurity executive Edward Dubrovsky has also been arrested on extortion-related charges. Investigators reportedly found communications connecting Dubrovsky and other negotiators to Shiny Hunters after Dutch police arrested a suspected group member and accessed Signal messages. The allegations remain under investigation, but they raise a specific concern about conflicts of interest in the negotiation business: some firms charge fees based on ransom size, potentially giving them a financial incentive that aligns more closely with criminals’ demands than victims’ interests.

A joint advisory from U.S., German, and British authorities says the SafePay ransomware group has compromised at least 600 critical-infrastructure organizations worldwide since emerging in August 2024. SafePay is described as one of 2026’s most active ransomware operations, with victims across four continents. The group reportedly enters through stolen credentials, brute-force attacks, vulnerable VPNs, and exposed network devices. After gaining access, attackers escalate privileges, move laterally with legitimate administrative tools, disable security software, steal data, and encrypt systems. SafePay uses double extortion: it demands cryptocurrency for decryption tools while threatening to publish stolen information, and it reportedly calls victims directly to increase pressure. Authorities are urging organizations to improve defenses against the group’s expanding operations.

The United States has barred Chinese AI startup DeepSeek from federal civilian agency systems. The Department of Homeland Security says DeepSeek’s China-based infrastructure could expose sensitive U.S. data to Chinese authorities; Beijing condemned the restrictions and warned of possible retaliation, adding to existing U.S.-China technology tensions. Separate research by cybersecurity startup Hirondu examined Alibaba’s Qwen3 Coder model and found that it generated more exploitable applications for American defense contractors than for Chinese contractors: 70% of U.S.-contractor applications were vulnerable, compared with 59% of Chinese-contractor applications. Code created for a Hong Kong democracy advocacy group was also more likely to leak secrets. Hirondu says the differences disappeared after researchers modified the model to remove what they characterized as Chinese Communist Party political alignment. The reported result is that AI coding assistants may produce security risks shaped by their training and underlying behavior, not merely by the user’s technical request.

Accenture, Dragos, and the SANS Institute are launching the nonprofit Community Cyber Resilience Foundation with $10 million in funding. The initiative initially plans to help as many as 500 smaller U.S. water, wastewater, electric, and natural-gas utilities by providing cybersecurity technology, hardware, deployment assistance, and training at no cost. The program follows a surge of attacks affecting more than 100 American water systems across over a dozen states. Eligible utilities must have annual revenue below $100 million, a threshold the briefing says covers more than 50,000 organizations nationwide. Participants will receive Dragos security technology, Accenture implementation support, and SANS operational-technology training. The sponsors describe the effort as a response to the gap between large infrastructure operators and smaller utilities coping with limited budgets, aging equipment, and staffing shortages.

Robert Wayne Bowling Jr., a 45-year-old American, pleaded guilty to orchestrating an identity-theft operation that targeted thousands of U.S. servicemembers and veterans. Prosecutors say Bowling operated from the Philippines between 2014 and 2019, using stolen personal information to access bank accounts and steal money and veterans’ benefits. The operation allegedly obtained sensitive records from a former U.S. Army medical-records contractor stationed in South Korea. Dozens of money mules in the United States received stolen funds and transferred portions of the proceeds to the Philippines. Bowling was deported to the United States and arrested in May. Two accomplices have been sentenced, while two others remain fugitives. Bowling faces up to 40 years in prison for conspiracy to commit wire fraud and money laundering.

Host Dave Bittner interviews Leo Scott, managing director of DataTribe, about the organization’s upcoming Cyber Innovation Conference and ninth annual DataTribe Challenge. Scott says DataTribe previously held the challenge alongside a one-day Cyber Innovation Day, but this year expanded to two days through a partnership with DMV Rising. DMV Rising will run the October 26 agenda, while DataTribe will run October 27, culminating in the afternoon challenge. The second day is centered on startups and cyber innovation, reflecting DataTribe’s focus on very early-stage cybersecurity companies and its goal of strengthening the Washington, D.C.-area ecosystem while attracting attendees from outside the region. After collecting submissions throughout the summer, DataTribe received many hundreds of applications and selected five finalists: Charlemagne Labs, Layer 5, Navasana AI, Sondera, and Spotlight Security. Scott confirms that AI was a common thread, but says the most interesting applicants were not all solving a narrowly defined AI problem. Instead, they were responding to a faster, more dynamic world shaped by AI with varied solutions. Each finalist receives coaching from a DataTribe member to refine both the live pitch and broader customer messaging. Scott expects more than 500 attendees for the challenge, including startups, cyber-focused investors, CISOs, and other executives who could become customers. He emphasizes that the invite-only format is designed to keep the audience high quality and make the event valuable beyond the competition itself through introductions and side conversations. More information is available at cyberinnovationconference.com. Bittner also discloses that N2K CyberWire is a DataTribe company and has received sponsorship, expertise, and investment from DataTribe.

The closing story concerns Brazilian electronics distributor Oderco, which says two pallets of high-end NVIDIA RTX 5090 graphics cards arrived at São Paulo’s Guarulhos International Airport and then vanished. After receiving no useful answers through official inquiries, the company took its search to Instagram and said that nothing similar had happened during its 38-year history. The missing shipment is valued at approximately $470,000, although Oderco has not disclosed exactly how many cards were in the pallets or when they disappeared. The timing is especially costly because RTX 5090 cards are in short supply and can sell for thousands of dollars each. The briefing leaves open whether the shipment was stolen, misplaced, or lost in an administrative process, with Oderco now hoping social media can help locate hardware that many people are already searching for online.