Cyber Incidents USA 2026-27

[sharon sanders]

AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk​

Updated Oct. 21, 2026 at 6:05 pm ET
First, artificial intelligence heralded the Bugmageddon. Now it is triggering an all-hands-on-deck cyber emergency.
The creators of PHP, a technology that powers as much as 70% of the world’s websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software. That would allow an attacker to steal information or launch a cyberattack on anyone visiting a hacked website.

Copyright

https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea

FluTrackers installed the fix yesterday as soon as we were notified. Hat tip again to linuxkidd.

 

[Commonground]

Alert Number: I-102326-PSA | 23 October 2026

Critical Vulnerability Alert: PHP Core​

---

In a follow on to the FBI's initial social media posting on October 21st regarding the identified PHP vulnerabilities, the FBI is sharing this PSA to continue to warn the public of the criticality and necessity to take steps to protect any affected networks from these known vulnerabilities. PHP is a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected.

The FBI urges organizations to take the following steps now:

• If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
• Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
• Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

The FBI urges organizations to take the following steps now:

• If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
• Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
• Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

Report It​

If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or www.ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP's announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA's Known Exploited Vulnerabilities catalog. In addition, CISA released the following guidance, which can be found here. https://www.cisa.gov/news-events/al...ulnerabilities-php-require-immediate-patching

Internet Crime Complaint Center (IC3) | Critical Vulnerability Alert: PHP Core

 

[sharon sanders]

Sam Altman, Co-Founder and CEO of OpenAI: Staying Human While Scaling Superintelligence

zhttps://www.youtube.com/watch?v=anAmTGcewX8&t=1326s

 

[Commonground]

CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security​

CISA 2030: Defend, Harden, Prevail
Released
October 26, 2026
[emphasis is mine]

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) today released its new strategy, CISA 2030: Defend, Harden, Prevail, which advances President Trump’s Cyber Strategy for America and National Resilience Strategy while strengthening the security and resilience of the nation’s critical infrastructure.

The strategy addresses an increasingly complex threat environment, strengthens national cyber defense, and prioritizes the infrastructure most essential to America’s national security, economy, public health, and safety.

The threat landscape is evolving at an unprecedented pace. Nation-state actors and other malicious adversaries are becoming increasingly sophisticated in their attempts to compromise U.S. networks. CISA is strengthening national cyber defense through decisive, proactive action to identify, disrupt, and eliminate adversarial access while hardening critical infrastructure against emerging threats.

“I call on every company and organization in the critical infrastructure community—from owners and operators to vendors and technology manufacturers—to act now,” said CISA Acting Director Nick Andersen. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”

CISA 2030 is guided by three pillars:

• Defend: Lead National Cyber Defense;
• Harden: Prioritize National Infrastructure Security, and
• Prevail: Mobilize National Resilience. Under the strategy, CISA will strengthen security across the interconnected physical and cyber dimensions of critical infrastructure.

The strategy also reaffirms CISA’s role, as delegated by the Department of Homeland Security, in leading the initiation and restoration of National Security and Emergency Preparedness communications, which are essential to maintaining continuity of government and public safety during crises.

The strategy recognizes that cyber, physical, and geopolitical threats increasingly intersect and can disrupt essential services Americans rely on every day. CISA will work with public- and private-sector partners to strengthen the security and resilience of operational technology, advance software security, support secure emerging technologies, and improve continuity of National Security and Emergency Preparedness communications.

In alignment with Cyber Strategy for America, CISA will move from a passive defense posture toward an aggressive, anticipatory stance focused on identifying, mitigating, and reducing malicious access to critical infrastructure. The agency will also improve its ability to prioritize risk, mobilize partners, and support rapid, coordinated action when threats emerge.

The strategy sets out CISA’s priorities for the coming year:

• Within 60 days, CISA will begin reviewing its core services and capabilities to meet key objectives.
• Within 180 days, CISA will provide a plan to implement the strategy and measure its results.
• Within 365 days, CISA will report on its progress in carrying out the strategy.

CISA 2030: Defend, Harden, Prevail delivers a clear, decisive roadmap for advancing the agency’s mission and strengthening the security and resilience of the nation’s critical infrastructure in service to the American people.

CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security | CISA

www.cisa.gov

 

[Commonground]

(TLP:CLEAR) Vulnerability Notification – Critical PHP Vulnerabilities “PHP2Shell,” Immediate Action Required (Updated October 29, 2026)​

Created: Thursday, October 29, 2026 - 15:55
Categories: Cybersecurity, Security Preparedness

October 29, 2026

Summary: CISA released an alert on October 23 and updated it on October 26 to provide a SIGMA rule organizations can use to help identify potentially suspicious activity, incorporate partner resources, and reinforce existing mitigation guidance. WaterISAC encourages members to review CISA’s “Actions to Take” and make use of the SIGMA rule where able.

Original Source: https://www.cisa.gov/news-events/al...ulnerabilities-php-require-immediate-patching

October 21, 2026...

-snip-

These vulnerabilities are particularly concerning for utilities because PHP underpins many internet-facing services, including public websites, customer and payment portals, content management systems, business applications, and hosting control panels. PHP may also be embedded in third-party products and appliances that are not directly managed by internal IT teams. Successful exploitation could allow attackers to deploy webshells, steal sensitive information, and establish a foothold for further intrusion into utility networks.

Continued: https://www.waterisac.org/vulnerabi...php-vulnerabilities-immediate-action-required

 

[Commonground]

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – October 29, 2026​

Author: Chase Snow
Created: Thursday, October 29, 2026 - 15:40
Categories: Cybersecurity, Security Preparedness

he below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
Continued: https://www.waterisac.org/tlpclear-weekly-vulnerabilities-to-prioritize-october-29-2026

 

[Commonground]

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say​

Oct 29, 2026
By Raphael Satter, AJ Vicens and Phil Stewart, Reuters

The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.

One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.

Continued: https://www.militarytimes.com/penta...tions-as-suspected-cyberattack-officials-say/

 

[Commonground]

Oct. 29, 2026

Chinese hackers used DeepSeek and other AI tools in sweeping global cyberattacks, report finds​

Chinese state-linked hackers targeted more than 200 organizations in just 11 days, using AI to attack governments and businesses worldwide, according to CrowdStrike.

...https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343

 

[Commonground]

CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026​

Released November 02, 2026
WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) kicks off Critical Infrastructure and Resilience Month today, recognizing the systems and assets that keep the country running as well as the people who operate them. This year’s Critical Infrastructure Security and Resilience Month aligns with President Trump’s National Resilience Strategy and comes as we continue to see new and evolving threats, including those driven by rapid advances in technology like super intelligence. Through it all, we rely on frontline operators who keep essential services moving even when things are disrupted.

“Our work depends on people who understand their systems and stay prepared,” said Acting CISA Director Nick Andersen. “Resilience comes from knowing what matters most and having a plan you can actually use when something goes wrong.”

All month, CISA will highlight four practices that help infrastructure owners and operators stay prepared:

1. Know your most important systems and the outside services they depend on
2. Understand the risks that matter most to your organization
3. Make clear plans that guide response and recovery
4. Track progress and update plans based on real lessons learned

As threats continue to emerge, it’s imperative that everyone does their part to be more resilient. Strong resilience in critical infrastructure helps protect lives and jobs, keeps communities connected, and reduces disruptions. Critical Infrastructure Security and Resilience Month empowers American industry, state and local governments, and the Federal Government to each do their part to protect our nation’s security, prosperity, and freedom.

Organizations can participate in Critical Infrastructure Security and Resilience Month with CISA’s toolkit, which includes graphics and plain language text that organizations can use to show the steps they are taking this November to be more resilient.

CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 | CISA

www.cisa.gov