Cybersecurity News: Research Digest

Date saved: 2026-10-24 15:24 (PDT)

Sources: Google Cloud, Wiz, Cyber Security News, Tech-Critter, TechSpot, Kotaku, Futurism, Design Week, The Verge, The Synth Source, AP, The Register, Brussels Times, GitHub

Key findings

Emergency patches: PHP2Shell

Google Cloud (Oct 21, 2026): CVE-2026-109618 and CVE-2026-109619, both scored 9.2 critical, let an unauthenticated attacker run code on any server answering PHP web requests; every release from PHP 5.4 through 8.5.11 is affected, fixes shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and end-of-life PHP 8.1 and older will never get one. The flaws were found by Wiz Research and disclosed with the patches. (Source)
Cyber Security News (Oct 21, 2026): Researchers demonstrated code execution against Apache mod_php before any application code even ran, Cloudflare reported early attack attempts, and proofs of concept began circulating within hours of the release. (Source)
Tech-Critter (Oct 23, 2026): Amazon Threat Intelligence detected the first exploitation attempt against its honeypot on October 17, four days before the public disclosure, and saw broader attacks begin once the fix was out. (Source)

Console security: Sony chasing its own patches

TechSpot (Oct 21, 2026): A South Korean developer, Gezine, demonstrated a kernel-level exploit against PS5 firmware 14.10, the update Sony shipped to close the "Relapse" jailbreak that works on every console from firmware 7.00 to 13.60; Sony answered with firmware 14.20 days later, and the whole chase now runs alongside GTA 6's November 19 launch, which requires the newest firmware. (Source)
Kotaku (Oct 21, 2026): Firmware 14.20 also patched a year-long exploit by the hacker Ark Sama that would have let pirated "fake PKG" files run natively. Reported through HackerOne, it can now legally be published under mutual-agreement disclosure rules, so the patch itself is what unlocks the release. (Source)

Adobe and Microsoft, re-engineered

Futurism (Oct 14, 2026): The team that open-sourced ArtCraft, a free imitation of Adobe's Creative Cloud with clones of Photoshop, Lightroom and Premiere, followed up with free copies of Word, Excel and PowerPoint: GridCraft, DeckCraft and WordCraft. The developers say they rebuilt the programs without copying code. (Source)
Design Week (Oct 7, 2026): ArtCraft pushed a suite's worth of code to GitHub in about a week; the developers describe a clean-room rebuild, while skeptics note that rebuilding from decompiled binaries would breach Adobe's license either way. (Source)

The firmware wave: music gear and other hardware

The Verge (Oct 19, 2026): Custom firmware written with AI coding assistants has exploded across Roland's SP-404 MKII, Ableton's Push 3 and Move, Akai's MPC line, Arturia's MicroFreak and more; Elektron warns that mods can brick its machines, while maker M-VAVE has embraced the scene with an official open-source firmware and a flashing toolkit. (Source)
The Synth Source (Oct 15, 2026): The M-VAVE FM-1 went from one custom firmware in late September to 63 tracked projects by October 17. The reverse-engineering project documents no ROM recovery path and the device has no recovery button, so a failed flash can leave it dead, and several builds have never been run on real hardware. (Source)
GitHub Advisory (Oct 23, 2026): CVE-2026-55981 scores 9.6 critical: the firmware verification in Creative's Sound Blaster Katana can be fooled into accepting a modified image, letting an attacker push their own firmware onto the device. (Source)

Supply chain and critical infrastructure

Wiz (Oct 21, 2026): A malicious LiteLLM 1.107.0 reached PyPI and the major container registries and drew roughly 49,000 downloads in under two hours, carrying credential stealers. The attackers used stolen GitHub CLI tokens that had leaked into logs from an internal deployment the company had accidentally exposed to the internet. (Source)
Cyber Security News (Oct 21, 2026): Eight intermediate signing keys at certificate authority eMudhra were generated with such weak randomness that Mozilla found the private keys could be recovered almost instantly from the public certificates; Chrome and Android blocked the affected certificates without a user update. (Source)
AP (Oct 13, 2026): Cyberattacks disrupted about 700 supermarkets in France, with hackers forcing refrigeration systems into continuous defrost cycles and pushing temperatures as high as 50C (122F), in the same week grocery infrastructure across Europe went under. (Source)
The Register (Oct 19, 2026): Ahold Delhaize, parent of Food Lion, Stop & Shop, Giant, Albert Heijn and Delhaize, confirmed a cyberattack forced it to take websites and apps offline across most of its US and European brands, with no evidence so far that customer, associate or partner data was stolen. (Source)
Brussels Times (Oct 19, 2026): In the Netherlands, Ahold shut its entire digital infrastructure after state broadcaster NOS reported unidentified traffic from servers in the US, Poland, Moldova and Turkey; distribution centers could not tell trucks where to go, and Albert Heijn shelves ran bare. (Source)

The emergency fixes that landed on October 21 were not a routine patch day. PHP runs on roughly seven in ten websites, the project shipped fixes for two flaws rated 9.2 out of 10 that let a stranger run code without logging in, and the institutions that usually send a gentle "apply when you can" note did the opposite: CISA told operators to patch immediately, the FBI's cyber division warned publicly, the NSA said servers that could not be updated should be taken offline until they were, and Japan's prime minister told website owners to consider suspending their sites if patching was slow. When those four move on the same day, the message is that the bug is already being used, and Amazon's honeypot data says the exploitation attempts started four days before the fix even existed.

The throughline of the week is that the attack surface is no longer a screen. Grocery distribution networks went dark and Dutch shelves ran bare. Home media servers were chained through four separate bugs into crypto miners. Eight signing keys at a certificate authority turned out to be generated so sloppily that anyone could recover them and mint certificates browsers would trust. The compromises landed in the plumbing underneath ordinary services, which is exactly where ordinary readers live.

The hardware story is the new one: community firmware for cheap music gear, written with AI coding assistants faster than anyone can check it. One $60 synth went from a single custom firmware in September to more than sixty by mid-October, some builds have never run on a real device, and a failed flash can leave the machine dead with no recovery path.