Cyber Recap, Week 44: PHP's on fire, Sony's bleeding, Warp tripped over its supply chain

Welcome back to the weekly recap. October refuses to stop burning, and honestly, so do we. Several corners are smoking at once this week, so buckle up.

PHP2Shell: the patch landed, and so did the attackers

The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) have half the web sweating. The PHP Foundation patched on October 21, but exploitation carried on regardless. Attackers went after internet-facing management interfaces on Palo Alto firewalls, and a suspected China-nexus crew chained it with a Linux kernel privilege escalation bug ('Fragnesia', CVE-2026-46300).

CISA added Fragnesia to its Known Exploited catalog on October 28, with a federal deadline of October 31. Three days. No pressure. Palo Alto shipped hotfixes for all affected PAN-OS versions between October 25 and 29. Your to-dos: patch, and get management interfaces off the open internet. Both, not just one.

Sony So-net: 2.58 million reasons to change your password

Sony Network Communications caught a serious data leak. Attacked on October 19, confirmed on October 23, disclosed on October 27: about 2.58 million records from its So-net and plala services, including names, contact details and user IDs.

The ugly part: roughly 54,400 email addresses came with their passwords attached, plus 16 bank account records. Sony says credit card data was not exposed and has reset passwords for the affected email services. Phishing and credential stuffing send their regards anyway.

Warp: when the AI shop catches fire next door

Warp, the AI-powered development environment, had to admit a security incident at a third-party provider. Detected on October 23 and made public by CEO Zach Lloyd on the 26th, who estimates around 1 percent of users were affected. AI agent logs and telemetry were apparently exposed. CrowdStrike is investigating.

The lesson is old and boring and still true: your supply chain is your attack surface. Use someone else's infrastructure, inherit someone else's risk.

GitHub under token fire: the Gheist campaign

Wiz Research went public on October 25 with a campaign built on stolen GitHub tokens. The tally: over 13,500 malicious branches across more than 850 compromised accounts, with rigged workflows siphoning repository secrets through the logs, including attempts to enumerate AWS Secrets Manager.

If you use CI/CD (and you do): rotate tokens, review suspicious workflow changes, and please stop printing secrets to logs.

Tailscale 'Tailworm': breathe, then update

Tailscale SSH and Serve had a privilege escalation (report published October 24): via Tailscale SSH socket forwarding, authorized users could get more privileges than intended, up to root in the worst case. No unauthenticated access, but still not great. The fix is in version 1.104.4, available since October 28 according to Tailscale. Update, restrict SSH forwarding, done.

Briefly noted

• ConnectWise Cloud Backup: Microsoft attributes the supply chain attack, which abused app identities in connected Microsoft 365 tenants, to the China-aligned group Storm-0940. App identities love to fly under the radar.
• eMudhra: eight intermediate CAs with weak keys caused by a script error. eMudhra says they never issued end-entity certificates, but Mozilla, Google and Apple blocked them anyway. On October 22, eMudhra announced it is exiting the global TLS certificate business.

That was the week. Moral, as always: patching is not a hobby, it is hygiene. Management interfaces do not belong on the open internet, tokens want rotating, and sensitive data does not belong in the first database you find without a lock on it. Turn on MFA. Think purple.