The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
Andreessen Horowitz announced on 22 October 2026 that it is renaming its digital asset investment unit from a16z Crypto to a16z Frontier. The practice, led by Chris Dixon, has raised nearly $10 billion across five funds since 2018 and backed Coinbase. The new mandate covers emerging technologies such as AI, robotics and networks connectin…
OpenAI is reportedly working on a private funding round of up to $30 billion at a $1.25 trillion pre-money valuation, led by Coatue and investors in the UAE, according to sources cited by CNBC. An earlier Bloomberg report put the figure at $1.4 trillion, and terms are still under negotiation. The UAE funding may be paired with a deal to s…
The Browser Company, now owned by Atlassian, announced on 2026-10-22 that it will sunset its Arc browser on December 22, 2026 and direct users to Dia, its AI-first browser. The company cited the rising cost of keeping a browser secure in the age of AI and said its engineering and security teams will focus on Dia. This is product and busin…
Arista Networks released security updates for CVE-2026-114625, a critical (CVSS 9.9) zero-day SQL injection in VeloCloud Orchestrator (VCO) that is being actively exploited. Any authenticated user, even with the lowest built-in Enterprise Read Only role, who can reach the VCO web interface can escalate to operator privileges and masquerad…
Node.js released security updates on October 21, 2026 for CVE-2026-111497 (nicknamed Node2Shell), an out-of-bounds write in the bundled Brotli decoder. Malformed compressed input can crash the process, leak memory or potentially give an attacker code execution. Node.js rates it high severity, and Bun is also affected. A public proof of co…
1Password launched 1Password for Agents on 22 October 2026. It lets users delegate logins to AI agents without exposing passwords or secrets to the agent. The launch coincides with an Axios report that U.S. banks are detecting agentic activity inside customer accounts and often cannot tell whether it was user-requested. The article presen…
Microsoft AI published a study in Science showing its MAI-DxO diagnostic system, which coordinates several AI agents acting as a panel of doctors, correctly diagnosed 83% of complex New England Journal of Medicine cases in simulation. Primary care doctors and general internists working alone scored 36%, though specialists and physician te…
This weekly roundup covers a cluster of breaches, critical vulnerabilities and law-enforcement actions. Bluesky confirmed more than 4,500 accounts compromised in a phishing campaign using a fake government payment offer. Zeabur will shut down after a second breach this year that exposed over 3.2 million environment variable records and da…
Indian certificate authority eMudhra will withdraw from its global SSL/TLS certificate business, its board decided on Thursday, five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. Six of the eight were TLS intermediates. Mozilla decided on October 20 to distrust the root above th…
Palo Alto Networks Unit 42 reviews the current OAuth attack landscape. Attackers are shifting from stealing passwords to stealing OAuth access and refresh tokens, which bypass MFA, survive password resets and give durable access. Unit 42 groups OAuth-based phishing into three categories: account hijacking, permission hijacking and malicio…
A new bipartisan House bill, the AI Cyber Defense Act, would direct NIST to develop voluntary industry standards and best practices for defending AI models against distillation attacks by foreign entities. The bill is sponsored by Reps. Pat Harrigan (R-N.C.) and George Whitesides (D-Calif.) and was shared exclusively with CyberScoop ahead…
Amazon has rebranded its Kindle Unlimited subscription as Kindle+, keeping the price at $12 a month and the existing ebook borrowing model. The main change is a wider audiobook catalog that includes titles narrated by AI. Authors in the Kindle Direct Publishing (KDP) program can use the free Virtual Voice service to produce AI-narrated au…
The French national CERT (CERT-FR, part of ANSSI) published a lessons-learned report on application data breaches. It states that in 2025 it tracked nearly 200 data breaches originating from web applications. In many cases the exfiltration relied on low-complexity attacker actions and did not exploit any technical vulnerability. The repor…
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care provider with more than 200 locations in 28 U.S. states, has proposed a $900,000 settlement to resolve consolidated class action litigation (In re American Renal Management LLC Data Breach Litigation, U.S. District Court for the Middle District of Tennes…
Two critical vulnerabilities in the PHP engine, collectively referred to as PHP2Shell, prompted emergency security releases on 21 October 2026 after details leaked on 20 October ahead of the planned disclosure. The UK NCSC urged organisations to identify affected systems and update immediately, and Amazon threat intelligence reported expl…
Uber and OpenAI announced an expanded partnership under which Uber's whole global workforce, about 30,000 employees, will use ChatGPT Work. OpenAI introduced ChatGPT Work in July as an enterprise-focused AI agent for corporate workflows. Uber first piloted it with 1,000 employees, about 80% of them non-engineers across finance, operations…
TechCrunch recapped the Startup Battlefield 200 cohort at Disrupt 2026. The event selected 200 startups, and Intero Biosystems won the $100,000 equity-free prize and Disrupt Cup, with Apate as runner-up. The article is event and business news with no incident, vulnerability, threat actor or malware content. The only security-adjacent item…
Railway, a cloud development platform, confirmed that unidentified attackers may have accessed encrypted environment variables and, for some, obtained the decrypted contents. These variables typically hold passwords and API keys that apps use to reach cloud storage and databases. Railway's initial analysis points to a "subset of users", b…
At TechCrunch Disrupt, three investors from Peak XV, Index Ventures and Bessemer described how founders can raise a Series A in the current market. Shailendra Singh of Peak XV called seed and venture markets the most dysfunctional he has seen and predicted a correction as soon as 2027. He cited inflated ARR figures, rounds priced at up to…
