Cybersecurity Today

PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619)
In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks.
He explains the shared root cause involving corrupted memory after abnormal request termination, outlines the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35), and notes no official updates for PHP 8.1 and older beyond limited source backports. Mitigations and Cloudflare WAF rules are described as partial, with patching urged by the UK NCSC.
The episode details AI-assisted discovery and coordination via OpenAI's Patch the Planet and tools from Wiz, how leaks on Hacker News accelerated disclosure, and reports of early in-the-wild exploitation attempts, outages, and expectations of rapid exploit development, web shells, and a long tail of downstream patching challenges.
00:00 PHP2Shell Emergency Alert
01:32 What The CVEs Do
02:05 Patches And Mitigations
03:40 AI Discovery And Leak
05:32 Exploit Chatter Spreads
06:46 Early Impact And Outages
08:22 Exposure By The Numbers
09:53 What Happens Next
11:50 Wrap Up And Thanks

Staples Gift Card Hack, Nikkei's Third Breach, Burger King Japan Leak, Broadcom Wi‑Fi "Foreverday," and Ledger Spy Implants
Host David Shipley covers a Chinese crime ring that breached Staples by abusing heap dump requests to hijack customer service sessions, issuing over 15,000 gift cards worth more than $5 million and redeeming thousands at retailers before merchandise was shipped to China; three Chinese nationals were sentenced and DOJ says the wider ring obtained over $100 million in gift cards.
The episode also details Nikkei's third breach in a month, where stolen credentials exposed 1.83 million cloud records, plus prior incidents involving compromised Google Workspace and Microsoft 365 accounts.
Burger King Japan reports attackers accessed its app server and stole 11 million customer records.
The show highlights an unpatched Broadcom WPS flaw enabling nearby root code execution on vulnerable routers, and Ledger-confirmed hardware wallet implants from a reseller designed to steal seed phrases over LTE.
00:00 Today's Cyber Rundown
00:30 Staples Gift Card Heist
02:20 Nikkei Breach Trio
03:42 Burger King Japan Leak
05:23 Broadcom WiFi Foreverday
07:27 Ledger Wallet Spy Implant
09:16 Wrap Up And Sign Off

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency
Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins.
A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts.
Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764).
Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts.
00:00 Top Stories Preview
00:34 ConnectWise Backup Breach
02:54 Bankruptcy Courts Outage
04:37 Phishing Markets Takedown
06:28 Romulus Malware Platform
08:54 BeyondTrust Zero Day
11:28 Japan Cyber Emergency
13:06 Wrap Up and Sign Off

ShinyHunters Arrests, Ransomware Negotiator Ethics,  Refrigerators Turned Into Ovens and UnPatch Wednesday, Part Two?
A Cybersecurity Today panel with Michael Joyce, Laura Payne, and David Shipley discusses major recent stories: the ShinyHunters gang's alleged hack of FBI personnel data and a string of arrests including a Canadian cybersecurity executive, raising ethical and legal concerns around the ransomware negotiation industry and calls for vetting or licensing. They also cover allegations that MonsterCloud charged customers for "proprietary" decryption while actually paying ransoms and skimming large margins. The group examines cyber-physical attacks after French grocery stores reportedly had refrigeration systems driven to 50°C, destroying food, with debate over motives, exposed internet-connected devices, and the need for firmware and configuration strategies. The conversation touches on AI doomerism and the Hugging Face/OpenAI incident as misdirection versus basic security failures, then ends on Microsoft's record-breaking Patch Tuesday and the emerging reality of "Unpatch Wednesday," questioning the sustainability of monthly bulk patching.
00:00 Welcome and Panel Intro
00:45 ShinyHunters FBI Hack Fallout
03:53 Ransom Negotiation Ethics
10:15 MonsterCloud Decryption Scam
14:05 Fridge Hacks Destroy Food
17:15 Why Smart Fridges Exist
21:38 Firmware Risk and Strategy
22:57 Grocery Cybersecurity Reality
25:05 Practical Mitigations for Chains
26:28 Food Chain Cyber Lessons
27:23 Grocery Ransomware Fallout
29:01 Lockout Switch Fix
29:56 AI Botnet Doom Debate
32:48 Hugging Face Missed Alarms
36:19 Centralized vs Local AI
40:29 Patch Tuesday Chaos
42:09 Unpatch Wednesday Reality
46:41 Simpler OS Future
47:44 Wrap Up and Thanks

Zero-Click Spyware Ads, Palo Alto Firewall Zero-Day, Critical Drupal Flaw, and OpenAI Bugging Charge
Cybersecurity Today Host David Shipley reports on Citizen Lab findings that Israeli spyware maker Candiru, now reportedly rebranded as Integrity Labs, used targeted online ads bought through DiscoverTech's Controlium platform to profile and, in some cases, zero-click infect Al Jazeera journalists' devices, with ad-bid records showing broad reach across nearly 200,000 sites and apps and extensive profiling of sensitive networks; Google and IAB Europe have cut off DiscoverTech.
The episode also covers active exploitation of Palo Alto Networks PAN-OS management interface zero-day CVE-2026-0322, the company's patches and mitigation guidance, and CISA adding it to the KEV catalog. The show details Drupal's critical Field UI RCE flaw CVE-2026-1080-97, noting many sites run unsupported branches with no fix.
Finally, we cover charges that an OpenAI engineer planted encrypted recording devices in an executive conference room.
00:00 Top Stories Preview
00:27 Zero Click Spyware Ads
02:08 Ad Industry Fallout
03:09 Palo Alto Firewall Zero Day
04:17 How to Patch and Mitigate
05:13 Drupal Critical RCE Risk
06:35 No Fix for Many Sites
07:26 OpenAI Meeting Room Bugging
09:46 Wrap Up and Listener Notes