BTH News: October 22, 2026
Two critical PHP vulnerabilities, a 16-year-old Wi-Fi flaw, AI agents attacking websites at scale, and certificate-authority keys so weak they were practically guessable. Here’s what caught my attention in cybersecurity this week.
The common thread is not novelty. It is exposure: forgotten systems, trusted software, and automation moving faster than defenders can inventory what they actually run.
Two Critical PHP Flaws—and the Systems Nobody Remembers
On October 21, the PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619. Both are critical, rated 9.2 under CVSS 4.0, and can allow unauthenticated remote code execution. The PHP team says all installations serving web requests may be at risk, with the highest demonstrated risk in Apache mod_php. There is no complete workaround: installing the patch is the only safe choice.
Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older are no longer supported, although some distribution and long-term-support vendors may provide updates.
The urgency spilled well beyond security teams. Britain’s NCSC advised organizations that could not patch immediately to consider taking affected systems offline, while government services in Finland and several other countries were temporarily shut down as a precaution. Those outages were not evidence that every system had been compromised; they showed how seriously operators treated the window between disclosure and patching.
The hard part is not reading the advisory. It is finding the servers.
That is where a security problem often becomes an archaeology project.
A widely shared post from IT Unhinged captured the scene perfectly: the emergency inventory turns up a forgotten WordPress site, an old tool under someone’s desk, a server marked “DO NOT TOUCH,” and a PHP 5.4 system that nobody owns but that somehow still prints the warehouse labels.
It’s satire, but anyone who has worked in IT for a while has met that server. Maybe not the label printer, exactly, but something just as fragile, mysterious, and business-critical.
So yes, patch quickly. But do not let the 9.2 score make every system look equally urgent. Ask three questions first: Is it facing the Internet? Does it contain sensitive data? Can it reach systems or data that are sensitive?
A vulnerable public WordPress site is a much bigger risk than the exact same PHP version inside an isolated development lab used by a few people. Start with the systems an attacker can reach and the systems that can take an attacker somewhere valuable. Then confirm the version is actually running in production, not the version the inventory says should be there.
I wrote more about that distinction in Vulnerability Prioritization: Fix What Matters First. The short version: update, restart, verify the running version, and keep looking for the systems nobody remembered to put on the list.
Read more: PHP’s security release notice, the OOM-corruption advisory, and the stale-state advisory.
A 16-Year-Old Broadcom Wi-Fi Flaw Is Still in Routers
The router in the corner may be quiet, but that doesn’t mean it has stopped aging.
Security researcher Quentin Kaiser found a flaw in Broadcom’s legacy Wi-Fi Protected Setup implementation that dates back to at least 2010. An attacker within wireless range may be able to trigger it without knowing the network password or completing WPS enrollment, potentially leaking information or running code on the router.
That “within wireless range” detail matters. This is not the same as an attacker anywhere on the Internet reaching every Broadcom-powered router. But old networking code has a habit of lingering. Broadcom began replacing the affected component in newer software in 2018, while vulnerable code remained in deployed devices. Kaiser confirmed affected equipment at three Belgian Internet providers and estimates that millions of access points from multiple vendors may be impacted.
The chip alone does not answer the question; the exact firmware does. There is no CVE, and switching off WPS in the settings may not stop the vulnerable parser. Ask the router vendor or your Internet provider whether your exact model and firmware received the fix. If the device is unsupported and cannot be updated, it is time to replace it.
Read more: Kaiser’s technical research and disclosure timeline and the WPSplinter public documentation.
One Hacker, 1,200 Targets, and an Army of AI Agents
We spend a lot of time talking about how AI can help defenders. This is the other half of that conversation.
An attacker reportedly used the open-source Cairn AI orchestration platform to probe more than 1,200 websites and gain access to sites belonging to more than 100 companies. Security researcher Snorre Fagerland was able to watch the activity because the operators had accidentally exposed their own Cairn control panels to the Internet. There is a certain irony in that, but the larger story is scale.
The attacker gave the agents short objectives and let them gather information, map related infrastructure, test weaknesses, and attempt commands. The human still chose the targets and the goal. The agents made the familiar work faster, cheaper, and repeatable across hundreds of sites.
And “cheaper” is doing a lot of work in that sentence. Fagerland estimated that the entire campaign cost about $5,000 in AI tokens—roughly $50 for each successful compromise. That is not a confirmed invoice, but even as an estimate it changes the economics. An attacker no longer has to choose between careful, skilled work and broad automation. For about the cost of a decent laptop, this one appears to have done both.
This is not a reason to throw out the defensive playbook. It is a reason to execute it faster. Know what is exposed, log service and application activity, patch the reachable paths first, and make repeated automated probing noisy enough that somebody notices.
Read more: Tom’s Hardware’s report based on the Reuters investigation and SecurityWeek’s coverage.
The Certificate Authority Keys That Were Basically Guessable
Certificate authorities sit near the center of Internet trust. When your browser shows the padlock, it is relying on one of these organizations to vouch for the certificate presented by the website.
So it is difficult to overstate how bad it sounds when a certificate authority’s private keys can be recovered by trying numbers smaller than 256.
On October 17, a security researcher reported that the private keys behind eight intermediate certificates operated by India-based eMudhra had been compromised. The keys had not simply been stolen. The P-384 private values were tiny integers, effectively all zeroes except for the final byte, which meant they could be recovered almost instantly from the public certificates. Mozilla independently reproduced the result without being told how the researcher had done it.
Six of the affected intermediates could issue TLS certificates. In the wrong hands, those keys could have been used to create fraudulent certificates for websites the attacker did not control, the digital equivalent of being able to print convincing passports for anyone.
The response was fast. Chrome and Mozilla blocked the affected certificates, eMudhra revoked all eight, and Mozilla removed the issuing root from its trust store to protect users who might not receive browser revocation updates. Chrome also found no certificates chaining to the six TLS-capable intermediates in Certificate Transparency logs before they were blocked. That does not prove the keys were never abused, but it sharply limits what would have worked in modern browsers.
This does’t mean the browser padlock is suddenly meaningless. It means the padlock depends on a long chain of organizations, hardware, software, ceremonies, and human checks working as intended. Here, an error in that chain produced keys so weak that “private” was more of an aspiration than a technical fact.
Read more: Mozilla’s incident announcement and response guidance and the public technical investigation.
BTH News is a roundup of interesting cybersecurity stories, technology developments, and occasional oddities from around the world. Thanks for reading!
Enjoyed this article?
Subscribe to Between The Hacks for practical cybersecurity, real-world stories, and fresh perspectives on the technologies shaping our digital future.
