Topics
Global Security news gathered by Explorineer every day, rewritten as plain-language explainers.
Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.
Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.
AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.
Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.
Louisiana resident Leslie Pickett spent months chatting with a scammer posing as rock star Jon Bon Jovi, who used AI-generated photos and videos to gain her trust. The story is featured in National Geographic's documentary Super Scam Me, where journalist Mariana van Zeller investigates online scams.
GMO Internet Group said hackers stole account credentials from servers for its FX auto-trading service, leading to unauthorized trades at more than 70 brokerages and FX firms in Japan and abroad. GMO announced a compensation plan on the 24th and asked the government for active cyber defense support, while Japanese officials said the measure is not triggered by individual company requests.
A serious security flaw in the widely used programming language PHP is, according to a expert at Germany's federal cyber agency, an example of a trend that may last for some time. Attackers can now exploit a published vulnerability within minutes or hours, while fixes are rolled out slowly and decentrally.
A new remote code execution vulnerability (CVE-2026-115560) has been found in PHP that is not fixed by the security updates released on the 21st. KISA recommends setting session.upload_progress.enabled to 0 and restarting all PHP processes until a patch is available.
Security experts warn that AI-driven discovery of software vulnerabilities could trigger a wave of security incidents and cyberattacks in the coming years. The alarm follows the public disclosure on October 21 of two PHP vulnerabilities, PHP2Shell, which were found by several independent organizations, including AI-assisted discoveries.
AhnLab took part in the cybersecurity exhibition 'Security Days Fall 2026 Tokyo' from the 21st to the 23rd in Tokyo, promoting its OT security solutions for Japan's manufacturing sector. The company showcased its cyber-physical systems (CPS) integrated security approach, including the AhnLab XTD network security and AhnLab EPS endpoint security products. It also appointed Tsubaki Yoji as the new country manager of its Japanese subsidiary to expand local business.
Network performance analytics firm Rampad plans to add a new security analysis feature to its AI LAMPAD solution by integrating Group-IB's indicators of compromise (IOC) intelligence. The feature compares IP addresses, domains, and URLs in live communication sessions against IOC data to flag threats such as malicious IP connections and command-and-control server traffic. The company announced the plan on the 24th.
GMO Internet has urgently requested that government agencies classify a cyberattack on its FX VPS service as the first case of 'active cyber defense,' a framework under which the state leads efforts to neutralize attack sources. The company says users suffered financial losses after their trading accounts were manipulated, and that it is still being extorted by the suspected attacker.
GMO Internet announced on October 24 that it will pay all users of its "Onamae.com Desktop Cloud" FX auto-trading VPS a ¥5,000 condolence payment and cover actual losses from unauthorized trades caused by the cyberattack. The company also disclosed that a security flaw in the system led to customer information being taken outside, and that it is not complying with the attacker's ransom demands.
Singapore cybersecurity firm CYFIRMA has detected Korean-speaking members on the I2P anonymous network discussing attacks that exploit the newly found PHP vulnerabilities PHP2Shell (CVE-2026-109618, CVE-2026-109619). Government agencies and financial institutions are reportedly the primary targets, and CYFIRMA has raised a possible link to North Korea's Lazarus Group, though it rates that assessment as moderate confidence and no direct connection has been confirmed.
Security experts worked around the clock to patch hidden PHP vulnerabilities before hackers could launch large-scale attacks. Two PHP2Shell flaws, disclosed on October 21, allow remote code execution on any PHP server without authentication. Cloudflare reported attack attempts rising from thousands to millions within days, though researchers at major security firms had not yet confirmed any successful exploitation in the wild as of October 23.
SoftBank has temporarily suspended its emergency disaster alert service in response to a serious PHP security vulnerability, so subscribers on SoftBank, Y!mobile, and LINEMO cannot currently receive earthquake and tsunami alerts by text. The company began an emergency inspection on the 23rd, scheduled to finish on the 26th, after the Japanese government urged caution on the flaw on the 21st.
Researchers have found a third PHP remote code execution flaw, CVE-2026-115560, alongside the two bugs that make up PHP2Shell. The PHP Foundation will not issue an emergency patch; it will ship a fix with the next regular PHP release and has advised a configuration workaround in the meantime.
Everyzone's Kim Jun-young argued at a defense-industry security conference that ransomware now threatens data theft as well as encryption, and that defense firms need security that stops both leaks and operational disruption. He cited a Korean pharmaceutical company that lost nearly ₩15 billion after being reinfected despite backup investments, and proposed endpoint-based, behavior-driven defense.