Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the span of a few days, we saw PHP2Shell, a set of critical remote code execution vulnerabilities in core PHP itself. That’s not in an application built on PHP, but in the engine that powers roughly 70% of the websites on the internet. Every PHP version released in the last decade was affected.

You might not run PHP yourself. That doesn’t mean you’re safe from PHP2Shell, which is why we created the PHP2Shell Security Checklist. Your SaaS provider might use PHP. Your hosting provider might manage PHP runtimes on your behalf. A third-party application could bundle PHP inside a container or software package you didn’t know existed. This is what makes PHP2Shell a supply-chain security concern.

One of the jobs of the National Institute of Standards and Technology is to keep on top of new technologies as they are developed and evolve. This is particularly important for risk management, considering both of the major governmental information security frameworks (FedRAMP and CMMC) are based on NIST publications. Well, as you might imagine, Artificial Intelligence technology is a huge new risk factor.

Passkeys and security keys both support phishing-resistant authentication, but they differ in how credentials are stored, managed, and used. A passkey is a digital authentication credential, while a security key is a physical authenticator that can store credentials and prove a user's identity. For enterprises replacing passwords, the distinction affects credential portability, recovery, hardware requirements, and control over authentication.

AI is changing from a tool that generates content into agents that reason, decide, and take autonomous action. Employees now use AI assistants in their browsers and desktop apps. Developers run coding agents that read files and execute commands on their machines. Business teams build agents and connect them to enterprise data through Model Context Protocol (MCP) servers. This shift from asking AI to tasking AI creates hard questions for security teams: Which AI agents are operating in the environment?

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

Keeper Security has been recognized in the 2026 Gartner Magic Quadrant for Privileged Access Management (PAM), the Gartner evaluation of vendors in the PAM market. Gartner also included Keeper Security in its companion report, Critical Capabilities for Privileged Access Management, which assesses vendors against specific PAM use cases and capabilities.

The banks aren’t being hacked, at least not in the way the headlines imply. They’re being out-authenticated. No breach of JPMorgan’s, Morgan Stanley’s, Bank of America’s, Citi’s, or Wells Fargo’s core systems has been publicly reported. Instead, Axios reported on October 22—and Reuters corroborated—that AI agents in bank accounts (major U.S. banks) are being detected and blocked.

Two days after PHP shipped emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the project is back with another RCE advisory: CVE-2026-115560. Looks like PHPoclypse is going to stick around till the weekend. In this blog, we break down what CVE-2026-115560 actually is, the narrow configuration that makes it exploitable, and the one-line mitigation you can apply before the weekend.

TL;DR: On October 22, 2026, Zero Day Initiative accidentally posted six unpatched Linux kernel vulnerabilities to the public LKML. Two are CVSS 9.0 SMB RCEs; three are local privilege escalation. No mainline patches exist yet. Monitor your distribution and unload exposed modules.