Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

wallarm

Stop Reviewing Your AI Agents. Start Governing Them.

Oct 22, 2026 By Wallarm In Wallarm
Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document says agents must follow least privilege. A risk assessment gets filed. Then the agent ships, and nobody can say what it actually did on Tuesday. That isn't governance.
Read Post
cato networks

Cato CTRL Threat Brief: Cato AI native SASE delivers PHP2Shell protection at machine speed

Oct 22, 2026 By Dr. Guy Waizel In Cato Networks
On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.
Read Post
armo

PHP2Shell: What Security Teams Need to Know About CVE-2026-109618 and CVE-2026-109619

Oct 22, 2026 By Ben Hirschberg In ARMO
On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.
Read Post
securonix

TRUST#GRAFT: JavaScript Attack Targets WordPress Admins with PHP Backdoor

Oct 22, 2026 By Akshay Gaikwad, Aaron Beardslee In Securonix
The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access.
Read Post
knowbe4

Job Seekers Who Use AI for Applications Need to be on the Lookout for Scams

Oct 22, 2026 By KnowBe4 Team In KnowBe4
Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications. Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.
Read Post
knowbe4

Warning: Calendly Phishing Pages Are Targeting Job Seekers

Oct 22, 2026 By KnowBe4 Team In KnowBe4
Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter. After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.
Read Post
Torq

AI SOC Adoption: Where to Start in the First 90 Days

Oct 22, 2026 By John White In Torq
John White is the Field CISO for EMEA at Torq. A respected security executive with more than 20 years of leadership experience, John previously served as CISO at Virgin Atlantic, where he led a multi-year transformation deploying the Torq AI SOC Platform to modernize cyber operations. Prior to Virgin Atlantic, he built and transformed security functions for global organizations, including ASOS, Liberty Global, AEG Europe, and KPMG. You’ve signed the AI SOC contract.
Read Post
Every Campaign Starts From Scratch. That's the Problem

Every Campaign Starts From Scratch. That's the Problem

Oct 22, 2026 By SecuritySenses In SecuritySenses
The team has launched campaigns before, yet the next one begins with the same questions. Where is the approved logo, who signs off the offer and which document contains the final headline? Experience exists, but the process seems determined to forget it every time a new deadline appears.
Read Post
How Viddo Holds An Incident Diagram Still While It Moves

How Viddo Holds An Incident Diagram Still While It Moves

Oct 22, 2026 By SecuritySenses In SecuritySenses
Security notes stay readable when the diagram does not grow a second architecture. A customer brief can start from the signed drawing on viddo, then add a short motion pass that leaves every box, arrow, and label on the same page the analyst already approved.
Read Post
Turning 1-Star Reviews Into 5-Star Ratings: A Response Playbook

Turning 1-Star Reviews Into 5-Star Ratings: A Response Playbook

Oct 22, 2026 By SecuritySenses In SecuritySenses
There are 250 million online customer reviews posted across digital platforms every day. But the volume isn't the major issue here. A single unaddressed one-star rating can instantly derail weeks of hard-earned brand momentum. Ignoring these public complaints costs real revenue when prospective buyers look elsewhere. Turning a scathing comment into a positive rating isn't about winning an argument online. It requires immediate action and strategy to transform angry customers into your most devoted brand advocates.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.