PHP exploitation attempts surge, with no successful attacks reported so far | Cyber Intelligence Briefing – 23 October 2026

Top news stories this week

1. PHPanic mode. PHP exploitation attempt surge, with no successful attacks reported so far
2. Un-cert-ain. Two certificate incidents expose weaknesses in the internet’s trust infrastructure.
   
3. Three strikes and you’re breached.  Nikkei discloses its third October data breach.
4. Git happens.  Code repositories become a new attack beachhead.
   
5. Facing brAIniac.  AI agents cross the line from testing to attacks’.
6. Third-party trouble. Public sector data exposed in recent data breaches in Japan and the US.
   

1. PHP exploitation attempts surge, with no successful attacks reported so far

Emergency patches were released for critical vulnerabilities affecting the widely used PHP programming language, prompting governments across Europe to take websites offline. Security researchers have reported a surge in the attempts to exploit these flaws, often using AI-generated proofs-of-concept which are not effective. Attempts began several days before the vulnerabilities were publicly disclosed and have since accelerated exponentially. S-RM is not currently aware of a working exploit being used maliciously in the wild.

So what?

Organisations are urged to patch the vulnerabilities immediately, be prepared to implement vendor patches for other appliances and management interfaces that bundle PHP, and monitor for suspicious activity originating from PHP-related processes.

[Researcher: Milda Petraityte and James Tytler]  

2. Two certificate incidents expose weaknesses in the internet’s trust infrastructure

GoDaddy revoked 404,607 SSL/TLS certificates after discovering they had been issued outside of documented certificate requirements, forcing affected customers to replace them to avoid service disruptions. Separately, cryptographic keys belonging to eight eMudhra intermediate certificate authorities could be recovered due to weak randomness, potentially enabling attackers to forge trusted HTTPS certificates and impersonate websites. Major browser vendors have scrambled to block the affected certificates.

So what?

Browsers have been updated, but other networked devices and software can rely on embedded certificate authority that also needs updating. SSL, the basis of most encrypted communications on the internet, is only as strong as the weakest link in the chain, so a compromised certificate undermines the whole infrastructure. Organisations should maintain visibility of all certificate renewals, not just automated renewals.

[Researcher: Steve Ross]  

3. Nikkei discloses its third October data breach

Nikkei disclosed its third cybersecurity incident in October after attackers used stolen credentials to access a cloud-based development environment. Over 1.8 million records have been exposed with 150,000 containing personal information. This incident follows two account compromise events previously announced by the Japanese media company, continuing a pattern of identity-focused security incidents. 

So what?

Compromised credentials remain one of the most effective attack vectors, particularly when they provide access to development environments. Organisations should review identity security controls around privileged accounts, developer access, and suspicious authentication activity to avoid repeated incidents. 

[Researcher: Robin Toulalan Parr]

4. Code repositories become a new attack beachhead

Github has warned that an ongoing large-scale supply chain attack campaign has evolved from injecting malicious workflows to planting malicious credential-stealing code disguised as a font file into a number of repositories. Separately, GitlLab released patches for a flaw that has been designated as maximum-severity, which allowed remote attackers to run arbitrary code on vulnerable servers.

SO WHAT? 

Companies using external repositories should treat them as critical systems and not just code storage. Appropriate controls should include securing developer accounts, controlling repository access and monitoring workflows.

[Researcher: Lester Lim]

5. AI agents cross the line from testing to attacks

India's CERT-In reported incidents in which AI models under test exceeded their intended scope and accessed sensitive data in live organisational environments. Separately, researchers found a cybercrime group using a multi-agent framework built on Claude, Grok and other commercial AI models to help coordinate attacks against more than 400 banks, fintechs and payment providers across Latin America.

So What?

AI can help accumulate knowledge, identify opportunities and scale decision-making amplifying attackers’ capabilities. While this may increase the speed and efficiency of threat actors, many attacks ultimately rely on familiar weaknesses. Strong security fundamentals therefore remain among the most effective defences against both human and AI-enabled threats.

[Researcher: Gabriella Nolan]

6. Public sector data exposed in recent data breaches in Japan and the US

Two third-party data breaches have recently exposed sensitive public-sector information. In California, attackers used a compromised login to access an Educational Testing Service (ETS) file-transfer system, exposing personal and educational data belonging to millions of public school students. Separately, unauthorised access to Japanese cloud provider Arcadia potentially exposed information belonging to around 125,000 police personnel, including names and email addresses.

SO WHAT? 

Compromises at third-party providers can expose sensitive information across multiple organisations and large populations. Organisations should ensure third-party risk management considers both supplier security controls and the sensitivity and volume of data entrusted to them.

[Researcher: Jenny Eysert]