Attempts to turn the PHP2Shell vulnerabilities into Potassium botnet infections have not produced a confirmed compromise, despite the millions of attacks Cloudflare reported within hours of disclosure. The attackers tried to use CVE-2026-109618 and CVE-2026-109619 to install a Mirai-derived Linux botnet, but researchers have not seen the malware downloaded or executed through those attempts. PHP has fixed the flaws in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Source

Imperva researchers have demonstrated that Node2Shell (CVE-2026-111497) can execute code on an official, unmodified Node.js 24.22.0 image running Linux arm64. The exploit uses crafted Brotli data and took several attempts; Node.js 24.22.1 rejects the same input. Applications that decode attacker-controlled Brotli data should update to a fixed release.

Source

The point of Zoom’s Unified Context Layer is to give AI business context it can use to help an individual participant during a conversation—not just transcribe what was said. In principle, an assistant could use that context to surface a relevant answer or suggestion. Zoom says its planned Live Meeting AI Agent will provide proactive help, including finding answers and keeping meetings on track, but hasn’t specified whether its suggestions will be private to one participant or how they will appear.

Source

Microsoft fine-tuned the open-weight Qwen3.8-27B model for business tasks, using ThinkingBox-Training, an open-source system that rewards AI agents for leaving databases in the correct final state. The approach more than doubled the number of tasks Qwen completed correctly on all 20 attempts, though it solved slightly fewer tasks at least once.

Source

OpenAI’s Decisions API lets applications and agents make quick, bounded choices—such as classifying an input or routing a request—using text, images, or structured data. Now generally available through a dedicated endpoint, it uses GPT-6 Luna and can make decisions up to 10 times faster than the same model through the Responses API. New capabilities include native GPT-Live integration, JSON inputs, image-based instructions, and support for 400 questions per request.

Source

A volunteer maintainer helped rush installable PHP security packages to users after two critical vulnerabilities triggered a scramble to patch servers. Ondřej Surý’s work made it easier to deploy fixes at scale, while the episode exposed how much web infrastructure can depend on a small number of people. Attack attempts surged after details of the flaws leaked and again after public disclosure.

Source

Agent Skills, a format that lets AI agents load task-specific instructions and supporting files, is moving to the Linux Foundation’s Agentic AI Foundation (AAIF). Anthropic says more than 70 platforms have adopted the standard, with 1 million skills published and nearly 280 million installations. The handoff places the standard’s governance and key assets in a vendor-neutral foundation.

Source

GitHub Copilot’s usage metrics API gives organizations reports on how developers use Copilot. It now identifies custom skills, agents, Model Context Protocol (MCP) servers, slash commands, and plugins by their configured names, making internal tools easier to track. Reports can show up to 25 named entries per category, rather than five.

Source

GitHub is rolling out its global default policy for generally available Copilot features on Business and Enterprise plans, with enforcement beginning now and continuing through October 26. Unconfigured eligible features will follow the admin-selected default, while settings admins have already chosen will remain unchanged.

Source

Google Sheets now creates box-and-whisker charts directly from numeric data, adding a quick way to visualize distributions without helper formulas. The cloud-based spreadsheet also preserves these charts when importing from or exporting to Excel.

Source

VulnCheck researchers have developed an exploit for PHP2Shell that achieves remote code execution on x86-64 servers despite Address Space Layout Randomization (ASLR), a memory protection that makes it harder to exploit software flaws. The advance raises the stakes after attack attempts surfaced before PHP2Shell was publicly disclosed. The exploit targets CVE-2026-109618 and works with PHP’s recommended production configuration.

Source

The Agentic AI Foundation has taken in four open-source projects from OpenAI, Anthropic, Hugging Face, and Alibaba, bringing its portfolio to 10 projects. The additions target model API compatibility, reusable agent skills, and the training and management of sandbox environments.

Source

Project Pantheon is an experimental AI memory app for Windows 11 that lets users save information and retrieve it later. It can search and summarize saved webpages, files, screenshots, text, audio, and video, and help draft content from them. Unlike Recall’s automatic screen captures, Pantheon relies on users to choose what the app remembers.

Source

Trend Micro’s Zero Day Initiative (ZDI) accidentally sent six unpatched vulnerability reports to the public Linux kernel mailing list instead of its private security list. Two critical KSMBD flaws, including remote-code-execution issues already disclosed, are part of the batch; four other reports affect different kernel components and ConnMan. Maintainer Greg Kroah-Hartman challenged the submissions, asking why they were posted publicly without patches.

Source

New Outlook for Windows is Microsoft’s email client for managing messages on Windows PCs. Microsoft is rolling out its All Accounts view, a Unified Inbox that lets users handle email from several connected accounts in one place. Copilot search is also arriving, but it currently focuses on the primary account.

Source

Copilot Prioritize uses AI to rank Outlook emails so users can focus on messages that need attention. Microsoft now says its removal, starting October 26, 2026, is expected to continue through the end of March 2027—not just mid-November as an earlier timeline indicated. The feature will disappear from all Outlook clients.

Source

Azure RBAC, Azure Policy, and resource locks can all block Azure management requests, but they enforce different rules. A practical test shows how to identify which control denied an operation: RBAC returns `AuthorizationFailed`, Policy returns `RequestDisallowedByPolicy`, and locks return `ScopeLocked`—even for an Owner.

Source

OpenAI has made its Decisions API available to all customers, offering a faster, lower-cost way for software to choose among options and return a confidence rating. The API uses a speed-optimized version of ChatGPT Luna, with voice and image capabilities in the public release. OpenAI says inference times can fall from seconds to roughly 100–180 milliseconds.

Source

Rob Shocks compares Cloudflare’s open-source security-audit skill with Gitleaks, Trivy, Claude Code’s security review, and a plain AI prompt using a deliberately vulnerable app. Cloudflare’s skill found all six planted flaws, while the other approaches found some but missed issues outside their scope. The results point to layered checks: use scanners and AI review together, and reserve deeper sandboxed audits for higher-risk work.

Source