cybersecurity teams

The EU's cybersecurity agency CERT-EU has issued a RED alert for a critical vulnerability in PHP, the widely used server-side programming language. The advisory, published as security advisory 2026-018, urges organisations running PHP to patch urgently. Developers and security teams are discussing the flaw's severity and how many web services could be exposed.

Cybersecurity firm CrowdStrike says its Counter Adversary Operations team has uncovered new campaigns planned for 2026 that use agentic AI, meaning autonomous artificial intelligence tools that can carry out attack steps with limited human involvement. The finding points to a shift in how attackers operate, with AI agents being used to speed up reconnaissance, exploitation and other stages of intrusions, raising concern among security teams.

ENISA, the European Union's cybersecurity agency, has published a joint statement addressing critical vulnerabilities in PHP, the widely used server-side programming language that powers a large share of websites worldwide. The statement signals coordinated concern among security authorities and is expected to prompt organisations running PHP-based systems to review and patch their installations urgently.

A cybersecurity startup has raised $34 million to help security teams defend against AI-driven threats, and has shared its pitch deck. The funding comes as companies scramble to counter new risks from AI-powered attacks, including automated phishing and deepfake-based fraud, which are outpacing traditional defenses. Investors are pouring money into tools built specifically to secure AI systems and respond to threats that use the technology.

Expel has published an article arguing that security operations centers have moved through data-driven and signal-driven phases into a new "context era," in which AI is reshaping how analysts work beyond simply speeding up alerts or easing alert fatigue. The piece argues that AI's real value lies in giving analysts richer context for decisions. Cybersecurity practitioners are sharing and discussing the argument.

IBM is highlighting how artificial intelligence can now uncover serious software vulnerabilities at a speed never seen before, raising questions about whether security teams can keep pace. The concern is that the same tools accelerating discovery for attackers and researchers may outstrip defenders' ability to patch and protect systems in time.

Tenable has introduced new capabilities that let cybersecurity teams assess and vet open source AI agents before deployment. The feature is aimed at helping organisations manage the security risks posed by increasingly popular AI-driven tools, giving defenders visibility into what these agents can access and do.

Indonesia's Id-SIRTII/CC, the national computer security incident response team, has published a fresh security advisory covering vulnerabilities in php2shell, tracked as CVE-2026-109618 and CVE-2026-109619. The advisory, released via the BSSN website, is being shared in cybersecurity circles as admins move to check whether their systems are affected and patch accordingly.

Security commentators argue that any competent cybersecurity team must already be equipped to deal with AI-originated threats. The reasoning: AI agents exploit the same vulnerabilities defenders are supposed to catch, so if an automated agent can break in, a human could too — and vice versa. Teams that cannot handle AI-driven attacks, the argument goes, were not built correctly in the first place. The take is resonating in discussions about how AI is reshaping security priorities.

Cloudflare has warned that fixing botched certificates issued by Indian certificate authority eMudhra will require work beyond browser vendors alone, according to iTnews reporting picked up in a cybersecurity news digest dated October 21, 2026. The digest aggregates nine security updates from three sources, with the eMudhra certificate issue among the day's notable items.

A cybersecurity practitioner joked that a new PHP development is being ignored because they are still busy dealing with Log4j, the Apache logging library flaw that has kept security teams overwhelmed since its disclosure. The quip reflects a common mood in infosec circles: analysts drowning in one major vulnerability barely have time to react to the next one.

A new security advisory reports that vulnerability CVE-2026-83531 affects multiple systems, with the potential for significant security breaches including unauthorized access or data exposure. Administrators are being urged to apply patches within 24 to 48 hours. Details of the flaw are circulating among cybersecurity professionals discussing its severity and remediation steps.

Cybersecurity company ANY.RUN has published its summary of phishing activity recorded over the past seven days, directing analysts to its Threat Intelligence Lookup tool for tracking the latest phishing campaigns and indicators. The update is aimed at security teams monitoring current phishing threats, offering searchable data on recently observed malicious activity.

A cybersecurity honeypot operator published indicators of compromise from 2,988 RDP scans recorded on 19 October 2026. The dataset highlights the most active source IPs, led by 154.36.174.33 with 2,415 scans, top ASNs including AS979 and AS212815, and the most targeted accounts. Full data was shared for defenders to block and investigate.

Huntress is hiring a Manager for its Security Operations Center, based in the United States, with a salary range of $165,000 to $185,000 per year. The opening was listed on a blue-team focused cybersecurity job board, drawing attention from security professionals tracking leadership roles in the SOC field.

Employers in cybersecurity are reshaping job requirements around artificial intelligence, with demand concentrated in red-teaming, security operations centre orchestration and AI governance roles. The trend signals that companies are no longer hiring only for traditional defence skills, but for specialists who can stress-test AI systems, automate SOC workflows and manage compliance as AI adoption accelerates across industries.

A team calling itself the Flamingos is recruiting participants for a cybersecurity event in Porto on 18–20 November. Teams get 48 hours to build an AI agent that breaks into a real company's environment, on purpose and within a signed scope. The playful recruitment message, posted amid honeypot log jokes, has drawn attention in the infosec community.

Safe Security, a cybersecurity firm, is hiring for a fully remote Solution Architect position covering North America. The opening is being shared across remote-work and infosec job channels, targeting professionals with cloud security and security engineering backgrounds. It reflects continued demand for senior cybersecurity talent as companies expand distributed security teams.

EY reports that AI-driven vulnerability discovery is rapidly changing how security operations centres report on cyber risk. Automated tools can now scan for and prioritise weaknesses at a scale human analysts cannot match, forcing SOCs to adapt their workflows, metrics and reporting lines to keep pace with machine-speed threat detection.

Cybersecurity researchers have published indicators of compromise drawn from RDP honeypot data collected on 19 October 2026, covering 5,976 scans. The breakdown highlights three source IPs dominating the activity, led by 154.36.174.33 with 4,830 scans, alongside the most targeted accounts and autonomous systems, with the full dataset and top features in each category shared for defenders to block.

Zscaler is hiring a Manager of MDR and Threat Hunting, a remote position open to candidates based in the United States with a salary range of $144,000 to $205,000 per year. The posting was shared via a cybersecurity jobs board and is drawing attention from security operations professionals looking for blue team leadership roles.

Cyderes is hiring a Security Analyst II, branded 'Guardian', for a fully remote position in the United States, with a listed salary of $68,000 to $75,000 per year. The opening is being circulated on cybersecurity job boards and social channels aimed at blue team and SOC professionals, as demand for security operations staff remains strong across the industry.

Cybersecurity commentators are warning that prioritizing software patches solely by CVSS severity score is no longer adequate. Many vulnerabilities rated "Critical" are never exploited in the wild, while some "Medium"-rated flaws become part of active attack campaigns. Security teams are advised to weigh real-world exploitability and threat intelligence, not just severity ratings, when deciding what to patch first.

The Aurora ransomware group has added POWERsonic Industries Inc., a US manufacturing company, to its leak site, claiming it as a new victim. The listing follows the group's pattern of publishing victim data on its blog. Ransomware activity against industrial firms remains a key concern for cybersecurity teams monitoring the manufacturing sector.