PHP Zero-Days Hit 70% of the Web — Plus Fake Wallets, Stolen Tokens & More
Tuesday, October 27, 2026 · 5-minute read
Hackers broke into a test environment at the University of Copenhagen and accessed personal data belonging to 525,000 people. The university confirmed the breach on October 26. A test environment is meant for development, not storage of real personal data, which makes this an especially preventable incident.
↗ BleepingComputerFrench energy company ENGIE — one of the world's largest power and gas providers — confirmed attackers stole customer data by breaching a marketing platform used by its business partners. The weak link wasn't ENGIE itself, but a third-party vendor with access to customer records. This is a classic supply chain attack pattern: go after the smaller door to get into the bigger house.
↗ BleepingComputerSouth Korean police identified seven suspects behind a cybercrime operation that hit more than 90 organizations. The attackers used a tool called ARTEX AI — a penetration testing framework — to carry out most of the attacks and steal 8.2 million data records. It's a sharp reminder that the same AI tools built to help defenders can be turned against them.
↗ BleepingComputerPHP — the programming language behind a huge chunk of the internet — has two critical bugs that attackers are already exploiting in the wild. Working exploits exist for both flaws, and CISA has ordered federal agencies to patch by Thursday. Government websites in Europe went offline after the vulnerabilities were disclosed. Cloudflare detected exploitation attempts starting around 3 AM UTC and quickly deployed protective rules, but unpatched servers are still exposed. The bugs can allow a remote attacker to run any code they want on a vulnerable server — essentially handing them the keys to the building.
Attackers are using generative AI to build fake login pages that look almost identical to real ones — complete with company logos, correct fonts, and convincing copy. What makes this worse: some of these pages don't just steal your password. They also capture your MFA code in real time or hijack your active session, meaning even two-factor protection won't save you. These pages are being tailored to specific employees and organizations, making them far harder to spot than old-school phishing attempts.
A flaw in Apple's CoreGraphics engine lets a malicious file — like a booby-trapped image or document — run unauthorized code on your device. Apple confirmed it was used in real, targeted attacks against specific individuals. The fix was released last month for newer devices and has now been extended to older iPhones and iPads including the iPhone XS, iPhone XR, iPad 7th generation, iPad 9th generation, and iPad mini 6th generation.
Status: Patch available. Update to iOS 18.7.11 or iPadOS 18.7.11 (older devices), or iOS/iPadOS 26.7.1 (newer devices). Go to Settings → General → Software Update.
A malicious Android app — with zero special permissions — could pretend to be a trusted Microsoft app like Teams and steal your work account's sign-in token. In tests, stolen tokens gave full access to a victim's email, files, and calendar. Microsoft says the attacker also needs the victim to complete a sign-in step in the Authenticator app, and that this flaw hasn't been exploited in the wild yet.
Status: Patch available. Update Microsoft Authenticator on Android to version 6.2606.4246 or later via the Google Play Store.
GoAhead is a tiny web server baked into the firmware of hundreds of millions of routers, printers, and industrial controllers. A researcher found it loaded a list of revoked security certificates but never actually checked against it — meaning a banned certificate could still get through the door. A second flaw could let an attacker decrypt supposedly private TLS sessions. The fix is GoAhead version 6.1.1, released to device makers on August 2 and published publicly on October 12.
Status: Patch available (GoAhead 6.1.1). Device manufacturers need to push updated firmware to affected products — check your router or device maker's website for firmware updates.
Tailscale — a popular tool that lets teams create private, encrypted networks across the internet — is rushing to patch almost a dozen security vulnerabilities in its SSH feature. The bugs range from credential theft to crashing servers to gaining full root (administrator) access on a machine. Tailscale's security team is actively working through the fixes. If your company uses Tailscale SSH to manage remote access, watch for updates and apply them as soon as they're released — root-level access bugs are among the most serious a network tool can have.
↗ BleepingComputerKeystone makes hardware wallets — small physical devices people use to store cryptocurrency safely offline, away from hackers. On October 26, the company revealed something alarming: an attacker had broken into Keystone's website and stolen the secret key the company uses to prove its devices are genuine.
Think of it like this. When you buy a Keystone wallet, you can visit the company's website and your device performs a handshake — essentially showing a badge that says "I'm a real Keystone, made in our factory." That verification process relies on a hidden key baked into every device. If a counterfeiter gets that key, they can build fake wallets that pass the same check. A buyer who trusts a counterfeit device could have their cryptocurrency stolen without knowing anything is wrong.
The good news: Keystone says the stolen key did not expose any owner's recovery phrase or private keys. Existing wallets are not directly at risk from this incident — the danger is specifically from counterfeit devices someone might buy in the future that pass the old verification. Keystone is destroying 18,835 unsold devices that carry the compromised key. All new stock will get a fresh one.
If you received a Keystone device after October 20, 2026, the company says to contact their support team before using it — they'll confirm whether your device is genuine. For everyone else, this is a good reminder that the physical supply chain for security hardware matters just as much as the software inside it. Always buy directly from the manufacturer or an authorized retailer, and verify your device the moment it arrives.