The Negotiators Working for the Hackers — Plus a PHP Bug Breaking the Web
Thursday, October 22, 2026 · 5-minute read
INTERPOL wrapped up a two-month sweep — codenamed Operation Serengeti III — that ran from late June through August 2026. Working with law enforcement in 21 countries, investigators arrested 1,462 suspects, disrupted 10,909 criminal networks, and clawed back more than $105 million in stolen money. Authorities identified almost 66,000 victims and traced losses that topped $385 million — from business email compromise and ransomware to run-of-the-mill online scams.
↗ The Hacker NewsHackers broke into Onamae Desktop Cloud, one of Japan's most popular VPS providers, and planted malware on as many as 26,739 customer servers. The full scope of what was stolen or damaged is still being investigated. If you or your business rents servers from Onamae, assume the worst and check for unusual activity immediately.
↗ BleepingComputerPHP powers the engine behind a huge chunk of the web — think WordPress, Drupal, and Joomla. Two critical bugs, together called PHP2Shell, let attackers seize full control of a vulnerable server. Exploits are already in the wild, European government sites went offline after the disclosure, and Cloudflare moved to block attack traffic within hours. Emergency patches are out now.
↗ Krebs on SecurityClickFix attacks trick you into copying and running a malicious command on your own computer — usually by showing a fake error page that tells you to "fix" a problem by pasting something into your terminal or Run box. Criminals are now using fake AI assistant installers, poisoned search results, and lookalike chatbot pages as the lure. Google Chrome is rolling out a Gemini-powered warning that flags suspicious copy-paste commands before you run them, but many browsers don't have that protection yet. Amazon's security team also confirmed attackers started exploiting the related PHP2Shell flaws four days before patches were released.
North Korean hackers known as Lazarus Group are now wrapping their malware delivery in post-quantum cryptography. By doing so, they make it much harder for security tools to inspect and block the malicious payloads they're sending to victims. The move shows sophisticated nation-state hackers are already preparing their tools for a world where quantum computers exist — even though most defenders aren't.
Two critical bugs in PHP — the language that runs most of the web — let an attacker execute any code they want on a vulnerable server, expose stored data, or knock the site offline entirely. Working exploits exist right now and are being used in active attacks. Sites running WordPress, Drupal, Joomla, or Magento are all potentially vulnerable if they haven't patched yet. Amazon says attackers were already probing for these flaws four days before patches dropped.
Status: Emergency patches released October 21, 2026. Update to the latest PHP version immediately. CISA has also issued an urgent patching alert.
GitLab — the popular platform developers use to store and collaborate on code — has a maximum-severity flaw in its Regular Expression compiler. A remote attacker can send a specially crafted request and run their own code on the server — no login required. Any organization hosting its own GitLab instance needs to patch immediately.
Status: Security patches released October 22, 2026. Apply the update as soon as possible.
Node.js patched 10 security flaws this week. The worst one lives in its built-in Brotli decompression code — a bug that lets a remote attacker run any code they choose on the server, just by sending malformed compressed data. All three currently supported versions of Node.js are affected. Fixed versions are 22.23.4, 24.22.1, and 26.12.1. Node.js 20.x and older will not receive a fix.
Status: Patches released October 21, 2026. Upgrade to a fixed version. If you're still on Node.js 20 or older, migrate urgently — those versions are no longer supported.
Google is adding two new protections to Chrome that use its Gemini AI to spot scams in real time. The first analyzes suspicious websites and warns you before you interact with them. The second specifically watches for ClickFix attacks — it flags suspicious content when you copy it, warning you that pasting it into your computer could be dangerous. This is a meaningful step because ClickFix attacks bypass traditional email filters entirely, and the scams have been growing fast. The feature is rolling out to Chrome users now.
Microsoft has added Quick Machine Recovery to Windows Server 2025. If a bad software update bricks a server so badly it can't boot, this feature lets IT teams fix it remotely over the network — without needing physical access to the machine. For businesses running dozens or hundreds of servers, this is a big deal: a botched update can normally mean hours of manual recovery work per machine. The feature draws on the same technology Microsoft developed after the CrowdStrike outage in 2024 exposed how catastrophic a faulty update can be at scale.
When a company gets hit by ransomware, the first call they often make is to a specialized firm that negotiates with the hackers on their behalf. You'd assume those negotiators are firmly on your side. A bombshell investigation by Brian Krebs suggests that at least in one case, the people you paid to rescue you were actually helping the criminals who robbed you.
The story centers on ShinyHunters, a prolific extortion group that has stolen data from dozens of major companies and extorted more than $70 million from victims this year alone. In a brazen move in September, they hacked the FBI's own recruitment website and threatened to publish deeply personal files on federal agents. Dutch police arrested a senior ShinyHunters member named Pepijn van der Stap — using flash-bang grenades to catch him while he was still logged into his accounts — and seized his Signal messages. Those messages blew the case wide open.
The chats allegedly showed that a Canadian cybersecurity executive named Edward Dubrovsky — who literally wrote a book advising companies to always negotiate with hackers — was in close, frequent contact with ShinyHunters leadership. Investigators believe he knew about new ShinyHunters victims before those victims did. He allegedly knew ShinyHunters had stolen FBI data and never warned the bureau. He has since been arrested and charged. The chats also pointed to at least one executive at a large, unnamed U.S. consulting firm who Krebs says investigators believe actively helped run the group's victim-shaming extortion website.
The lesson here is uncomfortable but important. The ransomware negotiation industry is largely unregulated. When you're in crisis and looking for help, it's very hard to verify who you're really hiring. For now, if your organization ever faces a ransomware attack, ask your negotiator pointed questions about their vetting process, check their references deeply, and consider looping in law enforcement early — the FBI and CISA both offer free incident response assistance and won't judge you for reaching out.