Saturday, October 24, 2026

← Oct 23   Oct 25 →   Every day

The flaw under most websites (8)

• Honeypot logs 35 shells from two addresses: first public end-to-end PHP2Shell code execution in the wild
  0x4D31 honeypot-data (GitHub)
  Two hosting-network addresses, Oct 24 15:35 to 18:57 UTC; author warns the favorable configuration says nothing about reliability elsewhere.
• BBC: volunteer Debian/Ubuntu PHP packager Ondřej Surý got $10,000 in donations in days after the rush fix
  BBC News · 23:05 UTC
  Warned in advance, he rushed when the leak moved the release up; 'the most severe incident in years', maybe not the last.
• Korean small businesses say they cannot tell whether PHP2Shell affects them; KISA reports no exploitation yet
  Financial News (Korea) · 21:01 UTC
  Cafe24 and Gabia patched; PHP 8.1 and older get no official fix; professors urge help for SMEs and schools.
• PHP2Shell keeps thousands of Nepali government sites and the central bank offline; return due by Tuesday
  Kathmandu Post · 19:56 UTC
  Shared GIWIMS platform to be patched centrally after the Dashain holiday; NCSC says no unauthorised access found; three banks back.
• Reuters: Cloudflare's Prince knows of 'a bunch' more severe AI-found flaws; VulnCheck sees disclosures doubled
  Reuters (via Honolulu Star-Advertiser) · 17:05 UTC
  Seven experts expect PHP2Shell-style weeks for years; curl's Stenberg and ArmorCode's Rahman say more bugs found does not mean more breaches.
• TechCrunch reconstructs PHP2Shell: bugs seen in 2024, Calif found the path, Amazon saw probes a week early
  TechCrunch · 15:30 UTC
  Calif says AI helped exploit but most work was human PHP expertise; cites Palo Alto and Trail of Bits on compromises.
• CYFIRMA says a suspected North Korean crew is staging PHP2Shell attacks on 216 hosts; unconfirmed elsewhere
  CYFIRMA
  Version 3 lists 15 staging and 21 scan addresses, rates the DPRK nexus 'HIGH', names no organization, confirms no compromise.
• CYFIRMA: Korean-speaking actors on I2P preparing PHP2Shell attacks on banks and government in four countries
  Korea JoongAng Daily · 05:35 UTC
  Lazarus link rated only moderate; no victim or North Korean infrastructure identified; Korean experts skeptical.

Everyday life (8)

• Authors paid up to $17,000 to a 'Patrick White Publishing'; ABC finds its storefronts and covers are AI-made
  ABC News (Australia) · 21:29 UTC
  Google Maps storefront images carry OpenAI watermarks; the company's ABN belongs to an unrelated firm that reported it to Scamwatch.
• Nigeria arrests nine with UK, Canadian and German help; one allegedly cloned Elon Musk's voice for a scam
  Blueprint (Nigeria) · 21:28 UTC
  $15,900 in crypto recovered; two Canadian romance-fraud victims lost more than CA$417,000; suspects not yet tried.
• Forced to pick, Grok 4.7 named the Republican in 92% of 500 midterm races; GPT-6.1 Sol the Democrat in 97%
  TechCrunch · 15:00 UTC
  Convovo study led by Cornell's Tapan Parikh; the models agreed under 10% of the time. OpenAI: the API test is not ChatGPT.
• CNBC poll: 63% of US voters oppose an AI data center within 10 miles of home; 13% support one
  CNBC via Political Wire · 12:02 UTC
  All-America survey finds bipartisan resistance to the data-center build-out nine days before the midterms.
• McGill estimate: 40% of Quebec voters asked AI chatbots about the election and got false or outdated answers
  Global News / The Canadian Press
  Experts say answers were often wrong ahead of Ontario municipal votes; Anthropic says Claude shows sources.
• A fake Bon Jovi sent AI videos that said her name; a Louisiana fan lost $10,000 and nearly her home
  Fox News · 11:00 UTC
  Money requests began seven months after first contact in late 2024, via Venmo, PayPal, Cash App and crypto; IP traced to Lagos.
• California mother wired $5,400 to Mexico after a fake-kidnapping call used an AI clone of her daughter's voice
  Fortune · 10:36 UTC
  Daughter, 37, was at work; Martinez police investigating. Gallup: 15 million US adults scammed in 2025, 12% of cases involving AI.
• Google's updated privacy policy lets Gmail, Drive and Photos data shared with AI Search personalize ads
  The Hacker News
  Effective Oct 16; opt-in through Personal Intelligence, not on by default; EEA, UK, Switzerland and Nigeria excluded.

Deepfakes (4)

• Spain's PP deepfake ad draws a criminal complaint for defamation and digital identity theft
  The420.in · 18:24 UTC
  Leire Díez asks judge Pedraz for the video's immediate removal; minister López condemns it, the PP's Sémper calls it satire.
• Lupa counts 1,423 AI-made posts in Brazil's campaign: 54% unlabelled, 716 deepfakes, 548 by candidates
  The Rio Times · 17:11 UTC
  VigIA tracker, Aug 16 to Oct 22: Lula in 509 posts, Flávio Bolsonaro in 247; Instagram 794, Facebook 690; runoff Oct 25.
• Bengal police arrest a man who flashed an AI-made police ID at traffic officers to make them drive him home
  IANS via SocialNews.XYZ · 08:17 UTC
  A scan showed the card was fake; he reportedly admitted making it with AI and was produced in Barrackpore court Saturday.
• Brazil's electoral court bars Nikolas Ferreira and Pablo Marçal from AI-manipulated posts, R$100,000 a post
  CNN Brasil · 03:12 UTC
  Signed Oct 23, in force until today's runoff closes; Meta and X must report on both profiles or face R$500,000 fines.

Breakthroughs (1)

• DeepSeek V4.1 Flash: Intelligence Index 39 to 45 and 35% cheaper per task, but still near the bottom on facts
  WinBuzzer · 15:39 UTC
  Artificial Analysis: Terminal-Bench 4.0 27% to 34%; Omniscience score 5 against 46 for Claude Opus 5.5.

Chatbot harms (1)

• Futurism: Character.AI's suicide and school-shooter bots reached minor decoy accounts as it lost $8-9M a month
  Futurism · 12:53 UTC
  Retrospective after the Chapter 11 filing; revenue peaked at $5.3 million a month per 404 Media's reading of court papers.

Rules and regulators (2)

• UK puts £100m into an AI biosecurity lab; OpenAI and Anthropic pledge up to £100m each in compute and credits
  The Next Web · 10:59 UTC
  Independent non-profit modelled on AISI, part of a £600m-plus AI security package; no site, director or start date yet.
• Forsa: 70% of Germans call global AI rules 'very important'; 47% among under-30s, 93% of Green voters
  Handelsblatt (dpa) · 02:39 UTC
  Poll of 1,000 for Internationale Politik, fieldwork Oct 9 and 12; 9% call global rules unimportant, 26% of AfD voters.

AI incidents (1)

• AI-found Brotli bug behind Node2Shell also hits Bun, Envoy, Istio and Python; the fix sat unreleased since Feb
  The Hacker News
  CVE-2026-111497, reported by OpenAI's Codex Security team; no in-the-wild exploitation or reliable public exploit yet.

Other (1)

• LiteLLM post-mortem: a master key left in a public repo since May let an attacker hijack the release pipeline
  The Hacker News
  Poisoned 1.107.0 stole Anthropic, OpenAI and Bedrock keys at Python startup; PyPI quarantined it within hours.

AI attacks (2)

• Korea Economic Daily, via Nikkei: modified ARTEX hacking agents keep spreading after the developer pulled them
  Korea Economic Daily · 07:08 UTC
  Variants tuned for remote access and scanning; claims of use against Japan are unsourced; a similar tool, Strix, has appeared.
• Reuters: Moonshot cut cyber-offense data from Kimi K3.1 Pro; its own hacking score fell to 81% from 90.5%
  Reuters via Investing.com
  Open weights due Nov 4; the benchmark is Moonshot's own and not independently verified, as China drafts AI-malware export controls.

← Oct 23   Oct 25 →   Every day

Headlines are written by Warning Shots and link straight to the outlet. Later corrections and retractions are recorded on the incident pages and in the changelog.