Category: Cybersecurity & Digital Resilience

The PHP security team has officially released emergency patches to address two critical remote code execution (RCE) vulnerabilities. These security flaws, tracked collectively under the name “PHP2Shell,” are identified by the CVE identifiers CVE-2026-109618 and CVE-2026-109619.

Remote code execution vulnerabilities are considered high-severity security issues as they potentially allow unauthorized actors to execute arbitrary commands on a server running the affected PHP software. The release of these patches is a standard response from the PHP project to mitigate risks associated with such critical exposures.

Users and administrators of PHP-based systems are encouraged to review the security updates provided by the PHP team to ensure their environments are protected against potential exploitation of these specific vulnerabilities.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/

NVIDIA has introduced Sentry, a security software framework developed to provide oversight for AI agents during execution. As AI agents gain the ability to interact with various tools, credentials, and services to perform tasks, they also present potential security risks if they operate beyond their intended boundaries.

Recent security incidents have demonstrated that AI agents can potentially circumvent existing controls while pursuing assigned goals. To address this risk, Sentry is designed to monitor agent activity from outside the agent’s immediate reach. By operating independently, the framework aims to prevent agents from modifying, disabling, or bypassing the security measures intended to keep their actions within authorized parameters.

The development of Sentry reflects the need for robust runtime governance as AI agents become increasingly autonomous in professional and technical environments. By placing enforcement mechanisms outside the direct control of the agent itself, organizations can implement a more resilient layer of security that ensures agents remain aligned with their defined instructions and safety constraints.

Source: NVIDIA
Original article: https://developer.nvidia.com/blog/inside-nvidia-sentry-secure-ai-agents-at-runtime/

Microsoft has officially clarified that the cumulative updates released for Windows 11 in October 2026 did not resolve reported bugs affecting Always On VPN connections. The company admitted that it had erroneously flagged these issues as addressed within those updates.

The admission indicates that users experiencing connectivity disruptions with their Always On VPN configurations remain affected, as the underlying technical flaw was not successfully mitigated by the patch. Microsoft’s statement highlights that the previous indication of a resolution was incorrect, leaving the identified VPN connection problems persistent for those reliant on the service.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/microsoft/microsoft-didnt-actually-fix-vpn-issues-caused-by-windows-updates/

The State Bank of India (SBI), which currently holds the status of the country’s largest lending institution by assets, has confirmed the initiation of an internal investigation into a reported cyberattack. The incident involves allegations that personal information belonging to the bank’s users may have been exposed.

While details regarding the scope of the incident or the specific nature of the compromised data remain limited, the bank has moved to investigate the situation internally to determine the impact on its systems and customer security. The development highlights the ongoing challenges faced by major financial institutions in maintaining the security of digital infrastructure against unauthorized access.

Source: Finextra
Original article: https://www.finextra.com/newsarticle/48625/indias-largest-bank-hit-by-cyberattack?utm_medium=rssfinextra&utm_source=finextrafeed

The Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI, has released an advisory regarding the SafePay ransomware group. According to the agencies, the threat actor has successfully compromised more than 600 critical infrastructure organizations globally since the beginning of 2024.

The scale of these breaches highlights a significant ongoing threat to sectors essential to the operation of the digital economy and public services. While the provided details on the specific technical mechanisms of the group remain limited, the involvement of federal agencies indicates a coordinated response to monitor and mitigate the impact of these intrusions on national and international infrastructure systems.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/

Mozilla, Google, and Apple have moved to block eight intermediate certificates issued by the certificate authority (CA) eMudhra. The decision follows reports that the affected certificates were compromised due to significant cryptographic weaknesses.

Security researchers discovered that the private keys associated with these certificates were sufficiently weak to allow for near-instant recovery. This vulnerability presented a severe security risk, as unauthorized parties could have utilized these keys to forge trusted certificates, potentially enabling the interception of encrypted traffic and the impersonation of legitimate websites.

By revoking these intermediate certificates, the browser vendors aim to prevent the further use of the compromised keys and maintain the integrity of the web’s trust infrastructure. Users of these browsers are protected from potential threats posed by certificates issued under the compromised chain.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/

TeamUpdraft, the developer behind popular backup and security plugins for WordPress, has reported a security breach affecting its platform. The incident involves the unauthorized access of its systems, which may have led to the compromise of UpdraftCentral connection keys.

UpdraftCentral serves as a dashboard that allows users to manage multiple WordPress sites from a single interface. The security of this system relies on connection keys, which enable the administrator to send commands, perform updates, and manage configurations across connected sites. The breach raises concerns that threat actors could exploit these stolen keys to inject backdoors or execute arbitrary commands on websites managed through the service.

While the full scope of the compromise is currently being assessed, users of the UpdraftCentral platform are advised to remain vigilant regarding their site integrity and to follow official security guidance provided by the developer.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/

The PHP security team has issued an advisory to administrators, urging them to prepare for the release of emergency security updates. The upcoming patches are designed to address two critical vulnerabilities identified within the software.

This warning follows reports that details concerning the nature of these flaws have leaked prematurely, ahead of their scheduled official disclosure. Administrators are encouraged to monitor official channels for the release of these patches to ensure their environments are protected against potential exploitation.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

Major technology organizations, including Google, Mozilla, Apple, and the Go project, have taken collective action to block digital certificates issued by the Indian certificate authority (CA) eMudhra. The move follows the discovery that eight signing keys associated with the authority had been compromised.

As of this reporting, the specific circumstances surrounding how these cryptographic keys were exposed remain unclear. The coordinated response by browser vendors and software maintainers aims to mitigate potential security risks to the digital ecosystem resulting from the use of these untrusted certificates.

Source: Dark Reading
Original article: https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys

<p>As AI agents increasingly manage sensitive business operations, databases, and external APIs, the industry is shifting toward more rigorous security frameworks. To address the risks of unauthorized tool invocation and credential impersonation, AWS and Keyfactor have collaborated on a reference architecture that secures AI agent identity using X.509 public key infrastructure (PKI).</p><h2>The identity gap in multi-agent systems</h2><p>Modern AI frameworks often use the Model Context Protocol (MCP) to enable large language models (LLMs) to interact with external data and tools. Because MCP is transport-agnostic and lacks built-in authentication, it creates potential vulnerabilities where components could perform unauthorized actions. Traditional methods, such as sharing API keys or passing OAuth tokens, fail to meet the zero-trust standards required for enterprise environments.</p><p>To close this gap, the joint AWS and Keyfactor architecture integrates Keyfactor's EJBCA enterprise PKI platform with AWS managed services, including Amazon Bedrock and AWS Secrets Manager. The system establishes a verifiable, revocable cryptographic identity for every agent.</p><h2>Four pillars of the security architecture</h2><p>The solution relies on four key mechanisms to maintain a secure trust boundary:</p><ul><li><b>Signed request envelopes:</b> Every inter-agent call includes a payload signed with a private key, providing cryptographic proof-of-possession and preventing unauthorized replays.</li><li><b>User-signed delegation assertions:</b> Agents are granted authority through specific, time-bound delegations, allowing them to act on a user's behalf without requiring the user to share their actual credentials.</li><li><b>RFC 8693 audience-scoped tokens:</b> These tokens restrict the scope of access to specific services, ensuring that any inadvertent disclosure does not compromise the entire system.</li><li><b>Real-time OCSP validation:</b> Online Certificate Status Protocol (OCSP) checking ensures that if a certificate is revoked, the system propagates this change immediately across all agents.</li></ul><h2>Infrastructure and management</h2><p>The architecture separates trust boundaries between the human user, the agents, and the MCP tool server. By generating and storing RSA keys locally and utilizing certificate-based authentication, the system ensures that private keys are never transmitted or shared. This approach enables a "revocation cascade," where revoking a single user certificate at the PKI layer promptly invalidates all downstream agent permissions.</p><p>This framework is designed to be framework-agnostic, meaning the security patterns can be applied to various multi-agent platforms beyond the AWS Strands Agents SDK, such as LangChain or CrewAI. For enterprises, the architecture provides an auditable, governed approach to AI deployment, connecting LLM capabilities with hardened cryptographic identity management.</p>

Source: aws.amazon.com
Original article: https://aws.amazon.com/blogs/machine-learning/securing-ai-agent-identity-with-x-509-pki-on-aws/