SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…

This may be the most significant data breach in Canadian history. Not in terms of the numbers, but in terms of the nature of the records compromised. "More than 1.5 million Canadian Crime Stoppers tips leaked" cbc.ca/news/investigates/can…

Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.

The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. wp.me/pZhYe-5Gb

As if PHP2Shell wasn't enough for one day... now GitLab. 😅 🚨 CRITICAL GITLAB ALERT (CVSS 10.0) CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers. ⚠️ Potentially affects 12 years of releases, dating back to 2014. Patches available. Update immediately! docs.gitlab.com/releases/pat… #gitlab #cybersecurity

🚨 ONE PHP LEAK HIT 5 COUNTRIES AND THE EU IN ONE DAY. HERE'S WHAT HAPPENED TO EACH: 🇯🇵 Japan — Uma Musume and Shadowverse games DOWN for emergency maintenance before the 23:00 patch 🇯🇵 Japan — BASE online shops, Sakura and X Server hosting all in EMERGENCY maintenance 🇯🇵 Japan — Codmon, the nursery app, SUSPENDED for emergency maintenance 🇯🇵 Japan — national cyber office demanded action "as quickly as possible" 🇯🇵 Japan — Tokyo police cyber unit WARNED every PHP site to be ready for the 23:00 fix 🇺🇸 USA — Cloudflare CTO: "We are seeing early attacks emerging" 🇺🇸 USA — Cloudflare: MASSIVE stopgap firewall rollout, free customers included 🇺🇸 USA — EVERY WordPress site exposed (the LARGEST site builder in the entire world, 40%+ of the internet) 🇺🇸 USA — the fix CAN'T install by automatic update (Wordfence) 🇪🇺 EU — CERT-EU: if you can't patch, CUT apps off public networks 🇬🇧 UK — NCSC gave the same advice: patch or go OFFLINE 🇦🇺 Australia — ASD ALERT: "prepare to update and apply patches" 🇵🇱 Poland — CERT Polska: ALL versions from PHP 5.0 up AFTERMATH: 2 critical flaws leaked before the fix, CVSS 9.2 out of 10 on both Every PHP site at risk (69.3% of websites run on PHP) 1,300,000+ internet-exposed hosts likely vulnerable Games, shops and hosting suspended across Japan in ONE DAY Mass attacks expected within 15 minutes of the patch One Hacker News post triggered this a day before the fix. The leak made sure everyone around PHP paid the price. This is not a one-country crisis. This is the beginning of something much bigger.

Some Government of Canada websites have been taken offline due to a vulnerability identified in the software, Minister of Artificial Intelligence and Digital Innovation Evan Solomon says. vancouver.citynews.ca/2026/1…