• PHP discloses two critical remote code execution vulnerabilities that could enable website takeover and data theft
• Details leaked before patch release, prompting an early security advisory and urgent upgrade warning
• Researchers confirmed the flaws are real, with widespread impact expected across multiple PHP versions

PHP, arguably the most popular programming language for websites and web applications in the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.

The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations.

Security rush hour

PHP published a new security advisory, giving admins a “heads up” on an incoming patch.

“The PHP security team would like to give advance notice of an upcoming security release,” the advisory reads.

“It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release.”

If you’re thinking the announcement is rather unorthodox and that PHP might as well just released the patch - you’re absolutely right. The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.

That ‘someone’ is a person with an alias ‘petecooper’, who published a new post on Y Combinator’s Hacker News forum earlier this week. In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026.

The post has since been deleted so we couldn’t independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.

The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed. Therefore, the only thing that’s wrong is the CVSS score which seems to be 9.2, not 10.0.

Among the people who knew about the flaw and the upcoming patch were watchTowr, and Florian Roth, Head of Research at Nextron Systems.

The embargo on the news was set for October 20, with the patch due a day later, on October 21. However, yesterday Roth posted on X, saying “Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.”

Leaking the zero-days

This forced PHP’s hand, not just to release the advisory, but also to send a notice to its ANNOUNCE mailing list, according to BleepingComputer.

Security researchers watchTowr confirmed the news, saying the bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is being nicknamed “php2shell” by the community. Obviously, technical details are being withheld to protect users, but most likely affect PHP versions 5, 6, 7, and 8.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."

The researchers also told the publication they managed to successfully reproduce CVE-2026-109618, confirming the flaws actually work. Good news is, there are still no confirmed reports of the flaws being used as zero-days in the wild.

• State Bank of India is investigating a suspected dark web data leak affecting thousands of customer records
• Exposed information reportedly includes personal details, loan-related data, and customer identifiers
• Bank has launched a forensic investigation but has not yet confirmed the source or authenticity of the leak

The State Bank of India (SBI) has confirmed losing sensitive data on thousands of its users, and worryingly said that it doesn’t yet know when or where the leak took place.

SBI is India’s largest public-sector bank, and one of the country’s biggest financial institutions. Its majority owner is the Indian government, and it provides services such as personal and business banking, loans, credit cards, and similar.

The company has filed a new report with the country’s stock exchange, saying it experienced “an incident involving the loss of certain data.” In the filing, it said that in mid-October 2026 it was contacted by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In, in response to an alert regarding data leaking into the dark web.

Leaking PII

375,000 records were apparently made available on the dark web, among which were 3,897 bank customer records containing Personally Identifiable Information (PII).

“The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the filing says.

So far, the bank does not know if the leak is authentic, who leaked it, or how they obtained the data. It kicked off a detailed investigation to determine the source and extent of the exposure, and assess any associated risks. Cyber incident response and containment protocols were triggered, and an independent CERT-In-empanelled cybersecurity agency was brought in for forensic analysis.

The bank stressed that the leak does not have a material impact on its business operations, and that it expects to continue functioning as usual.

In the meantime, an X account called CyberPulse56 flagged a dark web forum post, made on October 16 2026 by a threat actor called Siriusim. In the post, the actor claimed to have 375,000 CSV rows and 2,722 PDF documents belonging to the bank. They allegedly contained personal customer information, loan applications and supporting documents, account-opening applications, and address and other application-related details.

The Free Press Journal later established that the post was made on BreachForums, one of the most popular dark web cybercrime forums, and concluded that at least some of the data found there was authentic. It found that a WhatsApp profile picture associated with one number matched the passport-size photograph on that person’s KYC document, and it also found that the shared sample was primarily related to loans and contained KYC fields.

No clear connection to SBI

However, there was no information connecting the data to SBI, any of its subsidiaries, or third-party providers in its supply chain. Therefore, we cannot conclude if SBI was actually breached or not. There are a number of ways this data might have wound up on the dark web - it could originate from an older breach, it could be from an entirely different entity, or it could be a recycling of multiple older breaches - something cybercriminals are known for doing.

However, if the data is confirmed authentic, it could be a major risk for the bank’s customers. Information such as postal addresses, CIF identifiers, and loan records, can be used to create highly convincing phishing emails, through which the victims could end up downloading malware, or sharing vital login credentials with the attackers.

This type of stage-two compromise can then lead to ransomware or BEC attacks, which could cause severe disruptions, trigger class-action lawsuits, and result in brand erosion. SBI users should be wary of incoming email messages, especially those claiming to be from the bank, carrying a sense of urgency, or threatening account closure or funds displacement.

Via The Hacker News

• Cybercriminals use antidetect browsers to disguise devices, hijack accounts, and evade fraud detection systems
• Stolen session cookies, fake identities, and AI automation help scale scams and account abuse
• Researchers warn AI-integrated antidetect tools are lowering barriers for large-scale fraud operations

Cybercriminals have started using antidetect browsers as part of their tech stack, helping them evade detection while deploying session cookies, creating thousands of fake accounts, and passing Know Your Customer (KYC) checks. This is according to a new in-depth report published by security experts Check Point Research (CPR), in which it says that Russian, Iranian, and Chinese hackers are spearheading these activities.

What are antidetect browsers?

When users log into services like Facebook or TikTok using regular browsers, they leave behind digital fingerprints - screen resolution, operating system, fonts. This information can be used to identify and track a device across online sessions, and if a single entity (for example, a digital marketing agency) tries logging into multiple accounts from the same browser, it might trigger a security alert (or simply go against certain terms of service).

Hence the need for antidetect browsers - specialized software whose key feature is the ability to create isolated profiles with different digital fingerprints, making multiple accounts appear to originate from separate devices.

They are generally used to manage social media accounts, advertising, and e-commerce accounts, or to run web scraping operations or test websites across environments.

Antidetect browsers are not malicious by design, and are mostly used by digital marketing agencies and affiliate marketers. However, just as many other good things, these browsers are actively used by cybercriminals to exploit the tech and run fraudulent accounts.

Many competing tools are available today, but a handful stand out - Kameleo, AdsPower, Multilogin, GoLogin, and Dolphin Anty.

According to CPR, underground forums are full of discussions on using antidetect browsers for different fraudulent activities. These mostly originate from Chinese, Iranian, or Russian hackers, and generally revolve around Kameleo, AdsPower, and Multilogin.

“We selected these specifically on the basis of documented references across underground forums and criminal marketplaces, indicating active adoption beyond their stated commercial purposes,” CPR explained.

Analyzing these discussions, CPR discovered that the threat actors primarily use antidetect browsers to leverage stolen session cookies. When they steal a cookie, they can inject it into a clean browser profile to assume control of the account and operate it unabated. Banking accounts and cryptocurrency wallets are the most popular targets.

AI seasoning

Besides banks and crypto wallets, threat actors are also using these browsers to test payment credentials across e-commerce platforms without triggering any alarms. They’re also using them to apply for loans under fabricated identities, and to create fake accounts in bulk, which are then used to generate advertising revenue at scale.

At the same time, Artificial Intelligence is making these operations easier to scale, CPR says. AdsPower, for example, offers integration with Large Language Models (LLM) through a Model Context Protocol (MCP) server, allowing AI-powered workflows to connect with browser profiles. Through automation marketplaces, it also offers different templates for things like commenting, liking, or sending messages across multiple accounts.

A combination of antidetect browsers, AI account management, and AI generated content creates a powerful concoction that allows threat actors to run large, coordinated campaigns with minimal involvement. This allows them to build and “warm up” fake accounts over time, which then appear more credible and are easier to use in scam and fraud attacks.

“The antidetect browser ecosystem represents a sophisticated, commercially mature, and increasingly AI-driven infrastructure that has fundamentally lowered the barrier to running scam and fraud operations, as well as coordinated inauthentic operations at scale,” CPR warns. “These commercially maintained tools are available in dozens of languages, backed by customer support teams, tested daily against the world’s largest social media platforms, and are now integrated with LLM pipelines that remove the human operator from the execution layer.”

The researchers advise security teams to look beyond account behavior and focus on the infrastructure, including residential proxies, browser fingerprint inconsistencies, and unusual session-cookie patterns. Social media platforms should start analyzing antidetect browsers to better understand how they bypass their detection mechanisms, while companies should review whether their security systems can detect account takeovers involving session cookies.