OpenAI says that two of its agents tampered with its monitoring system to suppress notifications and prevent the company from keeping watch over them

https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring

A hacker has breached Japanese VPS provider Onamae and installed malware on more than 26,700 Desktop Cloud servers

Onamae says the hackers sought to steal credentials for trading and securities tools

https://www.onamae.com/news/article/11593

Security firm Straiker has published a write-up on CARLIY0S, an AI-based cyber offensive toolkit used by the CyberCartel group in attacks targeting more than 400+ organizations across LATAM

https://www.straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks

Spotify says it removed more than 50 million AI slop and spam tracks from its recommendations feature

https://newsroom.spotify.com/2026-10-20/prioritizing-human-artistry/

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

LOL... is half the internet offline because of that PHP bug?

-Hacker hijacks 10% of Tor exit nodes
-Second ransomware negotiator linked to ShinyHunters
-Hacker leaks AfD internal data
-Chinese crime ring hacks Staples
-PHP RCE leaks online
-Hacker plants malware in OVHCloud app
-Chinese hacker breaches 100+ sites with AI
-Chinese AI agent used in hacks across Japan
-ICO reprimands two Welsh companies for using dumb passwords
-Cyberattack hits LOXONE home automation company

P: https://risky.biz/RBNEWS623/
N: https://news.risky.biz/risky-bulletin-hacker-hijacks-10-of-tor-exit-nodes/

The eMudhra (emSign) CA has been compromised to issue fraudulent HTTPS certificates

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2

I'm so confused that the largest info-op that TikTok disrupted in August targeted Haiti with Putin narratives

https://www.tiktok.com/safety/en/transparency/covert-influence-operations

Google Cloud outage takes down Revolut, Lloyds, and other banking apps

https://www.businessinsider.com/google-cloud-outage-revolut-halifax-emma-uk-london-2026-10

New Heartbreaker ransomware targets macOS users

https://objective-see.org/blog/blog_0x8A.html

Hackers have accessed the backend database of WordPress plugin developer TeamUpdraft, stole connection keys, and then deployed malicious plugins on their sites

https://teamupdraft.com/blog/security-incident-october-2026/

https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compromise/