Daily brief: Wednesday 21 October 2026

PHP has two critical flaws with patches due today, weak keys forced eight eMudhra intermediate certificates to be revoked, F5 has patched critical NGINX bugs, an OVHcloud CLI release was backdoored, Windows Server 2025 gets quick machine recovery, and DHS has banned DeepSeek across US civilian agencies.

Cybersecurity

PHP warns of two critical flaws, with patches due today

PHP has warned admins about two critical flaws, CVE-2026-109618 and CVE-2026-109619, after details leaked ahead of the planned disclosure. PHP plans to release security updates on Wednesday 21 October at 14:00 UTC, and says it may release earlier if details go public or attacks start. PHP rates each flaw 9.2 under CVSS v4.0, while watchTowr and others describe them as 10.0. watchTowr says the flaws allow remote code execution and believes they affect PHP 5 to 8, but PHP has not yet confirmed which versions are affected. watchTowr says it has not seen exploitation in the wild.

Why it matters for IT: List every server and hosting plan you look after that runs PHP, including WordPress and other CMS sites, so you can patch as soon as the fixed releases appear. Chase your hosting providers for their patch plans today.

Source: BleepingComputer

Cybersecurity

Browsers block eight eMudhra certificates with trivially weak keys

eMudhra revoked eight intermediate certificates after researchers found their private keys were so weak they could be recovered almost instantly. eMudhra blamed a script error in April 2025 and says most were never used in production, with no evidence they issued certificates to end users. Mozilla and Google blocked them on 17 October and Apple added protections on 19 October. Go released versions 1.27.3 and 1.26.10 to fix the issue, tracked as CVE-2026-111943.

Why it matters for IT: Browsers are already protected, but software with its own certificate store, or that does not check revocation, may still trust these certificates until updated. BleepingComputer notes that the built-in curl on macOS may be one of them, so keep tools and appliances up to date.

Source: BleepingComputer

Open source

F5 releases emergency patches for critical NGINX flaws

F5 has released out-of-band patches for three critical NGINX flaws: CVE-2026-15176 and CVE-2026-97205 in the HTTP/3 module, and CVE-2026-93479 in the map directive. A remote attacker without credentials could crash worker processes, and may get code execution, on systems with certain non-default configurations. NGINX Open Source, NGINX Plus, Ingress Controller, Gateway Fabric and Instance Manager are covered. F5 has not flagged the flaws as exploited.

Why it matters for IT: Check which of your web servers, reverse proxies and appliances run NGINX, and update them. If you can't patch straight away, F5 lists config workarounds for each flaw.

Source: BleepingComputer

Open source

OVHcloud CLI releases on GitHub were backdoored to steal secrets

An attacker used a hijacked developer GitHub account to replace OVHcloud CLI releases v0.11.0 to v0.15.0 with versions built to steal secrets from disk. The bad releases were up from 14:47 to 16:21 on 19 October, until a customer reported them. Version 0.16.0 is clean, and source builds and Docker images were not affected. OVHcloud says GitHub's release immutability setting was switched off, and it has now turned it on.

Why it matters for IT: If anyone downloaded those versions on 19 October, treat every secret on that machine as exposed and rotate it. For your own GitHub repos, switch on release immutability and require MFA on every account with write access.

Source: BleepingComputer

Microsoft

Windows Server 2025 gets quick machine recovery

With the October 2026 security update, quick machine recovery now works on Windows Server 2025. When a server fails to boot, it starts the Windows Recovery Environment, sends crash data to Microsoft, and can receive targeted fixes through Windows Update without anyone being on site. Cloud remediation is off by default on Server 2025. You turn it on in Group Policy under Computer Configuration > Administrative Templates > System > Quick Machine Recovery.

Why it matters for IT: This is useful for remote servers with no hands on site, but decide on purpose whether you want Microsoft pushing fixes to your servers. Test the policy on one server first, and keep out-of-band access such as iDRAC or iLO either way.

Source: BleepingComputer

DHS bans DeepSeek products across US federal civilian agencies

The US Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and remove them from their systems, or ask for an exception within 60 days. The order also covers DeepSeek affiliates and third-party products built with DeepSeek technology. It cites concerns about Chinese government access to data. It is not a general ban on private or consumer use.

Why it matters for IT: This doesn't apply in the UK, but it is a good prompt to decide your own policy on which AI tools staff may use. Check which AI apps are being used in your tenants, and block or approve them on purpose.

Source: BleepingComputer

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs