> InfoSec News Nuggets – 10/21/2026

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws Details of two critical PHP vulnerabilities, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, leaked online ahead of coordinated disclosure, prompting the PHP project to urge all users to prepare for immediate patching with fixes scheduled for October 21 at 14:00 UTC. Both flaws carry a CVSS score of 9.2 and could allow unauthenticated remote code execution, with public reporting suggesting every PHP version from PHP 5 onward is affected. WatchTowr says it has reproduced one of the bugs, and while neither it nor Huntress has seen in-the-wild exploitation yet, Sansec warns mass exploitation will likely begin within 15 minutes of the patch release.   Google Chrome 156 Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws Google has pushed Chrome 156 to the stable channel for Windows, macOS, and Linux, fixing a massive 353 security vulnerabilities, six of them rated critical. Five of the critical bugs are memory corruption issues in Skia, Accessibility, CSS, Paint, and WebRTC, while the sixth is a use-after-free in Accessibility, alongside numerous high-severity fixes in ANGLE, V8, GPU, Site Isolation, and other components. Notably, at least two of the critical flaws were found with AI assistance, including one credited to an Anthropic researcher working with Claude and another reported by OpenAI Codex Security. Google has not said whether any of the flaws are being exploited in the wild, and users should update to version 156.0.8078.47/.48 as the rollout continues.   Ahold Delhaize confirms ‘malicious actions’ behind cyber outages affecting grocery brands Dutch grocery giant Ahold Delhaize has confirmed that the suspicious activity it detected in its IT systems last week was a cyberattack, forcing it to take systems offline across most of its U.S. and European brands and file a police report in the Netherlands. Stores stayed open, but online shopping at U.S. banners such as Food Lion and Stop & Shop remains down, while websites and apps for Albert Heijn, Etos, and Gall & Gall are back and e-commerce has been restored in Belgium and Central and Southeastern Europe. The company says it has no evidence that customer, employee, or partner data was stolen but has declined to describe the nature of the attack or whether ransom was involved, and the incident follows a 2024 attack on the company that exposed data on more than 2.2 million people.   OVHCloud CLI repo compromised. Customer reports incident European cloud provider OVHcloud says the GitHub repository for its official command-line interface was briefly compromised in a supply chain attack that was flagged by a customer rather than caught internally. CEO Octave Klaba said the attacker used a developer’s GitHub account to add a binary designed to retrieve secrets from disk, affecting CLI versions v0.11.0 through v0.15.0, while v0.10.0 and the upcoming v0.16.0 are clean. The malicious release was blocked within 94 minutes and no other repositories were affected, but anyone who installed a compromised version is being urged to rotate all secrets stored on their machines while OVHcloud continues analyzing the binary.   SBI Data Breach Claim – Hackers Allegedly Claim Access to 3.75 Lakh Users’ Database A threat actor calling itself Siriusim has posted on BreachForums claiming to hold State Bank of India customer data, including KYC records, Aadhaar numbers, loan applications, account-opening forms, and addresses spread across 375,000 CSV rows and 2,722 PDF files. In an October 21 update, SBI confirmed a breach, saying its preliminary review identified 3,897 customer records containing personal information on the dark web — far fewer than the 375,000 rows the actor advertised. How the records were obtained, and whether they came from SBI itself, a subsidiary, or a third-party service provider, has not been established. The exposed data could fuel identity theft, loan fraud, and convincing bank impersonation scams, so customers should verify any unexpected bank messages through official channels. The post InfoSec News Nuggets – 10/21/2026 appeared first on AboutDFIR - The Definitive Compendium Project.