Security brief for 22 October 2026

Here is what the security desk published in the last 24 hours (22 October 2026).

• Palo Alto Networks PAN-OS: Code Injection Vulnerability: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
• Microsoft Windows: Command Injection Vulnerability: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
• Ivanti Connect Secure: Authentication Bypass by Spoofing Vulnerability: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
• PHP security updates fix PHP2Shell: upgrade PHP now: 35 fix PHP2Shell, two critical flaws that let attackers take over servers.
• What the security grade means: The grade is a quick, passive look at how a website or GitHub repo is set up, from A+ to F.
• AI is finding bugs faster than anyone can patch: AI tools are surfacing serious flaws faster than ever, and attackers use AI too.
• Crypto sites and PHP2Shell: why claim pages are at risk: Many crypto project sites run on WordPress.
• How to check if your site is exposed to PHP2Shell: Find out which PHP version your server runs, then compare it with the fixed versions.
• PHP2Shell, explained: Two critical flaws in PHP itself let an attacker run code on a web server with no login.

Each post explains who is affected and what to do. If one of these touches software you run, start there.