CISA said on Oct 21 that two unauthenticated remote code execution flaws in PHP — CVE-2026-109618 and CVE-2026-109619, known as 'php2shell' — affect PHP installations serving web requests, and urged organizations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately and to take PHP-based systems offline if they can't patch right away. CISA said it had not observed exploitation as of publication (CISA). Details leaked online ahead of the coordinated disclosure (SecurityWeek). According to BleepingComputer, researchers from Calif, OpenAI and Wiz found the bugs, both rated CVSS 9.2; the risk is highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs, and Cloudflare's CTO said the company was already seeing early attacks. watchTowr said its honeypot network observed in-the-wild exploitation as of Oct 21 and that neither CVE was yet in CISA's Known Exploited Vulnerabilities catalog. RTÉ reported that the Dutch National Cyber Security Centre, the Dutch government portal and the Port of Rotterdam pulled sites offline as a precaution, Finnish and French government services were also taken down, and agencies in Europe, Australia, Japan and Britain urged immediate updates. South Korea raised its private-sector cyber crisis alert by one notch on Oct 22, and its internet security agency, KISA, urged updates (ZDNet Korea, News1).

• Indicators to watch · A KEV listing and the federal patch deadline it would set, vendor reports of mass compromise, hosting-provider advisories, responses from WordPress, Drupal and other major PHP platforms

• C1U.S. Embassy in Ottawa accuses Canadian officials of trying to sway the midterms; Canadian leaders push backA U.S. Embassy Ottawa factsheet released Oct 22 cited remarks by Industry Minister Mélanie Joly and Ontario Premier Doug Ford about retaliatory tariffs and political pressure to argue that Canada is trying to influence the Nov. 3 midterms; Prime Minister Mark Carney and other Canadian leaders dismissed the claims (The Tribune/ANI, TBS News/AP).

• B1Seoul says it will answer any North Korean loudspeaker move proportionally; military sees no new forward weaponsSouth Korea's Defense Ministry said on Oct 22 that proportional measures should follow if the North switches its loudspeakers back on, but nothing has been decided; Financial News said reinstalling South Korea's own loudspeakers is among the options and that claims of new weapons such as 600mm rocket launchers aimed at Seoul remain unconfirmed (Money Today, Financial News).

U.S. Impact Assessment

• Cyber exposurePHP sits under WordPress, Drupal, Magento and a long tail of hosting panels and vendor portals, and CISA is telling organizations to patch now or go offline. U.S. companies should inventory internet-facing PHP servers, including those run by marketing agencies, hosting providers and suppliers, and push them to the fixed releases; systems on PHP 8.1 and older need an upgrade or isolation plan. A KEV listing would also put a hard patch deadline on federal civilian agencies and the contractors that run their sites.
• Energy & fuel costsAs of collection, Brent is at $112.32 (+3.22%) and WTI at $99.73 (+2.66%). Iran's claimed tanker strikes, Houthi attacks near Saudi oil infrastructure and reports of post-midterm strike planning keep the Gulf risk premium high heading into November, so fuel-intensive operators — airlines, truckers, chemical makers — should budget for elevated diesel and jet fuel costs. South Korea's move to loosen its diesel export caps could add product supply in Asia, but timing and volumes haven't been set.
• Personnel & facilities in the GulfState's ordered departure from Saudi Arabia, with families at other Gulf posts expected to follow, is a signal for U.S. companies to review evacuation plans, travel authorizations and contractor staffing in the region. Iranian officials' reported threats against data centers and undersea internet cables put Gulf cloud regions and cable landing points on the watch list for U.S. tech and telecom operators.
• Markets & chip supplyThe VIX is at 18.55 (+11.21%) as of collection, and the Asian selloff shows investors growing pickier about AI spending returns. Hardware buyers dependent on Korean memory and Taiwanese foundry output should track Typhoon Champi's pass near Taiwan on Friday and TSMC's early work to reduce rare-earth exposure in its fab equipment.

Sources 36

• W
  WSLS (AP)World shares retreat as report of damage to oil takers pushes oil prices higher
  B
• T
  The Journal (AP)Iran says 7 tankers were damaged in the Strait of Hormuz, and other Mideast news
  B
• A
  Aaj English TV (Reuters)Iran says seven vessels hit in Gulf, warns US over regional bases
  B
• T
  The Irish NewsIran says seven oil tankers damaged overnight in Strait of Hormuz
  B
• C
  ClickOnDetroit (AP)US orders some diplomats to leave Saudi Arabia as fears of escalating Houthi attacks rise
  B
• T
  The Jerusalem Post (Reuters)US diplomats, families leave Saudi Arabia missions as regional conflict with Houthis escalates
  B
• Y
  YnetnewsUS, Israel prepare for renewed strikes on Iran after midterms, report says
  B
• T
  TRT WorldUS, Israel draw up plans for post-election strikes on Iran — report
  C
• F
  France 24 (AFP)Asian stocks back in retreat as tech mood sours again
  B
• M
  Money TodayKOSPI closes at 5,533.77, giving up rebound gains as foreign and institutional investors sell
  B
• S
  Swissinfo (Bloomberg)US Stock Futures Drop After Earnings, Oil Gains: Markets Wrap
  B
• T
  The Korea TimesBOK keeps rate steady at 3% after two consecutive hikes
  B
• S
  Seoul Economic DailyBOK Holds Rate at 3% to Assess Impact of Two Hikes
  B
• S
  Seoul FinanceBOK pauses on the 'fruits of hoeing,' keeps a November hike card in hand (in Korean)
  C
• U
  UPINorth Korea's Kim Yo Jong says border loudspeakers ready within days
  B
• M
  Money TodayNorth says 'new response means, loudspeakers on standby'; Seoul counters with proportional response and U.N. Security Council letter (in Korean)
  B
• F
  Financial NewsSigns of North Korean loudspeaker restart observed; military says no forward deployment of new weapons (in Korean)
  B
• H
  Hankook IlboSeoul hits back with a letter to the U.N. urging a North Korean apology and accountability (in Korean)
  B
• C
  CISACritical Vulnerabilities in PHP Require Immediate Patching
  A
• B
  BleepingComputerPHP ships emergency patches for critical PHP2Shell flaws
  C
• S
  SecurityWeekPHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
  C
• R
  RTÉWebsites go dark as AI exposes critical security flaws
  B
• w
  watchTowrPHP Remote Code Execution FAQ: CVE-2026-109618
  C
• Z
  ZDNet Korea'PHP security flaw emergency': AI secretary Lee Hae-min says the government is taking it very seriously (in Korean)
  C
• N
  News1Security flaw found in PHP, used by 75% of websites; KISA urges immediate updates (in Korean)
  B
• I
  Investing.com (Reuters)Exclusive-TSMC seeks factory-equipment alternatives to thwart China’s rare earths grip, sources say
  B
• M
  Money TodayDiesel export limits set to ease; trade ministry says exceptions possible without rule changes (in Korean)
  B
• N
  Nocut NewsPresident Lee: 'Don't worry about fuel prices… preparing to expand refiners' export volumes' (in Korean)
  B
• A
  ABC News (AP)Russia pounds Ukraine with missiles and drones, hours after agreeing to peace talks
  B
• S
  SBSRussia and Ukraine Exchange Heavy Missiles and Drones Amid Talk of Three-Way Talks, Causing Casualties
  B
• F
  Focus Taiwan (CNA)Taiwan issues land warning as Typhoon Champi approaches
  B
• T
  Taipei TimesTaiwan issues land warning as Typhoon Champi approaches
  B
• D
  Dimsum DailyCSI 300 edges into technical bear market territory
  C
• i
  investingLive (WSJ)Iran’s floating oil reserves in Asia run dry under US naval blockade, WSJ reports
  C
• T
  The Tribune (ANI)US accuses Canada of seeking to influence 2026 midterm elections
  C
• T
  TBS News (AP/UNB)Carney says Trump's tariffs hurt US families as embassy accuses Canada of election interference
  C

Iranian state television said seven oil tankers caught fire or were damaged overnight into Thursday, Oct 22, in the Strait of Hormuz (AP). According to Reuters, the IRGC Navy said it tracked four vessels it accused of illegal oil transfers in the northern Persian Gulf and hit them simultaneously, setting all four on fire, and that three more struck mines west of the strait the previous night and stopped. The Guards warned that 'if this trend continues, the scope of confrontation will extend to the aggressor bases in the region,' and accused Washington of steering ships onto unauthorized routes through mined waters (Reuters). AP said that, if verified, it would be the most vessels damaged in the waterway in a single day since the Iran war began Feb. 28; no casualties or flags were given (AP, The Irish News). We found no UKMTO or U.S. military confirmation as of collection. Brent is at $112.32 (+3.22%) and WTI at $99.73 (+2.66%) as of collection.

• Indicators to watch · UKMTO advisories and vessel identities, CENTCOM's response, further IRGC statements, ships waiting off Gulf ports and war-risk premiums, official U.S. or Iranian statements on talks

In a statement carried by KCNA on Oct 22, Kim Yo Jong, director of the Workers' Party's Office of General Affairs, said North Korea's 'new response means will enter standby status' along the entire border and that its loudspeakers aimed at the South would be on standby within days (Money Today, UPI). According to UPI, she warned that South Korea would face 'the most horrible and distressing situation' if it obstructed border fortification work and argued that the fortifications would reduce the risk of clashes. Money Today said it was her third warning since Oct 19. South Korea's Defense Ministry said that 'if North Korea does something, we naturally think there should be proportional countermeasures,' but that nothing had been decided, and Financial News reported that the military has seen the North maintaining existing loudspeaker sites but no forward deployment of new weapons. The Foreign Ministry said South Korea's U.N. ambassador would send a letter on Oct 22 to the Security Council president stating that the September DMZ blast was caused by mines planted by North Korean troops in clear violation of the armistice, and calling for an apology, accountability and dialogue to ease tensions (Hankook Ilbo). The Sept. 21 mine explosions wounded three South Korean soldiers; Seoul and the U.N. Command concluded North Korea planted the mines, which Pyongyang denies (UPI).

• Indicators to watch · Actual loudspeaker broadcasts and JCS confirmation, what Kim's 'new response means' turn out to be, Seoul's decision on proportional measures, Security Council reaction to Seoul's letter, North Korean construction and troop movements along the MDL

• B1South Korea moves to loosen diesel export caps as global diesel prices surgePresident Lee Jae-myung said on X on Oct 22 that, with refinery output recovered and domestic diesel demand down, Seoul is preparing to trim domestic supply obligations and let refiners export more (Nocut News). Since March, Seoul has capped monthly gasoline, diesel and kerosene exports at 100% of the year-earlier month and required domestic supply of at least 90% of prior-year levels; the trade ministry says it can grant exceptions without changing the rules (Money Today).
• C2WSJ: Iran's floating oil stockpile in Asia has run dry under the U.S. blockadeAs relayed by investingLive, The Wall Street Journal reported that Iran's floating storage in Asian waters, which peaked near 90 million barrels before the blockade was reimposed in mid-July, fell below 1 million barrels by Oct 5 and was fully depleted by mid-October; CENTCOM says the blockade has denied Iran at least $25 billion in oil revenue.

Watchlist next 12–48 hours and beyond

• Within days
  Whether North Korea's loudspeakers actually go to standby or start broadcasting, JCS confirmation and Seoul's proportional response
• Fri, Oct 23
  Typhoon Champi's closest pass to Taiwan; flight, port and chip-logistics disruptions
• Ongoing
  A CISA KEV listing for the PHP2Shell CVEs, vendor reports of mass compromise, and patch guidance from major PHP platforms
• Mon, Oct 26 (evening ET)
  South Korea's third-quarter GDP (Oct 27 Korea time), a key input for the BOK's November decision
• Tue–Wed, Oct 27–28
  FOMC meeting and rate decision
• Around Tue, Nov 3
  U.S. midterms; signs of U.S. carrier and Marine buildup in the CENTCOM area, wider Gulf ordered departures, UKMTO advisories

Intelligence gaps · unconfirmed

• Hormuz: The seven damaged tankers rest on claims by Iranian state TV and the IRGC; as of collection we found no confirmation from UKMTO or CENTCOM. AP described the location as the Strait of Hormuz, while Reuters said four were in the northern Persian Gulf and three west of the strait; vessel names, flags and casualties were not released.
• Saudi Arabia: AP put the death toll from the Dammam airport attack at two (a Saudi citizen and an Indian national), while Reuters, as published by The Jerusalem Post, reported one death; we could not confirm who carried out the attack. The ordered departures for families at other Gulf posts come from Reuters, citing four unnamed U.S. officials.
• Iran strike plans: We could not open The New York Times report and relied on ynetnews and TRT World's accounts; CNBC's story was blocked. The plans are attributed to unnamed U.S. officials and people briefed on them, and the White House declined to comment.
• Market data conflicts: AP reported Brent at $112.27 (+3.2%) and WTI at $99.80 (+2.8%), AFP had WTI at $99.88, and Bloomberg had Brent at $112.10 (+3%); we used the collected quotes, which were taken at a different time. Bloomberg reported the 10-year Treasury yield down 4 basis points at 5.08% on Thursday, versus the collected Wednesday reading of 5.146% (+3bp). AP and AFP gave different Nikkei 225 levels (62,907.84 vs. 63,907.84), so we left the level out, and Korean outlets reported different net buying and selling figures by investor type, which we also omitted.
• Bank of Korea: We could not confirm how many board members kept a hike open over the next three months; the Oct 27 date for Q3 GDP comes from Aju Business Daily. The earlier forecast 'bok-hike-oct22-2026' appears not to have happened after the Oct 22 hold and is left for grading.
• Korean Peninsula: We could not determine what Kim's 'new response means' are. Money Today said no move to restart loudspeakers had been detected, while Financial News said the military had seen maintenance at existing loudspeaker sites; we could not confirm the U.N. letter was actually delivered. We did not open Seoul Shinmun's piece on the U.S. Eighth Army, and the JCS announced no North Korean ballistic missile launch during the collection window.
• PHP2Shell: CISA said it had not observed exploitation at publication, while Cloudflare and watchTowr reported early attacks, so the scale of real compromise is unclear. BleepingComputer said backports were issued for PHP 7.4, 8.0 and 8.1, while KISA and Patchstack treat 8.1 and older as unsupported and recommend upgrading. We found no confirmed victims in the U.S. or South Korea.
• Korean diesel: Money Today put the drop in domestic diesel demand at 7.6% year on year from March to mid-October, while Nocut News said more than 24%, likely on a different basis, so we left the figure out; timing and volumes for the export easing have not been set.
• Taiwan: The Central Weather Administration issued its land warning for Champi on the morning of Oct 22, but we could not confirm the exact time. The earlier forecast 'taiwan-cwa-champi-land-warning-oct25' appears to have happened and is left for grading.
• Other: The CSI 300 bear market is confirmed only by Dimsum Daily (CNBC's page was blocked); Iran's depleted floating storage comes from investingLive's account of a paywalled WSJ report; the TSMC story is a Reuters exclusive based on three unnamed sources. AP counted 22 wounded in Kyiv while SBS reported two separate strikes with 6 and 15 injured. The AfD email leak (Oct 19) predates the collection window and was not covered. With no new South Korean financial-sector breach disclosures, we did not reassess 'kr-financial-hack-new-disclosure-oct31'.

The State Department on Oct 21 ordered nonessential U.S. government employees and their families to leave Saudi Arabia as Houthi attacks escalate, covering the embassy in Riyadh and the consulates (AP). Reuters, citing four U.S. officials, said family members at U.S. missions in other Gulf states will also be ordered out (The Jerusalem Post/Reuters). The same day, an attack hit King Fahd International Airport in Dammam — AP later put the death toll at two, while Reuters reported one dead and eight injured — and debris from a drone intercepted near Saudi Aramco's Shaybah oil field killed two people (AP, Reuters). The New York Times reported that U.S. and Israeli militaries have drawn up detailed plans to resume strikes on Iran after the Nov. 3 midterm elections, weighing a 'short but intensive' campaign against nuclear facilities, energy infrastructure and missile and drone forces, and that some U.S. officials believe a three-day offensive could do enough economic damage to change Iran's position (as relayed by ynetnews and TRT World). According to the same reporting, President Trump blocked an earlier Israeli operation ahead of the midterms, the full U.S. force — including three aircraft carriers — won't be assembled until early November, and Iranian officials have threatened data centers and undersea internet cables (ynetnews, TRT World). A White House official declined to comment on military plans 'that may or may not exist' (TRT World).

• Indicators to watch · Additional carrier and Marine deployments to the CENTCOM area, White House and Pentagon statements on Iran, ordered departures at other Gulf posts, Houthi attacks on Saudi airports and oil facilities, Iranian warnings about U.S. bases

South Korea's Kospi fell 201.89 points, or 3.52%, to close at 5,533.77 on Oct 22, giving back the previous day's rebound after touching an intraday low of 5,485.98; Samsung Electronics fell 4.03% and SK hynix 5.49% (Money Today). Money Today cited worries that AI investment is peaking, tightening fears, weaker demand for shares after SK hynix's buyback ended, the U.S. pullout of nonessential staff from Saudi Arabia, and disappointing results from Meta and Tesla. AFP said Meta raised its AI spending estimates while Tesla reported lower third-quarter profit and cut its capex forecast, and that weak Lam Research guidance and higher oil also weighed on Japanese and Hong Kong shares. Bloomberg said U.S. stock futures fell as the megacap results failed to reassure investors, quoting CaixaBank Asset Management's Santiago Mateo: 'the market is still willing to reward heavy AI investment, but is becoming much more demanding about returns' (Swissinfo/Bloomberg). The Bank of Korea held its base rate at 3.00% in a unanimous seven-member vote after hikes in July and August took it from 2.50%, citing the need to assess those moves and uncertainty over the Middle East and major economies' policies (The Korea Times, Seoul Economic Daily). Gov. Shin Hyun-song said further hikes will depend on incoming data, including third-quarter GDP and October consumer prices, and that the bank will keep responding 'until we are confident that inflation is converging sustainably toward our 2 percent target'; the bank now sees 2026 and 2027 growth well above its August forecasts of 3.3% and 2.9% (The Korea Times, Seoul Economic Daily). September inflation was 2.9%, and the next policy meeting is Nov. 26 (Seoul Finance, The Korea Times). As of collection, the VIX is at 18.55 (+11.21%) and USD/KRW at 1,321.58 (-0.38%).

• Indicators to watch · South Korea's Q3 GDP on Oct 27, October CPI in early November, BOK minutes on individual members' views, foreign flows into Korean chip stocks, the Oct 27–28 FOMC and Treasury yields

• C2China's CSI 300 slips into a bear market, down more than 20% from its June peakDimsum Daily said the CSI 300 fell nearly 2% on Oct 22, leaving it more than 20% below its June 22 closing high, while the Hang Seng Tech index dropped as much as 5% in the afternoon; it cited Bloomberg analysis pointing to rising Fed rate-hike expectations, weak overseas tech shares, doubts about AI returns and earnings disappointments.

• B1South Korea raises its private-sector cyber crisis alert over PHP2ShellSouth Korea's science ministry raised the private-sector cyber crisis alert one level on Oct 22 to get ahead of possible large-scale hacking, KISA urged users of PHP 8.2 through 8.5 to update to the patched releases, and presidential AI secretary Lee Hae-min said the government is 'taking this very seriously' (ZDNet Korea, News1).
• —New breach disclosures by South Korean financial firmsNothing significant confirmed. We found no new hacking-related customer data breach announced by a South Korean financial company since Oct 17 as of collection.

Edition archiveRSS

• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ETMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines
• Sunday, Oct 25 · Morning Edition · 05:50 ETTrump says a U.S. strike on Iran could come 'maybe tomorrow' while floating a 'big, beautiful agreement,' as Houthi missiles and drones fly at Riyadh and Khamis Mushait and Musk says SpaceX throttled Ukraine over 'offensive' Starlink use
• Saturday, Oct 24 · Evening Edition · 17:43 ETA U.S. intelligence memo warns Iranian plots against Americans abroad have reached 'advanced stages' as the State Department thins out Gulf embassies, Houthi ballistic missiles fly at Riyadh, Taif and Yanbu, and Ukraine says its Starlink speed caps are gone