atlasum.net
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. Ubuntu and RHEL haven't shipped a fixed kernel yet.
Summary drawn from atlasum.net's own description of the story.
Wired
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
Wired
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
Ars Technica
Hackers were already probing the bug before defenders were told it existed. Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems.
Ars Technica
PHP is the scripting language that builds pages for many of the web's sites and apps, so a flaw in it can be reached through WordPress, Drupal or Joomla. Maintainers plan emergency fixes for two bugs rated 9.2 out of 10, after an unconfirmed report of a tool that runs code on servers running PHP 5 or newer. Security firms expect mass attacks soon after the patches land.