Cyber news on October 21, 2026

1. 0103:34 UTC

   PHP releases emergency fixes for two PHP2Shell code execution flaws

   18 outlets · first: CyberSecurityNews Vulnerability

   Machine summary Every PHP setup that handles web requests is impacted by both, PHP-FPM, Apache using mod_php, php-cgi, FrankenPHP and LiteSpeed included, and patches have been released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, alongside minimal source-level backports targeting PHP 7.4, 8.0 and 8.1.

   Reported by CyberSecurityNews, Chron, The Hacker News, The Mandarin, RTE.ie, Global Banking & Finance Review, and 12 more outlets.

   • PHP
   • PHP2Shell
   • CVE-2026-109619
   • CVE-2026-109618
   • php-cgi
   • PHP security team

   Full coverage: every report, when each was published, and who was named (18 outlets)

2. 0202:47 UTC

   Taiwan agency reports 48% rise in Chinese disinformation in 2026

   2 outlets · first: Reuters Threat intelligence

   Machine summary Lawmakers were told by Taiwan's National Security Bureau that during the opening nine months of 2026, over 2.5 million pieces of disputed or false online content aimed at Taiwan had been disseminated, about 48% above the over 1.69 million items recorded a year earlier. The bureau attributed the content to China and said it used AI technology, fake accounts and coordinated comment flooding ahead of November local elections. Requests for comment brought no immediate response from the Taiwan Affairs Office; Beijing has previously rejected any allegation that it interferes in Taiwanese elections or disseminates disinformation.

   1. According to Taiwan's National Security Bureau, over 2.5 million items of disputed or false online content aimed at Taiwan were spread during the first nine months of 2026.
   2. The bureau reported an increase of about 48% from more than 1.69 million items in the same period a year earlier
   3. The China-originated content focused on energy, food security, defense policy, and the platforms and images of specific candidates, according to the report
   4. The campaign targeted elections for city mayors and county magistrates scheduled for November 2026, the agency said
   5. The report described the use of AI technology, fake accounts and coordinated comment flooding as tactics

   Reported by Reuters and rappler.com.

   • Reuters
   • Taiwan
   • Beijing
   • Taiwan Affairs Office

3. 0302:12 UTC

   Coverage recordArs Technica: “PHP warns it plans to release 2 emergency patches imminently”

   2 outlets · first: Ars Technica Vulnerability

   Reports ran between 02:12 and 07:02 UTC on Oct 21.

   The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

   Reported by Ars Technica and securityweek.com.

   • PHP2Shell
   • PHP

4. 0407:30 UTC

   JFrog adds AI verification policies and repo-level controls to its platform

   2 outlets · first: finanznachrichten.de Security

   Machine summary JFrog Ltd. announced on October 21, 2026, new DevGovOps capabilities on its Software Supply Chain Platform, including repo-level policies and AI Verification Policies alongside a DORA compliance framework. The company says policies check each release against its stated intent in plain language and generate signed proof. JFrog describes the platform as a system of record for software artifacts, binaries and AI assets.

   1. JFrog Ltd. (NASDAQ: FROG) announced the DevGovOps capabilities on October 21, 2026 at its swampUP Europe 2026 event, according to the company's announcement.
   2. Three additions are named in the release: a compliance framework covering the EU Digital Operational Resilience Act, which is ready out of the box, repo-level policies, and AI Verification Policies.
   3. According to JFrog, these capabilities give CISOs and R&D leaders a unified, shared picture of regulatory requirements, with every release accompanied by signed evidence.
   4. Yoav Landman, JFrog co-founder and CTO, is quoted saying AI is accelerating the pace and number of releases and that proof of trust must be produced continuously.
   5. An announcement outlines rules that compare a release with its purpose using clear wording and generate a signed verification.

   Reported by finanznachrichten.de and ca.marketscreener.com.

   • European Central Bank
   • EU AI Act
   • JFrog
   • swampUP Europe 2026
   • DevGovOps
   • EU Digital Operational Resilience Act (DORA)

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.