PHP attack attempts, Apple’s Australian app-store order

Researchers confirm PHP2Shell code execution on a decoy server

On the decoy server, a function address derived from exposed memory data appeared in the later PHP2Shell execution payload, Karimi says. The deliberately favourable setup does not establish reliability elsewhere. Unit 42 separately withdraws its PHP2Shell link to a European government breach. Security agencies urge operators to install the PHP fixes released on 21 October.

Australia’s federal court orders Apple to open its mobile platform

Australia’s federal court has ordered Apple to open iOS after finding a competition-law breach. The remedies require alternative app distribution and payments from 1 March 2027, unless the court approves an extension, and require Apple to readmit eligible Epic Games apps upon written application.

Meta faces Australian class action over alleged harm to children

Meta faces an Australian class action seeking compensation for alleged childhood harm linked to Facebook and Instagram. The company says it will defend itself vigorously as the eight plaintiffs’ compensation claim awaits a court decision.

New Mexico judge orders Meta to pay $25 billion penalty

A New Mexico judge has ordered a $25 billion penalty against Meta, CNA reports. The judgment is separate from August’s youth-platform settlement, and Meta warns that continuing US trials over youth-related issues could affect its financial results.

Updated

ConnectWise suspends Cloud Backup after unauthorized sign-ins

ConnectWise’s Cloud Backup suspension stopped scheduled backups and access to restoration. Microsoft describes attempts at more than 2,250 customer environments, not confirmed compromise of all of them; Huntress reported more than 300 successful sign-ins by 17 October, and administrators are advised to keep affected connections disabled pending formal restoration instructions.

32 UK government websites go offline as a precaution, Guardian reports

The Guardian reported on 22 October that 32 UK government websites had been taken offline as a precaution after a PHP flaw was found. A minister reported 32 unavailable services and four partly unavailable services, saying departments were working to restore access safely after security fixes.

US judge rejects bid to end SpaceXAI pollution lawsuit

US District Judge Debra Brown rejected the government’s claim that the Environmental Protection Agency could unilaterally dismiss the NAACP’s case against SpaceXAI. The ruling does not establish pollution liability; the government has until October 23 to explain its grounds for participating or stay out of the case.

US Commerce Department plans $389 million for chip research

The US Commerce Department plans $389 million for four chip and materials research projects. Helion says its proposed share would support manufacturing in Washington State and semiconductor development in Vermont, but the funded research would benefit later plants rather than Orion’s planned 2028 launch.

Updated

Cloudflare says eMudhra compromise requires updates and trust checks

Cloudflare’s fixes address certificate-based authentication after the eMudhra compromise, not weaknesses in TLS encryption algorithms. Chrome plans to remove trust in the affected certificate root on 27 October, putting about 30,800 unexpired certificates at risk of rejection and requiring affected website operators to install replacements.

Apple releases iPhone Duo with limited availability

Apple released the iPhone Duo on 23 October, according to The Hollywood Reporter. The feature describes Netflix, baseball and cooking app layouts that put video alongside controls, statistics or instructions, showing practical uses for the folding display after earlier reviewers found uneven app support.

Walmart plans AI shopping profiles with purchase controls

Walmart plans customer profiles for November and has announced an AI shopping gateway. The retailer says agents will be able to find customers’ usual products without receiving their broader purchase history, while its returns process will also cover purchases when an agent does not act as intended.

Tesla targets Cybercab customer deliveries by end of 2026

Tesla targets initial Cybercab customer deliveries by the end of 2026, though Elon Musk says most vehicles would remain company-owned for ride-hailing. The US auto safety agency is examining Tesla’s compliance certification, with the company’s response due October 30.