PHP patches two critical flaws in an emergency release

PHP team releases emergency fixes for two critical flaws

PHP’s security team released emergency fixes on 21 October for two critical PHP2Shell flaws. On 23 October, it advised operators with unusual session configurations to retain a separate mitigation for CVE-2026-115560, which remains unpatched and is being handled through the regular release cycle.

PHP server operators face attack attempts after emergency fixes

PHP server operators face attack attempts after emergency fixes released on 21 October. Polygon reported on 24 October that Square Enix had begun allowing Final Fantasy 14 logins again after roughly a day of work; housing auto-demolition is scheduled to resume on 26 October.

UK regulator finds children’s exposure to harmful content largely unchanged

Ofcom found no significant overall change in children encountering harmful content, or evidence that the severity of harm changed, during the first nine months of the UK’s child-safety duties. It reports reductions on some platforms, while the government plans an under-16 social media ban from spring 2027.

SafePay breaches at least 600 organizations, agencies say

SafePay has breached at least 600 organizations across four continents, the agencies say. Their advisory identifies known software flaws and compromised logins as entry points for attacks that spread through networks before stealing data and deploying ransomware.

Updated

US voting and privacy groups sue Homeland Security over voter data

US voting and privacy groups sued Homeland Security to halt its voter-data policy and seek deletion of the records. In a separate case, a judge cited reviews capped at 12 minutes and unreliable commercial records to support nine-state investigation restrictions set to expire on 3 November unless otherwise ordered.

Greece’s parliament bans social media for children under 15

Greece’s parliament has approved a social-media ban for children under 15. Minister Dimitris Papastergiou says the Kid’s Wallet app communicates only whether users are over or under 15, offering an age-checking approach ahead of the ban’s January 1, 2027 start.

Google says it has restored London cloud services

Google says it restored its London cloud services after the 20 October outage. European and UK regulators are seeking information about the banking disruption, while the UK Treasury committee has asked about its scale and any financial harm, with an initial response due by 4 November.

32 UK government websites go offline as a precaution, Guardian reports

The Guardian reported on 22 October that 32 UK government websites had been taken offline as a precaution after a PHP flaw was found. A minister reported 32 unavailable services and four partly unavailable services, saying departments were working to restore access safely after security fixes.

US Homeland Security bans DeepSeek from civilian agency systems

US Homeland Security’s ban requires civilian agencies to remove DeepSeek products and related third-party services and bars new purchases. Reporting on 21 October details how covered contractors must check for orders, investigate suppliers and report prohibited products, with later orders reaching existing contracts through amendment or modification.

US Homeland Security Department orders civilian agencies to remove DeepSeek

The US Department of Homeland Security has ordered DeepSeek technology removed from federal civilian systems. Issued in July and made public on October 19, the order extends earlier agency-level restrictions across civilian agencies, requiring removal of covered third-party tools as well as DeepSeek’s own products.