PHP2Hell – Joshua Wright – PSW #949

Paul Asadoorian

1. One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

   Summary: Quentin Kaiser found a remotely reachable flaw in Broadcom’s Wi-Fi WPS parser, present in its SDK since at least 2010. An attacker within Wi-Fi range can trigger it without the network password or completing WPS enrollment, then gain code execution and disclose information. He demonstrated it on routers from three Belgian ISPs; after the article’s October 20 update, Telenet was not affected, Proximus had disabled WPS pending patches, and Orange Belgium was still investigating.

   Paul's take: The useful detail here is that “remote” means over the air, without first joining the network. That puts vulnerable routers within reach of nearby attackers, while the old SDK bug and long support timelines leave a much wider set of devices to sort out. Broadcom’s refusal to assign a CVE or communicate clearly with OEMs didn’t help. Check your router and ISP’s guidance; if you have a Proximus BBox, the author says WPS has been disabled while full patching proceeds.

2. How I got over 300 Tor exit nodes removed

   Summary: A researcher found that attackers had altered more than 300 Tor exit relays to route SSH connections through 12 interception servers. Users who accepted an unfamiliar or changed SSH host key and then logged in with a password could have exposed their credentials and commands; the attacker also tried to install the Ebury OpenSSH backdoor. Tor operators and the project’s network health team removed the affected relays from exit service by October 5. The initial access method and number of affected users are unknown.

   Paul's take: The attack depended on controlling exit relays and, for password theft, getting users to accept the wrong host key and enter a password. That warning is doing its job. If you used SSH over Tor during the affected window and accepted an unexpected key, treat that password as compromised and check the server. Key-based authentication avoids this credential-theft path; it doesn’t make a compromised server harmless.

3. PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619

   Summary: VulnCheck reports independently reproducing two PHP remote code execution vulnerabilities, dubbed “PHP2Shell.” One involves memory corruption during out-of-memory handling; the other involves stale request state. VulnCheck’s early testing found exploitability on ARM64 and on x86 systems without ASLR, and expected public proof-of-concept code to trigger scanning and exploit attempts. PHP has since released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

   Paul's take: So many things to cover here, including:

   • The best source of this is here: https://calif.io/php2shell/ (I also liked the Vulncheck article linked above).
   • Something no one else is talking about yet: I confirmed in my lab that F5, Citrix Netscaler, Palo Alto PAN-OS (advisory issued), and Juniper all have affected products. You are stuck being vulnerable until they ship a firmware/OS update.
   • The botched embargo (which is hard)
   • Just how many sites are vulnerable and may never be patched
   • If you are not on the latest PHP, you won't get a patch so you have to upgrade PHP (ugly)
   • There are mitigations, and ASLR makes it more difficult though I've read reports that ARM ASLR is easier to bypass, but this has not been my experience (but I also suck at writing memory corruption exploits)
   • Don’t confuse a flood of GitHub proof-of-concept repos with working exploits or confirmed attacks.
   • The patches are out now, so check which PHP runtime and version your web applications actually use and update it. PHP says there are no complete workarounds.
4. The Internet goes on high alert after discovery of 8 compromised TLS certs

   Summary: Eight eMudhra intermediate TLS certificates had private keys that were tiny integers, ranging from 4 to 237, instead of unpredictable P-384 private scalars. Anyone who recovered those keys could create trusted certificates for other domains. Browser and application vendors began blocking the certificates, but updating other software and embedded systems will take longer; the article reports no evidence that the keys were used maliciously.

   Paul's take: 384-bit refers to the elliptic curve and the size of the private-key space. It does not mean “pick a random number between 0 and 384,” and this was a private key, not a seed. The observed key values were only 3 to 8 bits long. Ars quotes experts guessing at a botched key-generation parameter or example code escaping into production. URL: https://emudhra.we-have-a-problem.com/

   Summary: Eight eMudhra P-384 intermediate CA keys were generated as tiny integers, all below 256, making them recoverable from the public certificates. Mozilla independently recovered the keys and confirmed the flaw was in key generation. eMudhra says the keys were generated in an April 2025 ceremony using an Utimaco HSM; the company is investigating the script that invoked key generation. It says the affected certificates were mostly not put into production, and no end-entity certificates were issued from the one it identified as having been used. However, Its private key should be a randomly selected integer from 1 up to the curve’s group order, a search space of roughly 2³⁸⁴ possibilities. It does not mean “pick a number between 0 and 384.” These keys were integers below 256. We still don’t know why the generation process produced them: eMudhra says an Utimaco HSM was used and it is examining the key-generation script. So the failure is confirmed; the precise cause is still under investigation.

5. Your USB-C cables might need a firmware update. I’m serious

   Summary: The claim is real, but applies to particular cables with electronics and firmware, not to every USB-C cable. USB-IF’s Power Delivery firmware-update specification explicitly describes updating a cable’s electronics, and Apple has released firmware for its USB-C-to-MagSafe 3 cable. Apple delivers the update automatically when the cable is connected to a Mac and power adapter; the company hasn’t published what it changes. USB-IF specification · Apple cable update coverage

   Paul’s take: The headline makes a niche capability sound like a chore for everyone. Some cables contain e-markers or other active electronics; a regular passive cable won’t pop up asking for a firmware update. But the security angle is more than hypothetical: a USENIX Security study fuzzed USB Power Delivery firmware in phones, hubs, and chargers, finding 15 bugs, nine confirmed by vendors. The researchers note that these bugs could let an attacker reflash firmware. That’s evidence of risk in USB-PD implementations, though it doesn’t demonstrate a vulnerability in Apple’s MagSafe cable or in ordinary USB-C cables generally. USENIX Security 2023 study

   Further reading: USB-IF cable and connector requirements · Infineon FAQ on USB-C cables and e-markers

6. HaleHound Edition for Cheap Yellow Display

   Summary: HaleHound-CYD is an ESP32 touchscreen security toolkit for Cheap Yellow Display boards, with more than 40 functions across Wi-Fi, Bluetooth, Sub-GHz, 2.4 GHz, and NFC when paired with optional radio modules. It combines passive monitoring and defensive tools with active testing capabilities, and the project provides a Blue Team mode that disables its offensive modules.

   Paul's take: This packs a lot of radio capability into a small, inexpensive board, which makes it interesting for ( original text: authorized testing and demonstrations, my take: shenanigans). Some features transmit or interfere with nearby systems, and an interface disclaimer doesn’t authorize any activity. I’d be careful about where it’s used and what hardware is attached. Also, there are quite a few guides on how to get all of the smaller boards attached to your CYD, looks fun!

7. Claude reveals ECDSA curve origins

   Summary: Anthropic says Claude traced the seeds for the NIST P-192, P-224, P-256, P-384, and P-521 elliptic curves to the lrand48 pseudorandom number generator, initialized with Unix timestamps from 1997–98. The results make deliberate backdoors in those parameters less plausible, but don’t prove the entire curve-generation process was beyond manipulation: Anthropic couldn’t explain every seed or several base points, and it found some viable candidate curves had been skipped without knowing why.

   Paul’s take: This is a neat bit of cryptographic archaeology, and the reproducible matches are compelling. But “Claude found the origins” needs a footnote: it explains several mysterious seeds, not every choice made in constructing the curves. Anthropic says there’s no action to take and no evidence of a cryptographic break; I’d present it as reduced suspicion, not a mathematical proof that no backdoor could exist.

8. Your Docking Station Has a Patching Problem

   Summary: GBHackers combines several practical issues: on specific Dell laptops and docks, disabling an external USB setting can also prevent the dock’s LAN and firmware updater from working; separate Dell and Lenovo advisories document vulnerabilities in dock update software; and Thunderbolt/USB4 docks can expose DMA attack surfaces. The two research papers it points to—Thunderspy (2020) and Thunderclap (2019)—are real, but they study Thunderbolt security and malicious peripherals, not a newly discovered docking-station patching flaw.

   Paul’s take: The core maintenance advice is sensible, but this isn’t a new research finding: it’s a roundup of existing vendor documentation, older advisories, and well-known DMA research. The Dell setting conflict is real and narrowly scoped; the updater-tool vulnerabilities are also real, but the Lenovo one dates to 2023 and the Dell advisory to 2023. Thunderspy and Thunderclap are useful background, not evidence that ordinary docks are currently being exploited or that Thunderbolt 4 docks share the same weaknesses. There is no new dock threat.

9. Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware
10. Five Linux Kernel Exploits Enable Root and Container Escape
11. US Army reportedly developing program to deploy AI agents to autonomously seek and destroy targets

    Summary: Tom’s Hardware reports on The Intercept’s account of leaked Army Cyber Command documents describing ECHOTRIBBLE, a proposed framework for agents to navigate networks, identify and “neutralize” targets, and operate with minimal human oversight. The documents reportedly emphasize offensive use and describe self-directed, worm-like behavior. This is a procurement and prototyping effort, not evidence that an operational autonomous cyber weapon has been deployed.

    Paul’s take: I think this is a bad choice. A system that can independently move through networks and delete or disable what it judges to be a target creates obvious risks of collateral damage, misidentification, and escalation—especially when adversaries rely on compromised third-party infrastructure. “Predefined triggers” don’t solve the harder problem: who verifies the target, who authorizes the destructive action, and who is accountable when the agent gets it wrong? The Army should keep humans responsible for those decisions and tightly bind any automated tools to reversible, auditable actions.

    Sources:

    • The Intercept report on ECHOTRIBBLE
    • Anthropic’s self-replicating AI research
12. US restarts three shut-down nuclear reactors to feed AI data centers

    I think this is good news.

13. PatchSlop: How Security Patches Became Maps for Attackers

    Summary: Terra Security argues that security patches can expose where a vulnerability lived and how developers tried to fix it, helping researchers and attackers find bypasses. The company reports an eightfold increase in open-source fixes that were later found to be broken in 2026, with examples from Roundcube, the Linux kernel, and Windows.

    Paul’s take: Incomplete patches are a real, long-studied problem; the “patches as maps” framing isn’t new. Terra’s reported 2026 jump is the fresher claim, but its post doesn’t provide a dataset, code, or enough methodological detail to independently verify the eightfold figure. The examples support careful patch review and follow-up testing, but don’t establish that patches have suddenly become a new or unusually dangerous attacker resource.

    Further reading:

    • A Large-Scale Empirical Study of Security Patches (2017)
    • A Large-Scale Analysis of the Effectiveness of Publicly Reported Security Patches (2025)
    • Akamai’s analysis of the incomplete Windows patch behind CVE-2026-32202
    • Roundcube’s advisory for CVE-2026-35540
14. From Authentication Bypass to Full Camera Compromise – OPSWAT
15. Open firmware for the Insta360 Wave speakerphone

Larry Pesce

1. Fake data may activate Japan’s emergency alert: expert

   When Japan started operating the J-Alert system in 2007, cyberattacks on the satellite communications system were not considered a real threat, leading the government to delay taking countermeasures.

2. Hackers heat French supermarket fridges, sparking fires and spoiling food
3. One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
4. The Internet goes on high alert after discovery of 8 compromised TLS certs
5. PHP
6. Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

Lee Neely

1. Critical Vulnerabilities in PHP Require Immediate Patching

   Summary: CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities.

   Lee's Take: Beware of these being categorized as a WordPress specific flaw. If you've got PHP, update. If you're using a hosting provider, they should have the updated versions by now. You may have to go to php.net for your OS distribution if their package repos don't have the new version. There are no fixes for PHP 8.1 and below, these are unsupported and vulnerable; you must move to PHP 8.2+

2. F5 Patches Critical Flaws in NGINX

   Summary: F5 published a security advisory that addresses 11 vulnerabilities in NGINX. CVE-2026-15176 and CVE-2026-93479, both with CVSS scores of 9.2, are heap-based buffer overflow issues in NGINX Plus and NGINX Open Source; SCWorld writes that "these flaws can be exploited by unauthenticated attackers through crafted HTTP requests, potentially leading to denial-of-service conditions or remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. The vulnerabilities are triggered under specific configurations involving the alias directive and the $request_filename variable, or when regular-expression capture variables are used in certain ways within the map directive." A third critical vulnerability CVE-2026-97205, CVSS score 9.2, is a use-after free issue in the ngxhttpcore_module that could be exploited to bring about memory corruption or a worker process crash

   Lee's Take: F5 is the primary maintainer of NGINX after acquiring NGINX Inc in 2019. In other words, this isn't just about your F5 appliances. While F5 lists some mitigations to the NGINX flaws, it's far better to update. Fortunately, it looks like the updates to the relevant NGINX software include all the fixes. Unfortunately, you're going to have to check all your NGINX, BIG-IP and F5 products for applicable updates. This would be a good time to verify you're on the most current supported versions of these products.

3. ARMORY CASTLE Exploits BeyondTrust

   Summary: Threat intelligence reports and security advisories from BeyondTrust, Google Threat Intelligence Group (GTIG), and Mandiant describe exploitation of a critical flaw affecting BeyondTrust Remote Support up to and including version 26.2.3. This exploitation was allegedly conducted by a threat actor associated with the Chinese government, months before the vulnerability was patched. CVE-2026-102764, CVSS score 9.3, allows a remote attacker to perform file operations on the appliance because internal components do not adequately validate the origin of received messages. The patch was released on October 8, but exploitation seems to have begun on August 29, 2026.

   Lee's Take: Remote support services, like Beyond Trust, are likely a critical success factor for your help desk. And these services are now an active target. After you've made sure that your implementation is fully updated. Since the discovered exploits pre-date the fix, grab the IoCs from the Google/Mandiant blog and make sure that you're clean. Next, and here's where it gets harder,  go through the targeted compensating controls to suppliment the patch. These include network restrictions, credential rotation, configuraton review, phishing-resistant MFA, setting the default Jump Admin policy to No Access and reducing permissions. Did I mention making sure logs go to your SIEM and implementing monitoring? In other words, harden the environment. While you've got all those plates spinning, have someone take a look and see if the hosted SaaS version of your remote support client is viable, it's one less component to keep updated.

4. PSA: Patch your Plex media server before someone hacks it

   Summary: One high-severity and three medium-severity fixed flaws in Plex Media server were under exploitation in the wild within a day of a researcher publishing proof-of-concept (PoC) details for the exploit chain. When Plex first published the September 1 advisory recommending users update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0, these four flaws were still awaiting CVEs and descriptions. CVEs were assigned on September 23; a researcher, "zmain," published the "Plex2Shell" chain PoC on October 16, and on October 17 a separate researcher, "boredhackerblog," observed in-the-wild exploitation in honeypots, including attempts to drop a cryptocurrency miner and potentially set up a residential IP proxy. The chain consists of two server-side request forgery vulnerabilities (CVE-2026-96652 and CVE-2026-96655, both with CVSS score 5.3), improper neutralization of encoded URI schemes in a web page (CVE-2026-96654, CVSS score 6.9), and external control of file name or path (CVE-2026-96656, CVSS score 8.6). Plex users should ensure they are using version 1.43.3 or later; boredhackerblog also notes that zmain has published detections for this exploitation.

   Lee's Take: You've got that Plex server you're using to stream content to your devices, and remember how you set it so that your buddy across town could check some of your stuff out too? What do you bet Shodan has your device and information available - go look! Grab another cup of coffee, update to the latest version, review your external access (port 32400), check for the IoCs (in the boredhackerblog) If they can use the flaw to deploy a crypto miner, they can use it to deploy something else, so if you don't need to expose the service, patched or otherwise, don't. Your Plex server has three things they want, cyclesl, storage and Internet access.

   Further reading:

   • Boredhackerblog
   • Zmain blog
5. ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

   Summary: Late last week, ConnectWise published an advisory noting that it "identified unauthorized access to application identities within the ConnectWise Cloud Backup [formerly known as SkyKick] environment." In response, ConnectWise decided to temporarily suspend service to several ConnectWise application identities: ConnectWise Cloud Backup; ConnectWise Cloud Management; ConnectWise Cloud Management - MS Teams; ConnectWise Cloud Management - Exchange Online; ConnectWise Cloud Management - MS Graph; ConnectWise Cloud Management - Partner Center; and ConnectWise Cloud Management - SharePoint Online.

   Lee's Take: Remember that pitch on how you could get your M365 environment fully backed up and you wound up implementing ConnectWise? Here we are with a third-party issue. At this point your ConnectWise services should not be enabled. Right now, while you don't get new backups, the existing backups remain encrypted, preserved, and isolated. ConnectWise has to finish rotating credentials and developing guidance moving forward to prevent recurrence. While that is sorting itself out, review your M365 environments for unexpected accounts, and unauthorized privileges in concert with your MSP. It's too soon to be second guessing your choice to use ConnectWise versus something else.

6. Ahold Delhaize update on status of cybersecurity incident

   Summary: Ahold Delhaize has published an update regarding a previously disclosed cybersecurity incident that has disrupted systems at multiple stores in the EU and the US. Ahold Delhaize disclosed the incident on Monday, October 12. After discovering the incident, the company engaged third-party cybersecurity experts. A subsequent investigation has determined that the incident was caused by the activity of malicious threat actors. The company proactively took certain systems offline, which affected most of Ahold Delhaize's brands in the EU and the US. While stores have remained open to customers, the company is restoring disrupted services in phases; online shopping is still not available at all stores.

   Lee's Take: You may recall I was not happy about Ahold Delhaize's notificaiton regarding offline services. This is much better - they are publishing ETAs for systems, where known, as well as acknowledging what remains offline/in-progress even when they don't have an ETA. Some sites have a list of services with a up/down indicator, while AD is describing status in text. Both work, the point is to notify and keep people updated during an outage without that notification overshadowing or impacting the incident recovery and and response.

7. Baltimore suburb confirms August data breach after ransomware claims

   Summary: Anne Arundel County, Maryland officials have disclosed that data from government systems were stolen during an August 2026 cybersecurity incident. A spokesperson for the county said that they detected anomalous activity on August 28; a subsequent investigation "determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems." Investigators are attempting to determine whether any of the stolen data contain information about the county's more than 600,000 residents. Federal agencies with offices or headquarters in Anne Arundel County include the Defense Department, the Internal Revenue Service, the Environmental Protection Agency, the Social Security Administration, the Department of Agriculture, and the US Coast Guard. Ransomware threat actors have claimed responsibility for the attack and have threatened to leak 2.6 terabytes of data if they do not receive $2 million.

   Lee's Take: This is a tale of two incidents. The first was detected in May of 2025, and the investigation and review of systems just finished, with notices being sent to affected individuals last week, 17 months later. The second occurred August 28, 2026, which they are investigating now. This has got to be rough, while the Rhysida ransomware gang is taking credit for the second incident, it's not clear if the attackers took advantage of mitigations not fully implemented, or other new weaknesses, or if maybe the second incident was discovered while investigating the first. No matter how you look at it, this has to be rough on the team. I hope they publish some lessons learned we can leverage.  In the meantime, tighten up those investigation timelines, particularly implementing remediations/hardening. Make sure that you fully implement countermeasures, such as MFA, monitoring, WAF (defense in depth) , and risk-based updates. Our adversaries are using tools to find weaknesses at an ever-increasing rate, forcing us to use more aggressive approaches to raising the bar. In the long term it's worth it, make sure you're keeping senior management on-board while your team implements.

8. ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

   Summary: Last week, multiple vendors released updates for industrial control systems (ICS) products. Siemens published 17 advisories, which include fixes for some of the vulnerabilities, and suggested mitigations for others, which users are urges to apply until patches are available. On Monday, October 19, Siemens disclosed that it "has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center." The vulnerability is addressed in Siemens Software center version 4.0.9.8 and published an associated advisory, SSA-580366, on October 15. Schneider Electric published two advisories, both high severity: CVE-2026-96434 involves use of unmaintained third-party components and affects all versions of Pro-face STW6000 and Harmony STW6; CVE-2026-102250 involves insufficient verification of data authenticity and affects Sage RTU 1410, Sage RTU 1430, Sage RTU 1450, Sage RTU 2400, Sage RTU 3030 Magnum, and Sage RTU 4400. Rockwell Automation published one advisory that addresses two high severity vulnerabilities in 1732E ArmorBlock®: CVE-2026-12655 (CVSS score 8.8 / 9.1) is an authentication bypass by capture replay issue that could be exploited to change a device's web server password; CVE-2026-12656 (CVSS score 7.5 / 8/7) is an allocation of resources without limits or throttling issue that could be exploited to cause denial-of-service conditions. In addition, the US Cybersecurity and Infrastructure Security Agency (CISA) published seven ICS advisories last week, including one for Swann SWIFI-SE2KIC camera vulnerabilities and another for a privilege escalation issue in Inductive Automation’s Ignition product. Germany's CERT@VDE (Germany) has published an advisory addressing a privilege escalation vulnerability in Bender’s Customer&Partner platform." SecurityWeek also notes that multiple vendors published advisories over the past month: Moxa, Honeywell, Hitachi, Hitachi Energy, Johnson Controls, and ABB.

   Lee's Take: Remember those OT/ICS systems which take a licking and keep on ticking? You need two things here, first plans for how they are being kept updated, and second how they are protected. The owners are not going to be keen on rapidly applying updates, which is why the protections are key. Verify how they are isolated so only authorized systems can interact, and make sure you've got monitoring and alerting, there are systems which understand the proprietary protocols these talk and will detect anomolies as well as new/unexpected traffic which you need to investigate. Remember, availability is king, downtime is a nasty four-letter word, and the system owners don't want to be compromised any more than you do. Odds are these are systems which really are keeping the lights on.

Sam Bowne

1. The Blind Spots of Agentic Pentesting and How to Close Them

   Thorough agentic pentesting uses a lot of tokens, which makes it expensive. That’s why deterministic automated pentesting is still needed. It’s less creative, but it delivers consistent testing, costs less, and finishes faster, so it can run far more often. It follows repeatable steps, allowing teams to compare runs over time and reliably retest fixes. But a serious limitation is that a lot of systems are out of scope: organizations pentest only 32% of their attack surface on average. Instead, indirect evidence must be used to assess vulnerability: breaking the CVE down into the attacker behaviors required to exploit it and testing each behavior against your live security controls.

2. AI Slop Isn’t Just for Social Media; It’s Ruining Cyberattacks, Too

   Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it. Threat actors are using AI to increase noise, but it decreases their sophistication.

3. AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds

   "Frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes." These agents were given no prior knowledge of the OT in question: neither source code, nor engineering documents, nor advanced OT guidance. Existing defenses blocked or slowed some actions, but no single safeguard consistently stopped the autonomous models from achieving their objectives. “Owners and operators should focus less on predicting every form of frontier AI use in an attack and more on making their environments difficult to traverse, removing implicit trust, detecting consequential industrial changes quickly, and limiting what an attacker can affect after gaining access, whether through cyber or physical means.”

4. Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

   The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, from a web page all the way to the computer. The six-day run cost about $40,000 in AI charges.

5. Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility

   SB 73 attempted to regulate adult websites by requiring them to block VPN users or to identify the physical location of visitors using them or similar tools that mask their network traffic. It even went so far as to prohibit websites from offering instructions on how to use a VPN to bypass these checks. The Utah federal court halted enforcement of the law's VPN provisions last week, ruling that the law likely violates the U.S. Constitution's prohibition on passing laws that significantly burden businesses and people outside Utah's borders.

6. Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

   The flaw is in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a Wi-Fi network without the password being typed in. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so an attacker in range can send crafted messages that corrupt the router's memory. Broadcom's WPS code is embedded in routers and access points from dozens of vendors, and the researcher estimates that millions of devices worldwide are affected.

7. Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

   U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group. Investigators also unraveled a murder-for-hire plot involving one of the ShinyHunters leaders. One person involved is an executive at a U.S.-based consulting firm more than 1,000 associates.

8. India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1

   This should help people identify calls from unknown numbers and tackle spam or fraudulent calls.