DeepCove’s monthly security briefing
Security news for the AI and quantum era, updates from our team, and a recipe worth making. Sent from DeepCove HQ once a month.
The DeepCove Deep Dive™ IR Framework. We go deeper, so you surface stronger.
The exploit window is closing
Nearly one in four exploited vulnerabilities this year was under attack before defenders even had a CVE to track, according to VulnCheck’s State of Exploitation 1H-2026 report. Attackers are now using AI to turn fresh advisories into working exploit code faster than ever, which leaves very little time between disclosure and compromise.
For MSSPs, monthly patch cycles are no longer enough. Vulnerability management now has to be continuous, prioritized by what attackers are actually exploiting, and backed by 24/7 detection and response. For clients, being patched is only part of the picture. It is just as important to know which exposures could hurt you this week, and how quickly you can respond if one is exploited.
The DeepCove Team
Source: VulnCheck, State of Exploitation 1H-2026 (July 2026)
Software and the internet are in an escalating security crisis as more and more vulnerabilities are found and exploited by large language models, agents and agentic swarms. Traditional approaches to cybersecurity are under pressure to transform and address this challenge by using AI approaches to detect and defend against vulnerabilities and attacks as the idea that humans alone can protect and defend against AI powered attacks is showing to be unworkable.
At the same time code is becoming more fungible and it is becoming easier and easier to develop and rebuild new software as the recent ArtCraft copies of Photoshop and other creativity and productivity software show. While some open-source projects have outright rejected AI contributions, Linus the founder of Linux recently embraced using LLMs and lifted the requirement to disclose the use of LLM in contributions to Linux code.
A new age of personal empowerment has started, where everyone can be a developer and vibe code the workflow and software solution that best fits their needs, even if that vibe coded software of today is still widely insecure, those security software security gaps are being quickly addressed with new (and old) techniques to ensure correctness.
While AI is coming for software it is also challenging its fundamentals, mathematics, with the apparent solving of Navier-Stokes, and 700 math papers released by OpenAI, and the formalization of proofs using AI and theorem provers. Entire areas of mathematics are being disrupted with mathematicians pushing back and questioning the future of their profession.
AI is also shaking the foundations of cryptography and encryption, built on math and code, and while the looming challenge of emerging Quantum Computers to some types of “classical” cryptography pushes the need for new post-quantum algorithms that can resist them, AI is finding new weaknesses in both current encryption algorithms and post-quantum ones.
While AI continues to take focus for organizations, quantum computing is poised to further accelerate innovation, with more stable and reliable quantum computing hardware, quantum simulators, and LLMs and models are also becoming increasingly instrumental in programming and improving algorithms and circuits for quantum computers, powering new discovery capabilities for drug discovery, material science, logistics and financial modeling.
We are only in the early innings of a power transformation of our digital world.
Mike Krygier · Founder, DeepCove Cybersecurity
Critical PHP flaws under active attack
On October 21, the PHP project released emergency fixes for two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Any PHP installation that serves web traffic is in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. That covers most WordPress, Drupal and other PHP-based websites.
Attacks started before the fix was public. Amazon recorded an exploitation attempt on October 17, four days before disclosure, and Patchstack and Cloudflare reported active attacks on release day.
Patched versions
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- PHP 8.1 and older are no longer supported. Get a fixed build from your Linux distribution or LTS vendor, or upgrade.
- Restart PHP workers after updating, and check every copy of PHP you run, including containers and bundled applications.
If your site is hosted on Kinsta
- Kinsta manages PHP at the platform level and rolled out patched builds for PHP 7.4 through 8.5 on October 21. There is nothing to install yourself.
- To apply the patch right away, Kinsta advises switching your site to another PHP version and back in MyKinsta.
- Kinsta has added Cloudflare firewall rules and server configuration changes for all sites, and says they will stay in place until further notice.
If your site is behind Cloudflare
- Cloudflare has deployed WAF rules against known PHP2Shell exploit attempts for all customers, including the free plan.
- Confirm the Cloudflare Managed Ruleset (or Free Managed Ruleset) is turned on and set to block.
- Lock your origin server so it only accepts traffic from Cloudflare. Otherwise attackers can bypass the WAF by going straight to your server.
- WAF rules buy time but do not replace patching. Cloudflare has already seen attackers trying to get around them.
If you cannot patch today
- Set
session.upload_progress.enabled=0at the server or PHP-FPM pool level, then restart workers. - Cap request and upload sizes at the web server or proxy, and block multipart form uploads if your site does not need them.
- Restrict public access to unpatched systems, or take them offline.
- Review logs from October 20 onward for unusual requests, PHP worker crashes or unexpected commands. If anything looks wrong, rotate credentials and start an investigation.
Need help? DeepCove can find every PHP instance in your environment, confirm patches are applied, configure your Kinsta and Cloudflare protections, and investigate any signs of compromise.
Contact UsSources: Qualys, Help Net Security, Recorded Future, Kinsta Status (October 2026)
Japan’s breach wave
Japanese companies disclosed several large breaches this month. Sourcenext reported 22.5 million member records exposed through an abused API, travel site skyticket 14.6 million, Burger King Japan 11.2 million app members, and Yakiniku King operator Monogatari 10.8 million. A ransomware attack on IDC Frontier, SoftBank’s cloud subsidiary, disrupted 495 customer organizations. On October 21, a vendor breach was reported to have potentially exposed details of 125,000 police officers and staff.
In many cases, attackers pulled API endpoints and keys out of public mobile apps, then abused internal APIs or exposed admin functions. Others exploited a critical Metabase flaw (CVE-2026-72898) or came in through contractors and hosting providers. Japan’s government has told ministries and companies to tighten their defenses, new active cyber defense powers took effect on October 1, and a senior ruling party official called it “a state of emergency in cyber space.”
Lessons for Canadian organizations
- Keep API keys and database credentials out of mobile apps and browser code, even if that code is obfuscated.
- Enforce access control and rate limits on every API endpoint, including ones you consider private.
- Include admin functions in penetration tests, and keep them off the public internet where possible.
- Hold suppliers and hosting providers to the same security standard as your own systems.
- Delete personal data once you no longer need it.
Sources: The Hacker News, TNW, Malware News, The Japan Times (October 2026)
Company updates
Two new hires join the team
Please welcome the newest members of DeepCove: our Senior Client Solutions Manager and our vCISO.
DeepCove at SecTor 2026
Our CTO, Kellman Meghu, and the DeepCove executive team represented DCC at SecTor 2026 in Toronto, Canada’s premier IT security conference.
Layered Defense Lasagna
Security people love defense in depth, where several independent layers mean one failure doesn’t sink the whole system. Lasagna works the same way. This recipe comes from our own kitchen.
Attack Surface (Ingredients)
- 12 lasagna sheets
- 1 lb (450g) ground beef or Italian sausage
- 1 small onion, diced
- 3 cloves garlic, minced
- 1 can (28oz) crushed tomatoes
- 2 tbsp tomato paste
- 1 tsp dried oregano, 1 tsp basil
- 15 oz ricotta cheese
- 1 egg
- 3 cups shredded mozzarella
- ¾ cup grated parmesan
- Salt, pepper, olive oil
Hardening Steps (Method)
- Brown the beef with onion and garlic in olive oil; season with salt and pepper.
- Stir in crushed tomatoes, tomato paste, oregano and basil. Simmer 20 minutes. This is your perimeter layer.
- Mix ricotta, egg and half the parmesan in a bowl for the internal control layer.
- Boil lasagna sheets until just pliable, per package instructions.
- Layer in a 9×13 dish: sauce, noodles, ricotta mix, mozzarella. Repeat three times.
- Top with remaining mozzarella and parmesan. Cover with foil.
- Bake at 375°F (190°C) for 35 minutes covered, then 15 minutes uncovered until golden.
- Rest 10 minutes before cutting. Let the layers hold before you probe them.
Know someone who’d get value from this?
Forward it along, or point them to a no-obligation assessment.