1). What

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…

As if PHP2Shell wasn't enough for one day... now GitLab. 😅 🚨 CRITICAL GITLAB ALERT (CVSS 10.0) CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers. ⚠️ Potentially affects 12 years of releases, dating back to 2014. Patches available. Update immediately! docs.gitlab.com/releases/pat… #gitlab #cybersecurity

🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity. → REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely. → TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions. → Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to. → THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates. → RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches. → PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers. PHP AND Node.js both facing major security disclosures on the SAME DAY. If you run a website or application, TODAY is the day to check your servers. And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated. Don't be the last one to patch.

HAHAHAHAHAHA So 70% of all websites are about to be an attack vector wiz.io/blog/php2shell-php-rc…