ICHI Global Five Minute Cyber Rundown

Akari: The daily cyber rundown, brought to you by ICHI.global. I'm Akari.

Akari: Before today's news, a change to how we measure the health of the internet, starting today. Until now, the Internet Cyber Health Index leaned heavily on counting vulnerabilities. But a count alone does not say how much danger a flaw poses. So from today, the index weighs offensive capability against defensive capability, with defensive capability carrying the higher weight. In plain terms, it compares how easily attackers can turn a flaw into real damage with how well defenses stand up: patched, unexposed, and able to blunt the attack. A flaw nobody can reach should not move the score like one being exploited right now.

Akari: Now to the news, and the story that shows why that change matters: PHP2Shell. Tomorrow, October twenty-ninth, is the federal deadline to patch two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in, and both are now confirmed as exploited in the wild. Researchers recorded thirty-five successful shell executions across three honeypots, and Amazon's team spotted exploitation attempts as early as October seventeenth, days before the flaws were publicly disclosed. Patches have been out since October twenty-first, in PHP versions eight point five point twelve, eight point four point twenty-seven, eight point three point thirty-six, and eight point two point thirty-five. If you run PHP, especially on internet-facing servers, tomorrow is the line: patch, or take the system offline until you can. This is exactly the kind of flaw the new index weighs heavily: not just a vulnerability on a list, but one with proven, working exploits against systems that have not yet patched.

Akari: Next, a breach with a hardware twist. Keystone, which makes hardware wallets for cryptocurrency, has disclosed that attackers broke in through a flaw in a third-party monitoring system and reached its website and Shopify purchase records. Almost twenty-six thousand customer records were exposed, including names, contact details, shipping addresses, and purchase histories. The attackers also compromised an authentication key used to verify that Keystone devices are genuine. Keystone has suspended shipments, plans to destroy nearly nineteen thousand devices, and says no customer funds were affected. The incident was detected on October twentieth. For anyone holding one of these devices, the practical point is to follow Keystone's guidance on verifying hardware authenticity, because a compromised authentication key undermines the very trust a hardware wallet is built on.

Akari: A wider lens now, and another reason the scoring change matters. New research published today puts the gap between attackers and defenders in numbers. The Threat-Defense Gap Index reads one hundred sixty-four point seven, meaning attacker-side measures rose sharply over the past year while defender-side measures slipped. The average data breach now costs just under five million dollars, a record. Exploited software flaws now open thirty-one percent of breaches, overtaking stolen credentials. And ransomware appears in nearly half of all breaches. The message for security leaders is blunt: the pressure is rising faster than the defenses, and the flaws actually being exploited, not the total count of flaws, are doing most of the damage.

Akari: Finally, a quick update on two flaws we have tracked all week. Exploitation traffic for Node2Shell, the Brotli decoder flaw, and PolyShell, the Adobe Commerce upload flaw, continues to be recorded in honeypots, and Microsoft pushed an emergency dot net update over the weekend. Federal agencies have until November tenth to remediate both. If you run Node, Adobe Commerce, or Magento, treat these as patch-now items, and rebuild any affected container images rather than just restarting services.

Akari: One practical takeaway from the scoring change, for practitioners. Under the new weighting, your patching priority should follow proven exploitability, not the size of the list. A flaw with working exploits in the wild, running against internet-facing systems you have not yet patched, moves the score more than ten flaws with no known exploitation. So the daily question changes: not how many vulnerabilities did we find, but which ones can actually hurt us, and are our defenses holding against them. That is the lens we will use in this rundown from now on.

Akari: That is the first edition of the ICHI Global Five Minute Cyber Rundown. The new scoring is live from today, the PHP2Shell deadline lands tomorrow, and we will be watching what moves the index next. I'm Akari, and I'll see you tomorrow morning.