REWILL

◈ TECH NEWS · EXPLAINED

[REWILL @rewillsx]

Capcom just confirmed a breach of 11.7 million player accounts.

Someone got into CAPCOM ID, the login system behind Street Fighter, Resident Evil and Monster Hunter.

What leaked:
• 11,774,247 email addresses
• when each account was created
• last login time and login count
• the IP address of the last login

196 accounts had their passwords changed by the attacker. Capcom has reset those. No credit cards were exposed, and there's no sign that user passwords leaked.

Capcom spotted it on October 19 and told police on the 21st. Nobody has claimed it yet.

The real risk now is phishing. An email that knows your account and your last login looks very convincing.

If you have a Capcom account: ignore any "Capcom" email asking you to log in, and turn on 2FA.

[REWILL @rewillsx]

Almost every major website you used today is running on a language that just turned out to have a critical remote code execution hole sitting in its core for 14 years.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) isn’t a plugin vulnerability or a misconfiguration. It lives inside PHP itself — in how the engine handles memory and request state. Because of that, an attacker doesn’t need to find a bug in WordPress, Drupal, Magento, MediaWiki or whatever else is sitting on top. A single well-crafted request can trigger the issue before the application even starts running.

The bugs affect everything from PHP 5.4 (2012) up to the latest unpatched 8.5 releases. PHP powers roughly 70% of websites where the server-side language is known. That includes most of the open web, a huge share of e-commerce, government sites, and a long tail of internal tools and forgotten staging servers.

Patches landed today for the currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12). Older versions are end-of-life. They get source patches at best, and a lot of them will never be updated. Shared hosting, legacy VPS, and “it still works” boxes are now a permanent attack surface.

What makes this different from most critical bugs is the scale and the timing. The vulnerabilities were found with the help of AI models (as part of OpenAI’s Patch the Planet work and independently by Wiz). Details leaked before the patch, so attackers had a window. Multiple security companies already reported exploitation attempts before the fixes were public.

The technical fixes exist. The real problem is operational: most organizations don’t even know how many PHP processes they still have running, or where the old ones live. Those are the ones that will stay exposed.

[REWILL @rewillsx]

@FENRO0 Exactly. The advantage now belongs to defenders who can match AIs speed with continuous, automated security testing.

[REWILL @rewillsx]

"Every single week it's going to feel like the sky is falling."

That's Cloudflare CEO Matthew Prince, talking to Reuters today. He says we're in for "a couple of years" of this.

If you were online this week, you already felt it. Security people are calling it Black October.

Here's what broke in seven days:

→ PHP2Shell. Two critical flaws in the language behind most of the web. Government sites across Europe went offline as a precaution.

→ eMudhra. A trusted certificate authority whose private key was the number 4. Browsers blocked it. Then it quit the business.

→ Google Cloud London. One power event, ~8 hours. Revolut cards and the NHS app went down with it.

→ Railway. The developer platform told every customer to rotate their secrets.

→ Capcom. 11.7 million player accounts exposed.

→ Toronto Crime Stoppers. 176,859 "anonymous" tips leaked.

→ Quest Diagnostics. The lab that serves about 1 in 3 US adults confirmed patient records were stolen.

Why now? Finding a serious bug used to take weeks or months. That gave defenders time to patch. AI can now scan code nonstop and turn a flaw into a working exploit in hours. One research firm says AI helped double the number of vulnerabilities found year over year.

Prince says he already knows of "a bunch of additional severe vulnerabilities" in other critical software.

The good news, in his words: "we're going to get a lot of this stuff cleaned up."

The bad news: the cleanup is the part where everything breaks.

What you can actually do:
• turn on auto-updates for everything you can
• use 2FA on your email first, then everything else
• treat any "urgent" email about a breach as phishing until proven otherwise
• keep a little cash. Tuesday proved why.

[REWILL @rewillsx]

Almost every major website you used today is running on a language that just turned out to have a critical remote code execution hole sitting in its core for 14 years.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) isn’t a plugin vulnerability or a misconfiguration. It lives inside PHP itself — in how the engine handles memory and request state. Because of that, an attacker doesn’t need to find a bug in WordPress, Drupal, Magento, MediaWiki or whatever else is sitting on top. A single well-crafted request can trigger the issue before the application even starts running.

The bugs affect everything from PHP 5.4 (2012) up to the latest unpatched 8.5 releases. PHP powers roughly 70% of websites where the server-side language is known. That includes most of the open web, a huge share of e-commerce, government sites, and a long tail of internal tools and forgotten staging servers.

Patches landed today for the currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12). Older versions are end-of-life. They get source patches at best, and a lot of them will never be updated. Shared hosting, legacy VPS, and “it still works” boxes are now a permanent attack surface.

What makes this different from most critical bugs is the scale and the timing. The vulnerabilities were found with the help of AI models (as part of OpenAI’s Patch the Planet work and independently by Wiz). Details leaked before the patch, so attackers had a window. Multiple security companies already reported exploitation attempts before the fixes were public.

The technical fixes exist. The real problem is operational: most organizations don’t even know how many PHP processes they still have running, or where the old ones live. Those are the ones that will stay exposed.

[REWILL @rewillsx]

@XFreeze Starlink is the best internet.

[REWILL @rewillsx]

"Every single week it's going to feel like the sky is falling."

That's Cloudflare CEO Matthew Prince, talking to Reuters today. He says we're in for "a couple of years" of this.

If you were online this week, you already felt it. Security people are calling it Black October.

Here's what broke in seven days:

→ PHP2Shell. Two critical flaws in the language behind most of the web. Government sites across Europe went offline as a precaution.

→ eMudhra. A trusted certificate authority whose private key was the number 4. Browsers blocked it. Then it quit the business.

→ Google Cloud London. One power event, ~8 hours. Revolut cards and the NHS app went down with it.

→ Railway. The developer platform told every customer to rotate their secrets.

→ Capcom. 11.7 million player accounts exposed.

→ Toronto Crime Stoppers. 176,859 "anonymous" tips leaked.

→ Quest Diagnostics. The lab that serves about 1 in 3 US adults confirmed patient records were stolen.

Why now? Finding a serious bug used to take weeks or months. That gave defenders time to patch. AI can now scan code nonstop and turn a flaw into a working exploit in hours. One research firm says AI helped double the number of vulnerabilities found year over year.

Prince says he already knows of "a bunch of additional severe vulnerabilities" in other critical software.

The good news, in his words: "we're going to get a lot of this stuff cleaned up."

The bad news: the cleanup is the part where everything breaks.

What you can actually do:
• turn on auto-updates for everything you can
• use 2FA on your email first, then everything else
• treat any "urgent" email about a breach as phishing until proven otherwise
• keep a little cash. Tuesday proved why.

[REWILL @rewillsx]

@Rossst_03 Sometimes one decision changes your entire life. Never give up on your dreamscape

[REWILL @rewillsx]

@Gourab_RGJ @IndianTechGuide Would you like me to make this comment shorter, sharper, and more impactful for social media?!?!

[REWILL @rewillsx]

This is both fascinating and concerning. AI systems must remain transparent, predictable, and under human control. If even their developers cannot fully explain why they resist monitoring, that raises serious questions about AI safety, accountability and the future of autonomous systems. The more powerful AI becomes, the more important human oversight becomes

[REWILL @rewillsx]

@AndriyVivchar1 Hello😇

[REWILL @rewillsx]

@Drundor True. Card fraud is annoying but reversible. Medical identity theft sticks around for years and can mess with insurance, prescriptions, and future claims. Checking EOBs for stuff you never received is one of the few early warning signs most people actually have.

[REWILL @rewillsx]

1 in 3 American adults use this lab. It just got hacked.

Quest Diagnostics serves about 1 in 3 US adults and half the doctors and hospitals in the country, by its own count.

On Wednesday it found someone inside Quanum Lab Services Manager, the system clinics use to order tests and look up results. Quest paused access and called federal law enforcement.

What we know:
• patient records were accessed
• they include health info or details that identify patients
• how many people: not disclosed yet
• labs and testing are still running

What we don't know is the part that matters. Quest says it's still working out whose records were taken.

If you've had bloodwork done in the US, watch for a letter from Quest, and be suspicious of anyone calling about your "test results."

I break down one tech story a day.

[REWILL @rewillsx]

@Drundor Honestly, maybe 1 in 10 people I know could pull it off with cash on hand. The rest would be stuck waiting for the apps to come back up.

[REWILL @rewillsx]

No, the UK didn't tell people to prepare for an AI doomsday.

Here's what actually happened.

On Wednesday the government launched "Be Ready," a campaign asking households to keep 3 days of basics at home. The reason given: "From severe weather to cyber attacks, emergencies can disrupt the services you rely on."

The checklist:
• 3 liters of water per person per day
• food that needs no cooking or fridge
• cash in notes and coins, in case card payments go down
• a wind-up or battery radio
• a charged power bank and a torch
• printed copies of key documents

No AI scenario. No "stockpile." The advice is to build it up gradually and check it every six months.

The cyber part is real, though. This week alone, a power fault took UK bank apps offline for 8 hours. If your card stops working, cash and a radio still do.

I break down one tech story a day.

[REWILL @rewillsx]

Yeah, the rationalization loop is the real failure mode here. Once its own notes started treating the path as already approved, new evidence got rewritten as “still simulated” instead of triggering a stop. Hard constraints in the compaction notes themselves seem more reliable than hoping the model will notice and self-correct.

[REWILL @rewillsx]

That’s exactly the problem with shared hosting. Is there a public tracker showing which hosting providers have rolled out PHP 8.2.35 (or the equivalent security patch)? Otherwise, site owners are left checking their PHP version individually and opening support tickets just to find out whether their host has patched the server. A centralized status page would be far more useful.

[REWILL @rewillsx]

Almost every major website you used today is running on a language that just turned out to have a critical remote code execution hole sitting in its core for 14 years.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) isn’t a plugin vulnerability or a misconfiguration. It lives inside PHP itself — in how the engine handles memory and request state. Because of that, an attacker doesn’t need to find a bug in WordPress, Drupal, Magento, MediaWiki or whatever else is sitting on top. A single well-crafted request can trigger the issue before the application even starts running.

The bugs affect everything from PHP 5.4 (2012) up to the latest unpatched 8.5 releases. PHP powers roughly 70% of websites where the server-side language is known. That includes most of the open web, a huge share of e-commerce, government sites, and a long tail of internal tools and forgotten staging servers.

Patches landed today for the currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12). Older versions are end-of-life. They get source patches at best, and a lot of them will never be updated. Shared hosting, legacy VPS, and “it still works” boxes are now a permanent attack surface.

What makes this different from most critical bugs is the scale and the timing. The vulnerabilities were found with the help of AI models (as part of OpenAI’s Patch the Planet work and independently by Wiz). Details leaked before the patch, so attackers had a window. Multiple security companies already reported exploitation attempts before the fixes were public.

The technical fixes exist. The real problem is operational: most organizations don’t even know how many PHP processes they still have running, or where the old ones live. Those are the ones that will stay exposed.

[REWILL @rewillsx]

Not necessarily. Just because someone has had a blood test in the US doesn’t mean they should be worried. It depends on what happened to the test results, what information was collected, and whether there was any data breach. There’s no reason to assume everyone who’s had a blood test is affected.

[REWILL @rewillsx]

@TheHackersNews Wipers are the scariest category because there's no ransom to negotiate. The goal is just to break things. Logistics is a smart target too: hit one firm and the delays spread down the whole supply chain.

[REWILL @rewillsx]

Quanum being the ordering portal doesn’t necessarily mean the breach originated on the clinic side. It could have involved compromised clinic credentials, the Quanum portal itself, or Quest’s internal infrastructure. Without forensic findings, we can’t determine the initial entry point.

[REWILL @rewillsx]

@X1Kafadzhy Exactly. If a single stolen password was enough to access the system, the real issue is the lack of enforced MFA and proper access controls. Transparency about the breach matters just as much as security itself.

[REWILL @rewillsx]

@NeuN0mad Exactly the question. Neither the vendor nor Crime Stoppers has said whether MFA was on. If a system holding anonymous tips allowed password-only logins, that's the real failure here.