PHP critical RCE flaws lead a week of exploited edge bugs and a $1B AI round
Cybersecurity set the tone this week: PHP patched two critical remote code execution flaws and disclosed a third with no fix, while attackers exploited PAN-OS and Arista appliances and a poisoned LiteLLM release hit developers' credentials. Elsewhere, China tightened drone export rules, Flapping Airplanes raised a $1 billion Series A, and a Russia-aligned deepfake targeted a Texas Senate race. If you read one story, make it the PHP flaws.
This week's pick
- PHP patches two critical PHP2Shell remote code execution flaws and discloses a third, unpatched one Both patched flaws score 9.2, Unit 42 counts over 22.6 million potentially exposed instances, and the third has no fix yet.
OSINT
- Deepfake student smears Texas Senate candidate Graphika attributes two AI-generated assault-claim videos about James Talarico to the Russia-aligned Storm-1516 operation.
- Satellite images show St Petersburg damage Imagery shows oil tanks destroyed at two depots after the 18 October drone strikes, though every assessment traces to one Telegram channel.
- Bellingcat tests LLMs at geolocation On 52 unpublished photos, top models placed over half within 25 km, but none reliably found the exact spot.
Drones
- China revises its drone export controls, with the changes taking effect on 18 November Autopilots, engines and certain unmanned aircraft will need an export licence.
- FEMA opens a second $250 million counter-drone grant round to every state, territory and DC Applications close on 16 November, after a first round limited to World Cup host states.
- Ukrainian intelligence says Russia now builds 4,000 jet-powered Gerans a month The shift to Geran-4 and Geran-5 follows effective interception of slower Geran-2 drones.
VC Investment
- Flapping Airplanes raises a $1B Series A co-led by Index and Lux, reportedly at a $6B valuation The AI research lab raised it nine months after its seed round, with no commercial product yet.
- Tenstorrent raises $1.5B Series E at a $6.2B valuation, led by Trace Capital and Innovation X The round more than doubles its valuation after reported Intel and Qualcomm acquisition interest.
- Warhound emerges from stealth with a $200M seed round to breed gene-edited military working dogs Reported at a $1.2B valuation, it has no signed customers and its first dogs are about two years away.
CyberSecurity
- Unit 42 says Qilin and INC ransomware operators are exploiting PAN-OS flaw CVE-2026-0257 to reach victims' networks The authentication bypass lets attackers bypass MFA and start VPN connections.
- LiteLLM says its release pipeline was compromised and version 1.107.0 shipped credential-stealing malware SecurityWeek reports about 49,000 downloads before removal; 1.106.2 is the latest clean version.
- Arista patches VeloCloud Orchestrator SQL injection zero-day, CVE-2026-114625, that it says is being exploited It is the third exploited VCO zero-day in four months, and CISA has added it to its exploited list.
- Mozilla, Google, Apple and Microsoft block eight eMudhra intermediate certificates after their private keys proved recoverable almost instantly The weak keys would let an attacker forge trusted certificates for any website.