Overview
- A critical PHP vulnerability exploited in mid‑October 2026 let attackers access data on millions of servers and sites, and the full scope of what was taken is still unclear.
- Security firm Avast says criminals are using the stolen records to craft targeted phishing that aims to steal private email and online‑banking credentials.
- Avast warns that AI agents automate and scale these attacks around the clock so fraud attempts can be far faster and more numerous than human‑run campaigns.
- Investigators reported that some certificate keys were also taken in October, which means the browser lock or HTTPS can no longer be treated alone as proof a page is legitimate.
- Users should remove unneeded third‑party and AI app access, use separate passwords for each account, and open banks and important services only via official sites or apps to reduce risk while investigations continue; companies face data loss, fines, reputational damage and higher recovery costs as a result.