QUANTUM THREAT INTELLIGENCE
The Cyber Centre's alert AL26-026, first issued October 21 and now at Update 2 of October 27, 2026, covers two use after free flaws in PHP that let an unauthenticated attacker run code on an affected server. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no fix from the project. Update 1 added CVE-2026-115560, unpatched at the time, with the interim mitigation of disabling session upload progress. Update 2 reports both original CVEs exploited in the wild and added to CISA's Known Exploited Vulnerabilities list on October 26. PHP sits behind roughly seven in ten websites, and the researchers who found the flaws used AI models alongside human review, which is the part that matters for operators: the time between a flaw existing and a scanner finding it is now short. Patch internet facing systems first, isolate what cannot be patched, and find the PHP hiding inside third party appliances and containers that are not labelled as web servers.
Every advance in quantum computing shortens the window for migrating long lived infrastructure off quantum-vulnerable encryption, and data captured today can be decrypted later. Fabric Networks helps energy, government, telecom and community networks move to quantum-safe encryption on their own timeline, not an adversary's.