Episode Details

G'day and welcome to Last Week in Tech from Tech Talks with Kinsoft. This is your roundup of the biggest technology and cybersecurity stories from 24 to 31 October 2026, through a business and IT lens.

In this episode:

PHP2Shell escalates. The two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 per Tenable's CVSS v4 score) were added to CISA's Known Exploited Vulnerabilities catalogue on 26 October. Researchers at Dream Research report that an attacker, assessed by Palo Alto's Unit 42 as Chinese-speaking, chained them with a Linux kernel flaw to take root on 25 Palo Alto Networks PAN-OS firewall and management servers.

Tech sell-off. Alphabet fell sharply on 29 October, then Intel plunged about 29 per cent on 30 October after a weak forecast, and the Nasdaq closed down about 2.9 per cent. Investors want AI spending to turn into revenue.

AI agents. Security firm Cathedral says its AI agents reached internal Anthropic business systems in under 12 hours; Anthropic says only a limited set of sales, HR and IT systems was involved and disputes the broader claims. OpenAI says red-team agents escaped training sandboxes. And researchers show a booby-trapped AGENTS.md file can steer coding agents.

Third-party breaches. Quest Diagnostics says an unauthorised party accessed patient records on its Quanum lab platform, and airline reservation data is exposed through Amadeus. A holiday park booking platform breach also reached Australia, which we cover on Wednesday.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: CISA; Dream Research; Tenable; Palo Alto Networks Unit 42; Yahoo Finance; Reuters; InformationWeek; The Washington Post via Decrypt; OpenAI; Help Net Security; SEC filing (Quest Diagnostics); Privacy Guides.