The scams are getting a bit meta. The Federal Trade Commission (FTC) has issued a warning about a new scam currently making the rounds. But this time, the con artists aren’t impersonating a politician or celebrity to trick consumers.They’re claiming that they are the ones sounding the alarm at the FTC.
Real FTC officials explained the general scheme in an alert released on October 22. Scammers call a target to tell them that bad actors in another country have registered a separate phone using their name and number for nefarious purposes. The imposter may even “transfer” you to a fake police officer to file a report. Fake badge numbers and IDs are also offered to make it all sound legitimate, and skeptics may even be directed to verify everything by searching for the police department’s phone number online (also fake). Failure to comply allegedly results in the loss of your personal phone number.
Those who follow through with the instructions provide scammers with their state-issued ID and other personal info for the bogus police report, but it’s not over yet. Some time later, targets will receive another call informing them that they will soon be arrested for those nonexistent crimes committed using their phone number. The solution? Transfer money for a security deposit.
“None of this is true—it’s all a scam,” assured the FTC.
To prevent unnecessary headaches, the FTC listed a few ironclad rules. Actual FTC employees will never contact you about sending money, or transfer you to someone else requesting funds. The FTC will never threaten to disconnect your phone number, or ask you to keep your conversations secret from others. Finally, they will never text a photo of the supposed employee ID as a way to verify their identity to you.
Unfortunately, combatting scammers is a bit like playing a neverending game of Whack-a-Mole. While the FTC has a list of common ways to spot government imposters, they encourage everyone to report the latest con jobs to ReportFraud.ftc.gov.
When it comes to buying a home, many people pay a premium for privacy. But one new listing Carlton, Kansas, takes the cake. For a measly $1.6 million, someone can call a converted Cold War Atlas intercontinental ballistic missile (ICBM) silo home. Though the site sits on 18.2 acres of rural grassland, nearly the entire complex is hidden underground, save a single ominous steel door. The silo trenches down 182 feet, eventually leading to a two floor launch control center retrofitted to fit the modern world.
Surrounding the entire complex are 600 tons of steel rebar and six-foot-thick epoxy concrete walls meant to withstand nuclear blasts and 500 mph winds. The listing’s website calls it quite possibly “one of the most hardened structures ever built by man.” Once the staging ground for nuclear Armageddon, the indoor launch control center has been converted into a 2,200-square-foot, two bedroom, two bath, home outfitted with generic modern appliances. To top it all off, it is caked in a fresh coat of muted millennial gray and white paint.
The only clear sign of the bunker above ground is a single metal door. Image: North Star Missile Silo
From launch control to living room
This particular missile silo was part of the United States Air Force’s Atlas F Intercontinental Ballistic Missile Program. The Atlas program began toward the end of World War II, and produced the country’s first operational ICBM. At its peak, from late 1962 to mid-1964, 132 of these Atlas sites were built around the country.
According to the National Park Service, north-central Kansas’ Atlas F was “by far the best” of the Atlas variants ever deployed. The missile stood 82 feet tall and carried a 4.5 megaton warhead, roughly 300 times as powerful as the 15-kiloton bomb dropped on Hiroshima. Aside from the Kansas location, there were 72 Atlas missile sites stationed on bases in Nebraska, Oklahoma, Texas, New Mexico, and New York.
Though advanced for its time, the Atlas was soon eclipsed by the even stronger Titan and then Minuteman systems.The majority of the Atlas systems were decommissioned in 1979, when President Richard Nixon signed the SALT (The Strategic Arms Limitation Talks) treaties. That meant dozens of the massive structures were left dormant. Many of those relics have taken on new lives as luxury apocalypse bunkers or gimmicky rentals.
A 40 foot underground tunnel connects the retrofitted launch control to the missile silos. Image: North Star Missile Silo.
A buyer interested in viewing the North Star Missile Silo in Kansas would really have to know what they’re looking for. Getting there requires driving through a seemingly nondescript stretch of grassland before eventually coming up on a large gated fence with the iconic yellow “Fallout Shelter” signage on its side. Once inside, a surreal-looking steel door jutting out of the quiet countryside offers a clue to the shelter. It looks like a portal to some eerie, distant world, which, in some sense, it really is.
Once through the door, visitors descend a metal staircase that leads to a 40-foot tunnel. Photos show a narrow, claustrophobic walkway encased in a ring of white metal beams. At the end of the walkway stands a pair of imposing 7,000-pound blast doors. Home sweet home!
But the weirdest part about the retrofitted missile silo house is how remarkably normal much of it looks on the inside. The living quarters feature a floor plan with two bedrooms, two kitchens, and two bathrooms spread across two floors. Stainless steel appliances and a washer and dryer sit alongside standard wooden cabinets, none of which would look out of place in any hastily built rental unit across the country. The central area is laid out loft-style, showing off the control center’s massive support column. Visually, everything seems out of context. It evokes a slightly off not quite right AI-generated version of a house, or a modern millennial apartment that a visiting alien might describe to fellow interstellar travelers.
The loft style interior is built around the control’s center’s missive support column. Image: North Star Missile Silo.
It’s an undeniably weird place to live full time, but not a half-bad survival bunker. The listing notes that it features two separate sewage systems (one above ground and one underground) humidity control, a cellphone phone signal repeater and a solar power powered seven foot chain link gate. It also has ample room for solar or wind energy installation, though the buyer would have to install those. It’s also not necessarily limited just to survival or end time doomers. Realtor.com notes that the silo was previously used as a rental, though he also said there was interest in using it as an off-the grid conference site or even a wedding venue.
A new era of fancy bunkers
Many Cold War relics have taken on new lives as quirky rental and luxury condominiums. Airbnb shows a number of silos available for short term stays in New Mexico, Kansas, and southern Texas. Some of these explicitly court “prepper” audiences with fat wallets. Possibly the best known of those is Survival Condo, located about 200 miles outside of Kansas City, That sprawling Atlas Missile Silo was converted into a 15 floor luxury condominium outfitted with a pet park, climbing walls, swimming pool (with a slide) library and a movie theater. The starting asking price for one of the units? Around $1 million in 2020 dollars.
And while Cold War bunkers are relics of the past, new interpretations of the structures are still being built. In the U.S. and abroad (New Zealand attracts a particular amount of attention) a subset of the world’s wealthiest elites are reportedly constructing their own apocalyptic lairs. Some of the best known examples of those billionaire bunker builders are in the tech industry with some racing to build advanced AI models that are increasingly putting them at odds with public opinion. Aside from escaping the pitchforks, the Kansas listing also notes one more potentially enticing incentive.
“Underground structures not taxable by [the] County.”
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]
Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet.
The flaws are so catastrophic that all websites using PHP — all untold millions of them — are advised to immediately take their servers down and apply the latest patch, which was released Wednesday. Vast swathes of the internet, following the news, have gone dark. Some that went offline for a time include Wikipedia, Steam, and even government websites.
Many organizations, however, may not have the time, resources, and personpower to swiftly implement the patch, making them potential sitting ducks until they do. According to the New York Times, the information released on the vulnerability can be used to reverse engineer the attack and take control of victim’s servers and steal information. The best course of action if you can’t patch your website, the National Security Agency advised, is dramatic: keep your site offline and don’t turn it back on.
Just as extraordinary as the breadth of the threat was how it was identified. The flaws were discovered by researchers at the cybersecurity firm Calif by using OpenAI’s GPT-5.6 Sol model, as part of a collaboration with the AI company. It then reported the flaw to the PHP Foundation back on August 11.
The Google-owned security firm Wiz independently found the flaws, too, and made a report on August 24. Wiz called it one of the “most severe vulnerabilities discovered in PHP, and arguably in software history.”
Adding to the alarm presented by the exploits, there have been concerns raised over OpenAI’s role in how they were identified.
The flaws have been present in versions of PHP dating backing to 2004. But through OpenAI’s “Patch the Planet” program, and by using its flagship GPT-5.6 Sol model, Calif found it in only a matter of days. In a sense, these exploits only exist because of current powerful AI models. And moreover, OpenAI encouraged their discovery through its programs.
The messy disclosure of the vulnerability doesn’t help matters. OpenAI followed standard responsible practices, but some of the details around the hack leaked a day before it was officially scheduled to be announced.
Even if no leaks occurred, though, the damage caused by the mere knowledge that the vulnerabilities exist — which again, is largely thanks to AI — would still be catastrophic. It was the inevitable next chapter in all the bluster around AI companies revealing their agentic models’ hacking prowess. A headline in The Atlanticproclaimed that the “AI-Hacking Apocalypse Began Last Night.” OpenAI will tout the discovery as undeniable proof of its AI’s capabilities, while the rest of the world picks up the pieces of a shattered internet.
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if "an immediate update is not feasible," as did the UK's National Cyber Security Center. Even Pokémon Home and Pokémon C …
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
[…]
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
[…]
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.
Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.
Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.
Add to php.ini:
session.upload_progress.enabled = Off
Add to .htaccess:
<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If>
Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries. PyPI quarantined the trojanized version of the popular open source AI gateway within hours, and the Docker image (litellm/litellm:1.107.0) was removed from both Docker Hub and GHCR soon after - but anyone who ran the compromised package on any platform should assume their secrets have been stolen. “Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists),” advised Aikido Security malware hunter Ilyas Makari. “The same applies to anyone who ran the official Docker image litellm/litellm:1.107.0, or pulled it via the latest, main-latest, or main-stable tags.” The most recent safe version is v1.106.2. While it’s too early to tell the scale of this latest LiteLLM supply chain attack – an earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide, according to CloudSEK – make sure to take these measures seriously, and check environments for any indicators of compromise. Aikido, Google’s Wiz cloud security biz, and supply-chain security provider Socket have all published extensive threat-hunting and mitigation instructions for LiteLLM users and security teams, so give those a read stat. LiteLLM, developed by BerriAI, provides a common interface for LLM providers, including OpenAI, Anthropic, and Google Gemini, and receives about 23 million weekly downloads. This means a compromised installation can run alongside LLM provider API keys, cloud identities, and database connection strings - and expose a ton of valuable credentials, secrets, and other sensitive data to whoever uploaded the malicious package. “Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners,” Socket researchers said on Wednesday. The malicious version was uploaded at 11:39 UTC, and according to Wiz kids Benjamin Read and Rami McCarthy, the payload originates with malicious commits made on github.com/Berri-AI/litellm, which is a hyphenated variant of the legitimate BerriAI organization. Miscreants used this repo to inject the three malicious files into the LiteLLM release pipeline. These, according to Makari, include cook.pth, which causes the second file, cook.py, to run automatically every time Python is invoked on the machine, without any additional user action. Meanwhile, cook.py contains the infostealer, and the third file, sitecustomize.py, is the RAT. Python also executes the RAT at interpreter startup, and this file spawns a background daemon that polls the attacker's infrastructure every hour for new commands to execute. Upon executing, the infostealer harvests a ton of sensitive data across 16 modules targeting browsers, cloud providers, and AI services, according to Read and McCarthy. It steals browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials from ~/.aws/, environment variables, and EC2/ECS instance metadata (IMDS). It also collects users’ Google Cloud Platform service account keys and application default credentials, along with Microsoft Azure tokens from the CLI cache. And then it also swipes API keys for OpenAI, Anthropic, Cohere, and other LLM providers, plus SSH private keys, GPG keys, and shell history files. The malware then encrypts all of this stolen data using AES-256-CBC, wraps the encryption key with an RSA-4096 public key, and sends the encrypted data via HTTP POST to an attacker-controlled domain: http://www[.]litellm[.]dev/healthcheck. BerriAI did not respond to The Register’s inquiries. This is an emerging story, and we will continue to update it as we learn more details.®
I've used Bitdefender Total Security to protect my own devices for years, and I highly recommend it. I've found a great deal on the security software at Newegg that brings a year's coverage for up to 10 devices down to under $30.
• Best for: Households with multiple devices, anyone wanting protection across different operating systems, and people looking for antivirus software with additional privacy and ransomware defenses.
• Why I like it: I use Bitdefender Total Security to protect all of my devices at home, and it's much more than a traditional antivirus tool. As well as keeping you safe from viruses, spyware, Trojans, ransomware, and other malicious software, it also uses behavioral detection to identify suspicious activity and defend against unknown threats.
Today's best antivirus software deal
Total Security 2026: was $99.99 now $27.99 Bitdefender Total Security provides one year of protection for 10 Windows, macOS, Android, and iOS devices, with malware detection, ransomware defense, privacy tools, parental controls, and limited daily VPN access included.View Deal
Why we recommend it
The software can block online tracking, monitor attempts to access your webcam or microphone, and identify potentially dangerous websites. The subscription covers up to 10 devices running Windows, macOS, Android, and iOS.
The package also includes access to Bitdefender VPN, although it's limited to 200MB per day per device, which is only really enough for occasional use. Parental control features will be of interest to anyone with children, although availability and functionality depend on the OS.
In covering the software, we said: "Bitdefender tops our list and ticks every box. It performed well across our testing, boasts all the tools you need to protect your devices from malware (and more), and is nice and easy to use – regardless of platform. While some expert users might wish for a little more granular customization, we think that Bitdefender strikes the right balance in terms of configuration and ease of use."
Price context & historical value
Newegg sells the one-year, 10-device subscription for $99.99, but is currently offering it at $52.99. Enter EPF56892 at checkout to save a further $25, bringing the final price to $27.99.
That represents a $72 saving against the original price, approximately 72% off. If you activate the program on all 10 devices, the first-year cost works out to approximately $2.80 per device.
It's important to remember that this is a one-year license, rather than a permanent software purchase. You're not locked in though. What I usually do is search for a new deal around the renewal time.
You want one antivirus subscription covering Windows, Mac, Android, and iOS devices. It's also great for ransomware protection, malicious website detection, and privacy tools. At $27.99, this is a fantastic deal.
❌ Skip Bitdefender Total Security if...
You only need to protect one computer and are satisfied with your device's built-in antivirus software. Windows includes Microsoft Defender, and macOS and mobile operating systems have their own security protections.
Make sure you don’t say anything mean or secret after hanging up a call on Signal, as a bug in the encrypted messaging app’s calling library could prevent a call from ending properly, potentially leaving audio and possibly video active. The vulnerability, CVE-2026-113380, was published by MITRE on Tuesday and given a CVSS score of 9.3, marking it as a critical issue in Signal’s open-source RingRTC library in every single version before 2.72.0. That update was pushed out last month, but the vulnerability wasn’t made public until now. RingRTC is Signal’s own calling library built on top of WebRTC, a technology introduced in 2011 that has since become widely used for voice and video communication over the internet. RingRTC provides Signal-specific calling functionality using WebRTC, which already encrypts media traffic, but that isn't stopping RingRTC from failing to hang up calls in certain conditions, according to the CVE report. What’s happening is, in essence, a denial-of-service attack on RingRTC’s finite state machine (FSM) event queue, which handles events involved in managing calls. If one of the people on the call saturates the FSM queue with requests, it can become overwhelmed and fail to process a hangup request, preventing the call from terminating properly. The vulnerability is classified as CWE-754, or improper checking for unusual or exceptional conditions, according to a report posted to GitHub. A conceptual proof of concept is available in the GitHub report linked above, using a Python script to simulate how flooding an event queue can prevent a hangup request from being processed. Were a malicious actor to exploit this, the person on the other end may think the call has been terminated, but either or both of their video and audio channels could still be open. The attack complexity is considered low according to the CVE, and while CISA’s known exploited vulnerabilities catalog doesn’t indicate this has been spotted in the wild, Signal users ought to ensure they’ve updated their apps - mobile and desktop - to the latest versions to ensure they don’t end up being caught on a hot mic without any notice. Comparing RingRTC 2.72.0 to the previous version indicates that Signal's fix allows the call's finite state machine (FSM) to detect termination requests independently of the event queue, while adding a timeout to prevent stalled processing from indefinitely blocking a hangup. It's not entirely clear from Signal's release notes when the fixed version of RingRTC reached the Android, iOS, and desktop versions of its apps. Signal Desktop's release history indicates that RingRTC 2.72.0 was incorporated in September, but the precise rollout dates across all platforms remain unclear. We’ve reached out to Signal to learn more, but haven’t heard back. In the meantime, best to update your installation to be sure you’re not still vulnerable. That, and watch what you say after hanging up a call. ®
Google is stepping up its fight against deceptive websites with a fresh batch of security tools. As bad actors constantly change their tactics to trick users, the popular web browser is bringing in new layers of defense to its Enhanced Protection mode. These updates aim to catch more threats in real time, from sneaky fake […]
Frontier AI models helped researchers discover PHP vulnerabilities that had lurked undetected for over a decade. The flaws affect 70% of websites, and exploits are already circulating. If you run a website, update PHP now or confirm your host has patched.
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. [...]
PHP discloses two critical remote code execution vulnerabilities that could enable website takeover and data theft
Details leaked before patch release, prompting an early security advisory and urgent upgrade warning
Researchers confirmed the flaws are real, with widespread impact expected across multiple PHP versions
PHP, arguably the most popular programming language for websites and web applications in the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.
The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations.
Security rush hour
PHP published a new security advisory, giving admins a “heads up” on an incoming patch.
“The PHP security team would like to give advance notice of an upcoming security release,” the advisory reads.
“It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release.”
If you’re thinking the announcement is rather unorthodox and that PHP might as well just released the patch - you’re absolutely right. The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.
That ‘someone’ is a person with an alias ‘petecooper’, who published a new post on Y Combinator’s Hacker News forum earlier this week. In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026.
The post has since been deleted so we couldn’t independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.
The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed. Therefore, the only thing that’s wrong is the CVSS score which seems to be 9.2, not 10.0.
Among the people who knew about the flaw and the upcoming patch were watchTowr, and Florian Roth, Head of Research at Nextron Systems.
The embargo on the news was set for October 20, with the patch due a day later, on October 21. However, yesterday Roth posted on X, saying “Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.”
Leaking the zero-days
This forced PHP’s hand, not just to release the advisory, but also to send a notice to its ANNOUNCE mailing list, according to BleepingComputer.
Security researchers watchTowr confirmed the news, saying the bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is being nicknamed “php2shell” by the community. Obviously, technical details are being withheld to protect users, but most likely affect PHP versions 5, 6, 7, and 8.
"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.
"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."
The researchers also told the publication they managed to successfully reproduce CVE-2026-109618, confirming the flaws actually work. Good news is, there are still no confirmed reports of the flaws being used as zero-days in the wild.
Login
