Business
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit’s offsets appears in the subsequent execution payload,” Karimi shared.
“The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request’s final captured byte.”
Karimi’s findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
“This is by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,” Hutchins said.
The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after asking admins to prepare to install the security updates as soon as they became available.
While details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online and some proof-of-concept (PoC) exploits were published before the patches went live, the PHP security team said that none were functional.
Additionally, multiple cybersecurity companies (including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack) detected exploitation attempts before public disclosure, but flagged them all as unsuccessful.
Security researchers at Amazon Threat Intelligence also spotted attackers targeting the PHP2Shell vulnerabilities four days before security patches were released. However, until Karimi’s findings, the malicious activity was “limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises,” according to Dataminr’s Threat Research and Cyber Engineering (TRACE) team.
On Friday, the PHP security team also shared mitigation measures for a new RCE vulnerability (tracked as CVE-2026-115560) that has no patch and can only be exploited when targeting systems “with an unusual combination of configuration and application code.”
Until a security patch is released, the PHP devs advised admins to set session.upload_progress.enabled=0 to block potential attacks, a mitigation already recommended before patches for the PHP2Shell security updates were released.
Business
Dollar General overcharged millions at checkout for years, FTC and 20 states allege
The Federal Trade Commission and 20 states on Monday sued Dollar General, accusing the budget retailer of charging customers more for products than it advertised.
The chain, which operates 21,000 stores nationwide, allegedly mislabeled prices for years, “extracting millions of dollars in unlawful overcharges,” the FTC alleged.
“Dollar General has betrayed the trust of millions of American consumers and imposed significant financial harm on communities and consumers who are already struggling to make their paychecks last,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a statement.
The FTC added that American consumers depend on Dollar General’s advertised low prices to make ends meet on tight budgets, while prices that don’t reflect advertised deals make it impossible for them to manage household finances.
The agency filed its complaint in the U.S. District Court for the Middle District of Tennessee, Dollar General’s home state.
“Our goal is 100% accuracy between shelf and register prices in every store,” Dollar General said in a statement. “As with other retailers and despite our policies and procedures, occasional price discrepancies can occur. When that happens, our store teams are instructed, empowered, and expected to make things right for the customer. In recent years, we have enhanced our price-accuracy processes and remain committed to continuous improvement.”
Dollar General said it was made aware of the FTC’s investigation in early February.
“Inaccurate pricing”
According to the suit, thousands of Dollar General stores unlawfully overcharged shoppers.
Dollar General “has for years engaged in deceptive conduct that harms the very consumers it claims to serve,” the FTC and states allege in the suit. “Although Dollar General promises convenience, low prices, and value, the company has routinely charged customers more at the register than the prices displayed on shelves, price tags, and advertisements. This pattern of inaccurate pricing has persisted for years and affects millions of purchases across the country.”
The company also faced thousands of consumer complaints claiming it failed to honor advertised prices at checkout, a sign Dollar General knowingly harmed customers, according to the FTC.
The suit seeks a permanent injunction, along with monetary and other relief.
Dollar General in its statement said, “FTC staff also demanded a monetary amount that was untethered to — and orders of magnitude larger than — any realistic assessment of amounts attributable to pricing discrepancies.”
The company said it “worked tirelessly and in good faith to resolve this matter without litigation,” including an “alternative, and in our view, more reasonable, manner of calculating potential settlement ranges.”
“Although we respect the FTC’s role in protecting American consumers and the State representatives’ role in protecting the citizens of their respective states, we will defend this litigation vigorously,” it said.
Business
The “influencer who doesn’t exist”: Social media platforms struggle to detect AI profiles
Valeriia Litvinova Cunningham was pursuing her master’s degree at North Carolina State University as the war escalated in Ukraine.
She helped her parents and her sister Anya start a new life in North Carolina.
“They basically came here with only the clothes on their back,” Cunningham said.
Once reunited, her family hit the gym. It quickly became an escape. “We started strength training together as a way to distract ourselves from what was going on and also do something together as a family,” Cunningham said.
She began posting the family gym sessions on social media. Anya, who has Down Syndrome, quickly became a source of inspiration to their growing community of online followers.
“We just saw so much progress in Anya’s confidence, and she started having a sense of belonging in the gym.”
“Our entire life we’ve been told that Anya wouldn’t be able to achieve anything, that she wouldn’t be able to even walk. Now she’s strength training; she’s in the gym with other bodybuilders, with powerlifters, and just out training them,” Cunningham said.
The sisters’ online community grew into workout classes for people with Down Syndrome through GiGi’s Playhouse, a non-profit that provides resources to individuals of all ages with Down Syndrome. They call it Strength Without Labels.
“We’ve really proved, and hopefully continue proving, every day that she’s not defined by her diagnosis,” Cunningham said. “Our participants can see that they belong in a gym with other people. They don’t have to be separated into a separate group. They can work out alongside everybody else, and that’s what’s important.”
As their following grew, so did the skeptics.
“People are accusing Anya [of] not being real, because nowadays, apparently, now we have to fight with artificial intelligence, and that is exactly why people now struggle with distinguishing between what’s real and what’s not.”
WRAL Investigates met Anya in person during a workout class. However, we also found an account, @MiaTriso21, on both TikTok and Instagram that some people online believe modeled its face after Anya to put on other creators’ bodies.
“To be honest, I cannot even believe that I’m having this conversation right now, especially since…sharing our journey on social media and fighting all these stereotypes. Now I’m fighting against AI-generated content or fabricated content,” Cunningham told WRAL Investigates.
“These accounts borrow a real creator’s body, voice, and audience trust, put an AI face on top and then monetize that trust,” said Laeeq Khan, who is the director of the social media analytics research lab at Ohio University.
Khan says social media platforms tend to rely on victim reporting.
“If somebody hasn’t reported it, it doesn’t get caught,” he said.
Sometimes, reporting it isn’t enough.
“Sometimes, I would get a response saying that something that’s AI-generated is not, so the reports would claim that, ‘We didn’t find this content to be AI-generated,’ and then I have to fight back. I can’t believe that I’m spending so much of my time trying to fight a robot,” Cunningham said.
Both TikTok and Meta require AI-generated content to be labeled and have policies in place to take down videos that violate their respective community guidelines. However, WRAL Investigates found multiple videos still posted without proper labels.
We asked both TikTok and Meta what they’re doing to find [AI-generated] profiles/content that may fall through the cracks.
Meta did not respond to our repeated inquiries.
TikTok said it uses C2PA Content Credentials technology, which tracks the origin and edit history of digital content. The company also said it tests detection systems to target accounts dedicated to posting AI-generated spam.
Since WRAL Investigates started asking questions about @MiaTriso21, the account has been removed from both TikTok and Instagram. However, other versions of the same account are already floating around.
If something looks perfect, Khan warns, be skeptical. And if it looks too good to be true, it probably is.
Business
FTC and 20 states sue Dollar General, accusing bargain chain of overcharging customers
The Federal Trade Commission and 20 states have sued Dollar General, the nation’s largest dollar-store chain, for persistently overcharging customers at its more than 20,000 stores across the United States.
The lawsuit, filed in federal court in Nashville, cites a Guardian investigation published last December.
“Dollar General has for years engaged in deceptive conduct that harms the very consumers it claims to serve,” the 95-page legal complaint claims.
“Although Dollar General promises convenience, low prices, and value, the company has routinely charged customers more at the register than the prices displayed on shelves, price tags, and advertisements. This pattern of inaccurate pricing has persisted for years and affects millions of purchases across the country.”
The lawsuit says the scope of the retail chain’s “pricing misconduct” is “staggering”.
The FTC is the federal agency charged with protecting consumers from deceptive, unfair and anticompetitive business practices. State authorities from Mississippi to Ohio to Nebraska to Utah have joined the case as plaintiffs.
Dollar General did not respond to questions for this story, but has previously said that it was “committed to providing customers with accurate prices on items purchased in our stores”.
The FTC’s allegations are consistent with the Guardian’s December 2025 investigation, which found that Dollar General stores failed more than 4,300 government price-accuracy inspections in 23 states over a three-year period. That article “was the subject of significant internal deliberation and discussions” within the company, the lawsuit said.
The agency noted in the lawsuit that Dollar General has policies in place that are supposed to align register prices with shelf prices. For example, it directs employees to remove and replace outdated labels on certain days of the week. Workers told the Guardian that, because of understaffing, they are often too busy to change those labels.
“Dollar General’s on-paper policies to update pricing achieve little in practice,” the lawsuit said, because “they do not track whether the printed labels are actually affixed to shelves.”
The FTC cited a Guardian interview with a former lead sales associate in Louisiana who said: “I threw away tags sometimes, to keep me or a co-worker out of trouble.”
The lawsuit indicates that FTC investigators made undercover purchases at Dollar General stores in Ohio, Pennsylvania, Missouri and Maryland over a two and half month span. The first of these secret shopper tests took place this January, six weeks after the Guardian’s investigation focused wide attention on the discount chain’s pricing practices.
Every single undercover visit, the suit says, turned up overcharges on multiple products. At a Dollar General in Cleveland, 8 of 58 items purchased rang up more costly than the prices listed on the product label or shelf – an overcharge rate of nearly 14%.
Dollar General told the Guardian in 2025 that it is “disappointed” any time it fails to deliver on its commitment to accurate shelf pricing. In court documents in Ohio, Dollar General’s lawyers have argued that “it is virtually impossible for a retailer to match shelf pricing and scanned pricing 100% of the time for all items. Perfection in this regard is neither plausible nor expected under the law.”
In a statement accompanying the FTC lawsuit, the federal agency noted that Dollar General markets itself as a low-cost alternative to other retailers, and that low- and fixed-income customers rely on the accuracy of its price labels.
“Dollar General has betrayed the trust of millions of American consumers and imposed significant financial harm on communities and consumers who are already struggling to make their paychecks last,” said Christopher Mufarrige, director of the FTC’s bureau of consumer protection.
Business
OpenAI announces three big science discoveries and a new way to work with academics
This time OpenAI says it’s taking new advice from scientists on how to release the results.
This time OpenAI says it’s taking new advice from scientists on how to release the results.
The Verge Daily
A free daily digest of the news that matters most.
Email (required)
By providing your information, you agree to our Terms of Use and our Privacy Policy. We use vendors that may also process your information to help provide our services. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Business
Anthropic IPO might kick off tech reset if the AI stock underperforms
Stefan Wermuth | Bloomberg | Getty Images
The tech industry needs this to go well. So does Wall Street.
Anthropic’s IPO filing on Monday puts the Claude creator in position to pursue what could be the largest initial stock offering in history. Investors are already measuring the 5-year-old company’s potential market cap in the trillions, putting it in a category with the world’s most valuable companies.
It’s a critical moment for the whole tech sector, as the artificial intelligence boom has been largely driven by two companies: Anthropic and OpenAI. The latter has confidentially filed to go public, but has said a debut likely won’t take place until 2027.
Meanwhile, the stock market is showing signs of jitters on the AI trade. Neoclouds and data center companies have been getting pummeled, prompting Australia’s Firmus to withdraw its IPO plans and for SK Hynix’s U.S.-based Solidigm unit to do the same.
Now, all eyes turn to Anthropic , which is betting that investors will look past over $80 billion in losses in the first half of the year, and see the 14-fold increase in revenue as a reflection of seemingly insatiable demand for the company’s leading models and services.
“If it underperforms expectations, it’ll be a little bit of a house of cards,” said Jai Das, co-founder of Sapphire Ventures whose career in tech investing dates to the 1990s.
watch now
Anthropic’s business is deeply entwined with tech megacaps. Close to half its revenue comes from Claude being sold through cloud divisions at Microsoft , Amazon and Alphabet , which all hold investments in the company. In the IPO, some $77 billion in notes can be issued to Amazon , Broadcom and Google , while Microsoft and Nvidia agreed to invest $15 billion as the company builds up its computing capacity. Chips from Nvidia, Advanced Micro Devices , Amazon and Google are powering Anthropic’s development.
Cloud providers are ratcheting up capital expenditures to meet demand, and memory manufacturers are fighting shortages to prioritize AI chips. And there’s the debt factor. Alphabet, with its investment-grade credit rating, committed to backstopping Anthropic for a data center in Texas. Broadcom , which helps Google develop chips for AI labs, is creating financing pools to help Anthropic and OpenAI deploy high-performance models, CEO Hock Tan told analysts earlier this year.
For public market investors, more than one-third of the value of the S&P 500 comes from tech’s trillion-dollar companies, which are all, to varying degrees, going deep in AI. Beyond that, there are software giants like Adobe and Salesforce that have integrated with Anthropic’s Claude assistant.
Market reset?
And in the private markets, check sizes have ballooned but IPOs are few and far between. Bessemer Venture Partners and Menlo Ventures both told CNBC that Anthropic is their biggest investment ever.
“If they don’t perform well, they will become the bellwether for AI,” said Brad Bernstein, a managing partner at growth equity firm FTV Capital. “Their valuation will reflect that performance variation, and then it’ll just be a trickle-down effect to all the stuff going on with the excess capital that’s getting poured into the venture AI world. Everything is going to have to sort of be reset.”
Anthropic will be the third company to go public with a valuation above $1 trillion, after Saudi Aramco and Elon Musk’s SpaceX , which debuted in June. OpenAI could be the fourth.
Revenue at Anthropic has been multiplying at a staggering pace as businesses adopt the company’s coding and productivity tools. Second-quarter revenue soared to $11.56 billion from $787 million a year earlier.
The company held almost $132 billion in cash, equivalents and short-term investments at the end of June. And after five quarters of operating losses, Anthropic reported $974 million in operating income for the second quarter.
“It is, I think, better than feared,” said Rohit Kulkarni, partner and chief AI officer at Burnham Park Capital Markets, referring to the financials. “There could have been more negative tidbits.”
Vcg | Visual China Group | Getty Images
One source of concern in some corners of the investing universe is the emergence of so-called open-weight models, which are cheaper for businesses to access and allow for customization and flexibility in terms of where users access the models.
In the prospectus, the only two competitors Anthropic named were OpenAI and Google, though the company said it faces competition from a “broader set of model providers,” including open-weight or open-source models.
Anthropic says it’s all very early, with Fortune 500 companies committing less than 0.1% of their total expenses to its models and services in the latest quarter. Michael Monaghan, portfolio manager at Founder ETFs, says that’s part of the investment thesis.
“I think there’s going to be room for frontier models like Anthropic and OpenAI and SpaceX, and I think there will be room for open-weight models,” Monaghan said. “It’s way too soon to say that one is going to disintermediate the other.”
With hyperscaler spending on AI infrastructure set to reach into the trillions of dollars, Sapphire’s Das said there’s understandable concern about a market glut. But he compares it to the telecommunications and dot-com bubble of the late 1990s, when companies flooded the market with fiber-optic equipment. Eventually, the infrastructure got used, although plenty of companies went belly up in the interim.
“Long term, I don’t think there is a lack of demand,” Das said.
Downside risks
A lackluster debut could push out OpenAI’s offering even further and cause investors to rethink its lofty valuation. At the same time, rising interest rates mean it’s getting costlier for companies to raise debt.
David Trainer, CEO of financial research firm New Constructs, wrote in a report last month that the AI boom has been built on the view that cheap credit and access to the capital markets will be “readily available.”
“If AI liquidity dries up, and there are clear signs it is, we see large, 20%, downside risk in the S&P 500, with most of that concentrated in the valuation of AI-related stocks,” Trainer wrote.
Industry experts take a different approach, focusing on the power and rapid proliferation of the technology. Claude Opus 5.5 Max performs better than any other model on the Artificial Analysis Intelligence Index, an industry benchmark.
Snowflake CEO Sridhar Ramaswamy said the technology is only becoming more essential.
“Anthropic and OpenAI have by now demonstrated their ability to stay at the frontier of AI and keep pushing innovation,” Ramaswamy said. “They’re incredible companies that are doing a big service to humanity by expanding the frontier of what is possible, and we are very much rooting for them to be public and very successful companies.”
Still, Snowflake is experimenting with low-cost open-weight models from China’s Moonshot AI, DeepSeek and Zhipu.
“We spend a lot on internal AI because we want to get as much efficiency as we can,” Ramaswamy said.
WATCH: Seems like Anthropic will beat OpenAI to IPO, says FirstMark’s Rick Heitzmann
-
HealthNews2 weeks agoDementia risk more than quadruples among adults with common disorder
-
Business1 week ago‘Black Monday’ fears intensify as prediction markets shrug off 2026 crash
-
Sports2 weeks ago
Brewers take 2-1 win over Dodgers to kick off NLCS
-
Food2 weeks ago
Powerball winning numbers, results for Saturday, Oct. 10, 2026: No jackpot winner
-
Business2 weeks agoMcDonald’s chicken and beverage growth faces rivals
-
Entertainment2 weeks agoCollin Gosselin discusses alleged abuse by mom Kate Gosselin
-
HealthNews2 weeks agoThe ancient Iranian fruit scientists think may help heart failure
-
Entertainment2 weeks agoNetflix, Derek Cianfrance Adapting Gary Paulsen’s Book
