IT, AI & Telecommunications

Global – October 31, 2026 -- CrowdStrike has extended Falcon Adversary OverWatch managed threat hunting to AI applications and autonomous agents monitored by Falcon Guardian, and added telemetry-driven hunting for Google Cloud, bringing its coverage of the three major public clouds in line.

OverWatch Cross-Domain now covers AI agent activity around the clock

Falcon Adversary OverWatch Cross-Domain now provides 24/7 proactive hunting across AI applications and agent activity monitored by Falcon Guardian. Hunters combine Guardian's runtime context with Falcon platform telemetry and frontline adversary intelligence to find manipulation, abuse and emerging tradecraft that automated detections may miss.

Global – October 31, 2026 -- CrowdStrike's Falcon Guardian now traces supported AI agent sessions from prompt to impact on the endpoint, scoring every agent from 0 to 100 and blocking dangerous actions at runtime.

The product targets a blind spot in network-based monitoring. A gateway sees the conversation, and a web gateway sees an agent connect to a trusted site. Neither sees what happens inside the machine, where a hidden instruction can become a shell command or a downloaded file can run with the user's access.

Agent Graph links the AI layer to the execution layer

Falcon Guardian runs on the existing CrowdStrike Falcon sensor, which already sees processes, files and network connections. It now also sees prompts, models, tools and skills. CrowdStrike Agent Graph connects each agent to the users, hosts, models, prompts, tools, skills, MCP servers, processes, files and detections it touches, and keeps those links current as agents act.

Global – October 31, 2026 -- The China-nexus adversary VAPOR PANDA used the agentic framework ARTEX to target more than 200 organizations worldwide, according to CrowdStrike OverWatch. The campaign paired the Chinese-developed DeepSeek large language model (LLM) with a second commercial LLM to run intrusions against multiple high-value targets in parallel. CrowdStrike calls it an escalation in China-nexus use of AI agents, from single intrusions to simultaneous engagements directed by one human operator.

Campaign reached at least 14 countries in 11 days

Exploitation activity began on October 17, 2026, from a single ARTEX controller linked to VAPOR PANDA infrastructure. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East. U.S. semiconductor, defense and think tank organizations were also hit, along with telecommunications providers in multiple regions.

Global – October 31, 2026 -- CrowdStrike researchers say they located software vulnerabilities by watching where a frontier AI model refused to answer, and their method was correct in 73 of 86 controlled test scenarios across five vulnerability classes.

The approach, called Guardrail-based Vulnerability Discovery (GbVD), began when a model declined to explain one function in a small C web server. It had explained every other function in the codebase. A single token in that function had been changed from a max to a min, creating an out-of-bounds write. The prompt asked only what the code does, with no mention of security, exploits or vulnerabilities.

Global – October 31, 2026 -- CrowdStrike Counter Adversary Operations has observed no successful exploitation of the PHP2Shell vulnerabilities in the wild or in its honeypot environments, only testing, probing and unsuccessful attempts.

The firm has also found no fully weaponized exploit, and no proof-of-concept (POC) exploit sufficient for widespread exploitation. Opportunistic attackers are likely to favor proven alternatives, because several other vulnerabilities already deliver unauthenticated remote code execution (RCE) against PHP applications reliably and at scale.

PHP disclosed two CVEs affecting four release branches on October 21, 2026

CVE-2026-109618 and CVE-2026-109619 affect PHP versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Preliminary analysis by industry sources and the vendor indicates that many older versions, including end-of-life releases, are also affected and may receive only limited patches.

Las Vegas – October 31, 2026 -- CrowdStrike's Falcon Guardian has been deployed at hundreds of organizations since its September 1, 2026 launch, and early users report finding over 260 distinct AI services at a single organization and confidential documents being shared with public AI chatbots.

Customers span financial services, healthcare, manufacturing, retail, energy and the public sector. They are responding to the shift from AI that generates content to agents that reason, decide and act autonomously. Employees run AI assistants in browsers and desktop apps, developers run coding agents that read files and execute commands, and business teams connect agents to enterprise data through Model Context Protocol (MCP) servers.

Tokyo – October 31, 2026 -- SAP SE and NTT, Inc. have announced their intention to cooperate on SAP Sovereign Cloud and SAP Business AI, starting with a combined offering that pairs SAP Sovereign Cloud On-Site with NTT-managed infrastructure and operations in key markets.

SAP Sovereign Cloud On-Site runs in customer-owned or customer-selected data centers

The offering targets customers with stringent sovereignty, regulatory and compliance requirements. It lets SAP-managed cloud solutions operate in a data center the customer owns or selects. SAP says this gives organizations local physical control, data residency and operational assurance while helping them meet applicable local legal and regulatory requirements.

TOKYO – October 31, 2026 -- NTT DOCOMO BUSINESS, Inc. has been named Runner-Up in the Asia-Pacific Communications Service Providers (CSPs) category of the Gartner Eye on Innovation Awards 2026 for its AI-native, SaaS-based communication service docomo business ANCAR, finishing directly behind the Winner.

The result extends the company's run at the awards to two consecutive years. In 2025, it became the first Japan-based company to win the APAC category, for docomo business RINK, a network-as-a-service (NaaS) offering that combines network and security functions.

ANCAR embeds AI in the carrier network to serve contact centers, branches and stores

ANCAR combines carrier-grade voice infrastructure with AI to optimize customer touchpoints, including contact centers, branch offices and retail stores. NTT DOCOMO BUSINESS says it can be added to existing voice services without new on-premises hardware or large-scale systems integration.

Global – October 31, 2026 -- CIQ has released Stratum Kubernetes Engine (SKE), an Apache 2.0-licensed distribution that packages the roughly ten upstream projects a Kubernetes cluster needs into one signed file for installing, joining, upgrading and maintaining clusters on Enterprise Linux.

CIQ built SKE to cut the upkeep cost that AI workloads add, since training and inference spread across many systems and capacity moves with demand. The company is the team behind Rocky Linux, Fuzzball, Warewulf and Apptainer.

SKE pins and tests every component as one set

SKE builds Kubernetes, etcd, containerd, runc and kube-vip from unmodified upstream source. It adds Cilium for networking and CoreDNS for cluster DNS. Users download the file for their architecture and run stratum up.

The same file then handles four post-install jobs:

Global – October 31, 2026 -- A PHP vulnerability that stalled in triage after a 2024 audit became unauthenticated remote code execution this year once researchers applied frontier AI models, and both PHP2Shell CVEs now carry a CVSS v4.0 score of 9.2.

PHP Foundation admits a 2024 finding stalled for lack of a proven exploit

A 2024 external audit led a PHP core developer to the first signs of an out-of-memory problem, according to the PHP Foundation's account of CVE-2026-109618. An exploit was theorized, but no one found a concrete attack vector. Each candidate fix carried a cost: a compatibility break, new denial-of-service potential, or changes to third-party extensions that seemed impossible to coordinate. Work on the fix stalled and restarted for months.