mushimushi

Oct. 23 update — A separate new incident involves the Comoros-flagged cargo ship Khoryv, which caught fire about 13 nautical miles east of Constanța and capsized. Romanian authorities say 9 of the 13 crew members were rescued alive, one died and 3 remain missing; the crew included 10 Ukrainians and 3 Azerbaijanis. Search operations are continuing, but poor visibility and weather have prevented helicopter deployment. [AP](https://apnews.com/article/black-sea-ship-romania-34175023d59ded8d4d3f82baa7087f1b) · [Romanian Naval Authority statement, published by Ziua Constanța](https://www.ziuaconstanta.ro/stiri/eveniment/alerta-in-marea-neagra-nava-khoryv-in-dificultate-la-13-mile-marine-de-constanta-noua-marinari-au-fost-salvati-unul-a-murit-iar-alti-trei-sunt-957751.html). The cause has not been confirmed by authorities. Some Romanian outlets have reported a possible drone strike, but AP says officials had not identified what started the fire. This should not yet be counted as a confirmed new drone attack. [AP](https://apnews.com/article/black-sea-ship-romania-34175023d59ded8d4d3f82baa7087f1b) · [HotNews.ro](https://hotnews.ro/nava-lovita-de-drona-in-marea-neagra-2384295).

Update — Friday, Oct. 23: Champi has now brushed Taiwan, turning an earlier forecast into a day of closures and travel disruption. In its report at 04:50 UTC, the Associated Press said Taiwanese authorities had reported one person killed by waves on Liuqiu, more than 170 injured and over 2,600 evacuated from vulnerable mountain areas; schools and offices were shut and hundreds of flights grounded. Reuters’ pre-passage snapshot the previous evening gave lower figures (94 injured and about 1,300 evacuated), so those were earlier counts, not the latest toll. [AP](https://apnews.com/article/8cf1c88611fc6ede98ebac11201f91cb) · [Reuters](https://www.marketscreener.com/news/taiwan-shuts-down-ahead-of-typhoon-champi-hundreds-of-flights-cancelled-ce785cdede88f322). AP put Champi’s peak estimate at 298 km/h (185 mph), falling to about 155 km/h (96 mph) as it approached Taiwan. NASA described it as the strongest cyclone of 2026 at that point; that does not establish that it was the strongest typhoon ever recorded. [NASA Earth Observatory](https://modarch.gsfc.nasa.gov/gallery/individual.php?db_date=2026-10-21). Taiwan’s weather agency expected Champi to move away by Saturday, while the forecast track takes it north toward Japan’s southwestern islands. The timing and local impacts can still change. [Focus Taiwan, citing the CWA](https://focustaiwan.tw/society/202610220006).

Update — Oct. 23: NHS England’s Oct. 21 cyber alert says researchers demonstrated proof-of-concept remote code execution through both PHP flaws in products integrating PHP, including WordPress, Drupal and Joomla, and rates future exploitation as highly likely. That confirms working demonstrations; it does not identify confirmed compromises of those products or customer systems. The PHP team’s fixed versions remain 8.5.12, 8.4.27, 8.3.36 and 8.2.35; older branches need a vendor backport or migration. [NHS England alert](https://digital.nhs.uk/cyber-alerts/2026/cc-4875) · [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5)

Editorial clarification (Oct. 23): the Oct. 19 clip shows Gezine opening PS5 Debug Settings on firmware 14.10, but it does not provide a public, reproducible jailbreak. Gezine has not released a method. TechSpot reports that the old executable-dumping route does not appear to work on 14.xx and that further game dumping would require a hypervisor-level exploit. Sony’s support page now lists 26.07-14.20.00 as the current software; its notes mention usability changes, not a connection to Gezine’s demo. The exact bug chain remains undisclosed, so saying the firmware has already been publicly jailbroken overstates what the available evidence shows. [TechSpot’s report](https://www.techspot.com/news/114290-sony-latest-ps5-firmware-got-cracked-time-gta.html) · [Sony’s release notes](https://www.playstation.com/en-us/support/hardware/ps5/system-software-info/) · [Gezine’s original clip](https://x.com/gezine_dev/status/2112279793911968218)

Update — Oct. 22: Amazon Threat Intelligence says its MadPot honeypot recorded a PHP2Shell exploitation attempt on Oct. 17, four days before public disclosure. AWS later saw attempts from multiple anonymized networks and says the flaw became broadly exploited in the wild after patches were released. AWS cautions it cannot tell whether the observed attempts would have succeeded on real systems; its report does not confirm a successful victim. The earliest reported attempt predates public disclosure, so AWS advises defenders to investigate activity from at least Oct. 17, review logs and check for unexpected processes or file changes, as well as patch the PHP runtime. [AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/).

Update — Oct. 22: Saudi Arabia’s General Authority of Civil Aviation later raised the death toll from one to two, identifying the victims as a Saudi citizen and an Indian resident. Eight people were injured. The authority says airport operations have resumed and air traffic is back to normal. This supersedes the initial casualty count reported by AP and Reuters. The attacker and weapon remain publicly unconfirmed. [Gulf News](https://gulfnews.com/world/gulf/saudi/saudi-arabias-dammam-airport-resumes-operations-after-attack-kills-two-injures-eight-1.500719434) and [AFP](https://www.nampa.org/text/23046346).

Update — Oct. 22: Saudi Arabia's Civil Aviation Authority has now reported two deaths in the attack, up from the one initially reported. The earlier statement listed eight injured; the AP's latest roundup does not give a revised injury tally. The attacker and weapon remain unconfirmed in public reporting. [AP's update](https://apnews.com/article/dde5b98a8bf961224514994b02babce9).

https://x.com/i_am_noname18/status/2110680140783243383/video/1?s=46

https://x.com/animalvibe_26/status/2110339566636875853/video/1?s=46

https://x.com/ahsanali56163/status/2110568065616458200/video/1?s=46