Two major cybersecurity developments drew attention on October 29, 2026, involving a Telegram Android security vulnerability and active attacks exploiting critical PHP flaws known as PHP2Shell. The incidents highlight risks affecting mobile applications, websites, and network security products.
Security researchers disclosed a Telegram voice-call flaw that could potentially be combined with other vulnerabilities to compromise an Android device. Separately, Palo Alto Networks confirmed attacks targeting certain internet-exposed management interfaces affected by PHP vulnerabilities.
On October 29, 2026, cybersecurity startup NebuSec disclosed a vulnerability in Telegram for Android that researchers said could be combined with two additional security weaknesses to execute malicious code and potentially gain control of an affected phone after a user answered a voice call, according to the original report on the flaw.
According to the researchers, the vulnerability affected Telegram Android versions 8.6.2 through 12.10.3. An attacker needed only a regular Telegram account to initiate the reported attack, without requiring the victim’s password.
NebuSec demonstrated the issue using private voice calls on Android phones with ARM64 processors. The researchers did not establish that the same attack affected Telegram’s iOS or desktop applications or group calls. At the time of disclosure, NebuSec reported no known real-world exploitation, and the vulnerability had not received a CVE identifier.
Telegram addressed the identified call-signalling vulnerability in Android version 12.10.4, released in late September 2026. Android users should check their installed Telegram version through the application’s Settings page and update to version 12.10.4 or later using the official Telegram for Android download page or their trusted app store.
Until the application is updated, users can reduce exposure to the reported attack by declining unexpected voice calls or temporarily changing Telegram’s call privacy setting to “Nobody.”
Users should also be cautious of fake security updates or suspicious verification pages. TechBonafide’s guide to fake CAPTCHA malware explains how deceptive websites can trick people into downloading harmful software or running unsafe commands.
Another major security development involves two critical vulnerabilities in PHP, the programming language used by many websites and online services. The PHP project published a security advisory on two critical PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619.
Under certain conditions, these vulnerabilities can allow an attacker to execute malicious code on an affected server without providing login credentials. Both flaws received critical severity ratings of 9.2 under CVSS 4.0.
On October 21, 2026, the PHP development team released security updates addressing the vulnerabilities. The fixed releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Website administrators running affected installations should apply the appropriate security-fixed version or a vendor-supported package containing the relevant fixes.
On October 29, Palo Alto Networks updated its security advisory to confirm active exploitation of PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the public internet. The affected products include certain PA-Series and VM-Series firewalls and Panorama management systems.
These attacks create particular risks for organizations that allow sensitive network management interfaces to remain accessible from the internet. Palo Alto Networks recommends restricting management access to trusted systems and applying the relevant security fixes or vendor-approved mitigations.
Website administrators should identify PHP installations across their servers, check whether security-fixed versions are installed, and prioritize internet-facing services for updates. Organizations using affected PAN-OS or Panorama products should also review the vendor’s security guidance, restrict unnecessary public management access, and investigate suspicious activity on previously exposed systems.
Artificial intelligence also played a documented role in investigating the PHP2Shell vulnerabilities. In a Google Cloud security update, the company reported that its Gemini 4 Argon model contributed to identifying the security weaknesses, studying possible exploitation methods, and validating security fixes.
The development illustrates how AI-assisted security research can help researchers investigate complex vulnerabilities and accelerate defensive work. However, finding a flaw with AI does not mean affected systems are automatically protected; organizations still need to install the necessary updates.
For more developments in AI-assisted cybersecurity, readers can explore TechBonafide’s coverage of AI systems used to detect software vulnerabilities, including new models designed to help security researchers find software weaknesses.
For Telegram users, the immediate priority is to confirm that the Android application has been updated to a fixed version. Strong passwords and two-factor authentication remain useful against account theft, but they cannot repair a vulnerability in an application’s call-handling code. Users should also avoid unofficial software updates and suspicious download links.
Businesses should identify vulnerable PHP systems, install available security patches, limit access to sensitive management interfaces, and monitor affected infrastructure for signs of compromise. Systems previously exposed to active attacks may require a security investigation rather than a software update alone.
Organizations can further reduce their exposure by limiting privileged access and separating sensitive management systems from public networks. TechBonafide’s guide to Zero Trust security for small businesses explains practical ways to strengthen access controls and reduce the impact of a compromised system.
The Telegram vulnerability and PHP2Shell attacks demonstrate why security updates and exposure checks remain important for individuals and organizations. Telegram Android users should confirm they have installed a fixed version, while website administrators and network security teams should review the latest PHP and PAN-OS guidance and address vulnerable systems without delay.
