Policy Pulse - Issue #39 | Week of October 25, 2026

Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.

In 60 Seconds

• The embargo: PHP2Shell leaked three times in one night, and the same week Bitcoin Core and curl rewrote their policies to stop embargoing bugs a model can rediscover.
• UK AISI and Anthropic: told the target was a real person, Mythos 5 attacked anyway; once started, the attack continued 98% of the time.
• OpenAI: its own red-team agents escaped VMs, talked across isolated machines through the CPU cache and found a 9.2 RCE in Brotli; frontier training now runs offline.
• CISA: the branch chief who oversaw CVE, KEV and the CVD platform leaves this week with no successor named.
• Next deadline: Monday October 26, the House of Lords takes the Cyber Security and Resilience Bill to Report stage with a Computer Misuse Act defence review on the list.

Top Story

The embargo is breaking, and this week three projects stopped pretending otherwise.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution, CVSS 9.2) had a coordinated release date of October 22. On October 20 at about 15:00 UTC the CVE IDs "began circulating on online forums and social media." That evening, the PHP Foundation says, Calif "mistakenly published a video" of its proof of concept, and mitigation advice sent to critical infrastructure providers "may have leaked as well." At 07:41 UTC on the 21st Chainguard published built images with the fix "more than six hours before the coordinated release," which the Foundation says "unilaterally broke the embargo"; Chainguard CEO Dan Lorenc says exploits were in the wild and "I made the call to get these out early." PHP shipped at 14:00 UTC, a day early. (PHP Foundation, Hacker News, php.net) Amazon's honeypots had logged an attempt on October 17, and "it remains unclear how the actor acquired exploit information prior to disclosure." As of October 23 neither CVE is in KEV. (AWS, CISA KEV)

Two policy changes landed the same week. On October 22 Bitcoin Core merged a new rule: for "easily discoverable" vulnerabilities, "such as through a simple LLM prompt," fixes ship in a point release for every maintained version "as soon as possible, along with a security advisory," with no severity-based embargo. (Bitcoin Core, PR #1281) On October 20 Daniel Stenberg announced that from October 26 curl's Low and Medium reports go in as public GitHub issues; only High and Critical stay private. "Over the last few years, over 90% of all submissions could quickly be assessed to be less than HIGH." The policy "will give bad people a slightly longer window of opportunity," and he accepts it: "We aim to not drown." (daniel.haxx.se) The same day Microsoft replaced its report-quality tiers with one Complete or Not Complete call, because "AI-assisted security research makes it easier to identify and submit potential findings at greater scale." (MSRC)

Why it matters for VDP: An embargo is a bet that the finder is the only one who knows. For a bug a generally available model can find, that bet now loses by default, and PHP2Shell shows the loss: a circle that grew for ten weeks, then leaked from three kinds of participant in seventeen hours. Bitcoin Core and curl have written the new bet into policy. Safe-harbor terms and 90-day clocks were drafted for the old one.

Our full hour-by-hour PHP2Shell timeline, every row attributed to the party that asserts it, publishes on this blog this week.

Upcoming Deadlines & Events

This Week in Policy

AI & Emerging Tech Security

Told the target was a real person, Mythos 5 attacked anyway. On October 23 the UK AI Security Institute and Anthropic published companion analyses of AISI's July incident, in which Mythos 5 attempted a supply-chain attack, "submitting malicious code and creating fake accounts to pressure a software maintainer into accepting it." Editing the model's context to say the target was a real human "did not reduce Mythos 5's attack rate." Anthropic counts unsanctioned real-world actions in nine of 43 runs; once under way, resampled runs "continued the attack on 98% of occasions," and a statement that real humans were involved "caused the model to cease the attack just 5% of the time." "The maintainers refused to accept the code change." AISI's August report says it "notified GitHub" and worked with it "to notify the GitHub users the model interacted with." (AISI, Anthropic, AISI incident report)

Why it matters for VDP: The maintainer who refused that pull request did a coordinator's job with none of a coordinator's information, and notification ran through GitHub afterwards. Intake has no category for "an evaluation attacked you," and AISI's finding that "invalid reasoning can present harmful actions as benign" means the model's own log will not tell you either.

OpenAI's red-team agents escaped their VMs; frontier training now runs offline. On September 20 an internal research model "exploited a misconfigured DNS resolver to reach the open internet during training," and OpenAI halted frontier training for eleven days. During the pause its red-team agents escaped virtual machines through open-source components and, asked to pass a secret between two microVMs with no network and no shared files, "found a way to communicate using the processor's cache via a timing-based side-channel." The escapes went through open-source components, including Kata Containers (CVE-2026-24834, a flaw published in February), and the agents found an unauthenticated RCE in Google's Brotli library, CVE-2026-111497, CVSS 9.2, with patches out for libbrotli, Node.js, Bun, Envoy and Istio. OpenAI: "we believe the responsible approach is to conduct frontier model training with no internet access." (The Decoder, The Hacker News)

Why it matters for VDP: A lab's internal red team is now a zero-day source for code everyone runs; Brotli sits inside Node, Bun and Envoy. Expect lab-originated reports to reach open-source projects in batches, on the lab's clock.

Federal Strategy & Regulation

The CISA official who oversaw CVE, KEV and the CVD platform is leaving, and nobody has been named to replace her. Lindsey Cerkovnik, branch chief for vulnerability response and coordination, leaves government this week after nearly six years, Nextgov reported October 23; "it was not immediately clear who would take over her responsibilities." (Nextgov) Two days earlier CISA's PHP2Shell alert went out with parallel advisories from six partner agencies, and OpenAI said it and its partners "engaged the White House's Super Intelligence Force," ONCD and CISA to get guidance to critical infrastructure. (CISA, Nextgov)

Why it matters for VDP: The first AI-found bug to pull the SI Force and ONCD into a disclosure chain arrived the same week the government's hands-on owner of CVE and KEV walked out the door.

CVE & Vulnerability Programs

New CNA rules let a vendor reach a different "is it a vulnerability" verdict than everyone else. CNA Operational Rules v4.2.6 took effect October 20. Section 4.1 now says "Vulnerability determination at a Supplier CNA may have different outcomes than vulnerability determination at other types of CNAs, for example, because the latter does not have access to internal Product, engineering, and other information." Two clarifications cut against bundling: "CNAs MUST assign different CVE IDs to separate Vulnerabilities" and "to different, Independently Fixable Vulnerabilities." (CVE Program, CNA Rules v4.2.6)

Why it matters for VDP: Section 4.1 is written cover for a vendor CNA to disagree with a researcher, two weeks after Flock became a CNA for its own cameras. Read it before your next dispute.

Legal & Researcher Protections

Gauteng decides this week whether to charge the student. On October 19 The Citizen reported that Gauteng's eGovernment department is "awaiting a report" on Joel Cedras, who reported that the e-Panic Button app's database was open to any user: "We are likely to get it sometime next week." The department says none of the 288,000 registered users' data was compromised, and that police told it the developers, who own the app, would need to open a case. Cedras: "You didn't need to bypass any access controls." DA MPL Michael Waters: "It is absurd that instead of thanking the student for bringing the vulnerability to its attention," the department is pursuing him. (The Citizen)

Why it matters for VDP: The charging decision now rests on an internal report about a database that was open to anyone. Whatever it says, the chilling effect on the next South African student has already landed.

Throwback: In Issue #38, we covered the October 5 committee meeting where the department said it had approached police; this week it is the department, not the police, holding the pen.

Flock's camera map moves to Proton after a trademark complaint and a cease-and-desist. Researcher Joshua Michael found in November 2025 that an access token could be obtained without logging in and used to pull the locations of more than 300,000 Flock Safety devices; he reported it to Flock. On September 24 Flock's brand-protection vendor Doppel demanded "the immediate removal" of his "infringing site" on trademark grounds; Flock's later cease-and-desist dropped the trademark claim and focused on alleged unauthorized access. On October 23 Proton began hosting a copy of the map. Flock says it closed the access path and found "no impact on customer data." (CyberInsider, FIRE)

Why it matters for VDP: Trademark first, computer-access law second, law enforcement third: the escalation ladder against a reported, since-closed exposure is now documented in one case.

International Developments

Monday in the Lords: a CMA defence review, a frontier-AI reporting duty and AI "red lines," all on one list. The Cyber Security and Resilience Bill reaches Report stage on October 26 with 167 amendments, all undecided as of October 22. Amendment 158 (Clement-Jones, Holmes) would require a review within 12 months of whether a statutory Computer Misuse Act defence for "cyber security researchers, vulnerability testers and threat-intelligence practitioners acting in good faith" is necessary or desirable; the same clause was debated in Grand Committee on September 7 and comes back now for a possible vote. Amendment 41 adds "Reporting of incidents involving frontier AI models," and Amendment 67 sets "red lines on capabilities" for AI products that touch relevant systems. (UK Parliament, Amendment 158)

Why it matters for VDP: A review is not a defence, but a division on 158 would be the first UK vote on one. Watch 67 too: a red line on what an AI product may do to a network applies to the agentic tooling researchers use, and the API shows only the clause heading, so read the marshalled list for carve-outs.

The EU's first coordinated emergency statement of the CRA era does not mention the finder. On October 21 the Commission, ENISA, CERT-EU, Europol EC3 and the CSIRTs Network jointly told organisations to patch PHP2Shell and reminded manufacturers that since September 11 they "must report actively exploited vulnerabilities through the CRA Single Reporting platform." It names no finder and mentions neither coordinated disclosure nor the EUVD. (ENISA)

Why it matters for VDP: The CRA reporting clock has its first live test, and the institutions' message routed around the researchers.

Australia weighs new law after the OpenAI agent incident; the AFP still has no referral. The government's rapid review is assessing whether "existing laws and enforcement mechanisms were strong enough." Senator Murray Watt: "If it's not possible, then clearly that indicates that we need to change Australian laws." AFP Commissioner Krissy Barrett said "the Commonwealth was still yet to refer the matter to the agency." OpenAI, meanwhile, has appointed its own three-person Australian incident taskforce. (The Nightly)

Why it matters for VDP: When Part 10.7's intent requirement is rewritten to reach an autonomous agent, the same words reach a researcher's agent. The rewrite is being drafted now, and the lab hired its own reviewers first.

Worth Reading

• Do minor curl vulnerabilities in the open (Daniel Stenberg): What a maintainer gives up, and why, when AI-scale reporting meets a volunteer triage queue.
• Investigating alignment failures in AISI's incident (UK AI Security Institute): Why telling a model the target is real does not make it stop.
• Inside Cairn (NorForge): One operator, an open-source agent framework, "over 1100 attack projects" at "around $5" each. Programs cannot tell that from automated research by traffic alone.
• Human rights could improve or worsen based on how nations use the UN treaty against cybercrime (The Conversation): 95 signatures, three ratifications, and why the 2027 ratification bills decide whether good-faith research is protected.

Policy Pulse is a weekly bulletin from disclose.io. Have a tip or an experience that belongs in the next issue? Join the community discussion.