Key developments on Oct. 24-25:
Pope Leo XIV demands an end to Yemen hostilities, highlights Taiz’s humanitarian crisis and calls for peace after a deadly church attack in Jordan.
Related: Pope Leo XIV Confirms Official Visit to Argentina in November
Pope Leo XIV demanded an immediate end to Yemen hostilities during his Angelus address on Sunday, October 25, warning that civilians are paying the highest price in the conflict. Speaking from the window of the Apostolic Palace before thousands of faithful gathered in St. Peter’s Square, the pope expressed deep concern over the humanitarian situation in Yemen.
He paid particular attention to the city of Taiz, where residents are suffering from severe shortages of food, drinking water and medical care.
“I make a heartfelt appeal for hostilities to cease and for the Yemeni people and all the peoples of the region to be guaranteed the right to live in peace,” Pope Leo said.
The pope’s message came as fighting and road closures have cut off vital supplies in Taiz, leaving civilians increasingly isolated. The Vatican said the pope’s appeal was directed at all parties involved in the conflict and at the international community.
Pope Leo also condemned the broader spiral of violence affecting West Asia, calling for urgent guarantees for regional peace. He denounced the devastating consequences of armed confrontations across the region and urged leaders to choose dialogue over war.
The pontiff said wars not only cause death and destruction but also impoverish and damage the world. His appeal placed the humanitarian suffering of Yemeni civilians at the center of the Vatican’s message.
Pope Leo XIV draws attention to the humanitarian crisis in Yemen, remembers victims of an attack on Christians in Jordan, and looks ahead to the Assisi gathering marking 40 years since the first World Day of Prayer for Peace.https://t.co/UZ47Hb6oMw
— Vatican News (@VaticanNews) October 25, 2026
Vatican News | United Nations Office for the Coordination of Humanitarian Affairs
The pope’s warning focused on Taiz, a city that has become one of the most visible symbols of Yemen’s humanitarian crisis.
Residents face severe shortages of food, clean water, fuel and basic medical services as fighting and road closures restrict the movement of supplies.
Humanitarian organizations have warned that the blockade of supply routes has worsened conditions for hundreds of thousands of people.
The United Nations has repeatedly called for unimpeded humanitarian access to affected communities across Yemen.
Yemen has been devastated by years of war, economic collapse and the destruction of essential infrastructure.
The conflict has left millions of people dependent on humanitarian assistance and has created one of the world’s most severe food-security emergencies.
The pope said the Yemeni people, like all peoples of the region, have the right to live in peace.
His message also called for an end to the cycle of violence that has spread across West Asia.
Pope Leo condemned the human cost of armed conflict and urged the international community to prioritize negotiation and diplomacy.
The Vatican has repeatedly emphasized that military solutions cannot resolve political crises or address the needs of civilians.
The pope’s appeal comes amid heightened tensions across the Middle East, where conflicts have displaced communities, damaged infrastructure and deepened humanitarian needs.
The Vatican’s message called for a regional approach to peace that protects civilians and guarantees access to humanitarian aid.
🚨 Saná denunció que Arabia Saudita incumplió pactos previos a 2023 al bombardear el aeropuerto de la capital y poner fin a la tregua. Mohammed Abdul-Salam afirmó que la vía diplomática se agotó tras la falta de respuestas claras de Riad. #Yemen #ArabiaSaudita #teleSUR #19Oct pic.twitter.com/ONZhAvdkCG
— teleSUR TV (@teleSURtv) October 19, 2026
Jordan News Agency | Middle East Council of Churches
Pope Leo XIV also addressed the deadly attack on worshippers at Saint George’s Orthodox Church in Hamoud, in Jordan’s Karak governorate.
The attack occurred on Friday, October 23, during a funeral service at the church.
Jordanian authorities said gunmen opened fire on worshippers, killing nine people and wounding around 40 others.
The pope prayed for those killed and injured in the attack and expressed his closeness to the affected community.
He also expressed solidarity with Jordan, a country he praised for its history of peaceful coexistence and respect among different religions.
Jordan declared three days of national mourning following the attack.
Jordanian authorities launched an investigation to identify those responsible. No group had claimed responsibility for the attack as of Sunday.
Christian leaders across the region condemned the attack as a crime against humanity and an assault on religious coexistence.
Patriarchs and heads of Churches in Jerusalem called on churches across the region to ring their bells in solidarity and pray for the victims.
The pope’s response highlighted the vulnerability of religious communities in a region marked by political instability and sectarian tensions.
His message emphasized that attacks on places of worship are attacks on human dignity and the right to religious freedom.
The Vatican has repeatedly called for the protection of Christian communities and all religious minorities in the Middle East.
119 ataques aéreos de la coalición saudita en 24 horas contra Yemen. En Taiz, un bombardeo a una escuela y un puesto sanitario dejó 3 muertos y 12 heridos, entre ellos mujeres y niños. La escalada supera 2.177 agresiones. #teleSUR #13oct pic.twitter.com/SLJn8j89uW
— teleSUR TV (@teleSURtv) October 13, 2026
Community of Sant’Egidio | Holy See Press Office
Pope Leo XIV called on the faithful to join spiritually in the peace gathering taking place in Assisi, Italy, on October 27.
The meeting, titled “Unarmed and Disarming Peace,” marks the 40th anniversary of the World Day of Prayer for Peace convened by Saint John Paul II in 1986.
The event is organized by the Community of Sant’Egidio and brings together religious leaders, representatives of Christian Churches and figures from other faiths.
The 2026 gathering includes 384 representatives of religions, cultures and institutions from 53 countries.
Participants will take part in 24 thematic forums addressing conflict, disarmament, migration, poverty, young people and the role of religions in building peace.
The pope had planned to attend the closing ceremony in person but canceled the trip on medical advice after undergoing thoracic surgery.
The Vatican said Pope Leo would send a message expressing his closeness to organizers and participants.
The pope urged believers around the world to join the Assisi gathering in prayer.
“Never has it been more evident that wars, in addition to sowing death and destruction, impoverish and harm the world,” he said.
The pope called on the international community to abandon weapons and commit decisively to understanding and harmony among peoples.
The Assisi meeting recalls the historic 1986 gathering, when Pope John Paul II brought together representatives of different religions to pray for peace.
That event became a landmark in interreligious dialogue and remains a reference point for Vatican diplomacy.
The 2026 meeting seeks to renew that tradition at a time of multiple conflicts and growing humanitarian crises.
The pope’s appeal on Yemen hostilities reflects the Vatican’s broader diplomatic effort to promote dialogue in a region marked by war and humanitarian emergencies.
Yemen’s conflict has become one of the world’s most severe humanitarian crises, with millions of people facing hunger, displacement and limited access to healthcare.
The war has drawn in regional and international powers, making a political solution increasingly difficult.
The crisis in Taiz illustrates how blockades, fighting and the collapse of public services can trap civilians between military objectives and humanitarian needs.
Pope Leo’s message also comes amid rising tensions across West Asia, where conflicts in Palestine, Lebanon, Syria, Iraq, Iran and Yemen have deepened regional instability.
The Vatican has positioned itself as a voice for civilian protection, humanitarian access and negotiated settlements.
The pope’s call for peace in Yemen and his solidarity with Jordan highlight the connection between armed conflict, religious violence and the erosion of social cohesion.
The Assisi gathering offers a platform for religious leaders to promote dialogue at a time when political institutions face growing difficulty in resolving conflicts.
The Vatican argues that interreligious cooperation can help reduce hatred, protect minorities and build conditions for peace.
The pope’s message is a reminder that wars have consequences beyond battlefields: they destroy economies, displace communities and damage the future of entire generations.
PHP2Shell vulnerabilities allow unauthenticated remote code execution in PHP, prompting emergency patches, mass attacks and global website shutdowns.
Related: Anthropic’s Claude Mythos Escapes Sandbox in Alarming Cybersecurity Test 2026
The PHP2Shell vulnerabilities have triggered one of the most widespread cybersecurity emergencies in recent years, forcing governments, banks, airlines and global platforms to take preventive action.
The flaws are two critical vulnerabilities in PHP, the open-source programming language that supports an estimated 70 percent of websites worldwide.
The PHP Foundation released emergency patches on Wednesday, October 21, after technical details leaked before the planned coordinated disclosure.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable web servers without logging in.
The PHP Foundation rated both flaws 9.2 out of 10 on the CVSS scale, placing them in the critical category.
The vulnerabilities affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Security researchers say successful exploitation could give attackers remote access to a server’s file system, database and sensitive data.
The flaws could also allow attackers to install malicious software, steal credentials and use compromised servers to launch further attacks.
The PHP Foundation urged administrators to update immediately to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
The organization said PHP 8.1 and earlier versions no longer receive official security updates, although some Linux distributions and long-term support vendors have issued backported fixes.
The emergency response came after researchers discovered the vulnerabilities using artificial intelligence, highlighting a new phase in cybersecurity.
PHP Foundation | Cybersecurity and Infrastructure Security Agency
The PHP2Shell vulnerabilities were identified through an unusual collaboration between security firms and artificial intelligence systems.
Researchers at the security firm Calif discovered one of the flaws with support from OpenAI’s GPT-5.6 Sol model.
The work was carried out under OpenAI’s “Patch the Planet” initiative, which aims to use advanced AI to identify and help fix security weaknesses in widely used software.
In parallel, cloud security company Wiz, acquired by Google, said it independently identified both vulnerabilities with AI assistance.
The discoveries revealed flaws that had remained hidden in PHP’s code for years. Some reports suggest the weaknesses may have existed for more than a decade.
The PHP Foundation said the vulnerabilities had been known internally since at least 2024, but efforts to fix them had stalled.
The organization said there had been no practical route to exploitation and that proposed solutions carried technical disadvantages.
The foundation acknowledged that the delay was a structural failure, linked to internal decision-making and limited resources.
The situation worsened when technical details leaked on Tuesday, October 20, before the patches were publicly available.
The leak occurred after Chainguard released built images containing the fix ahead of the agreed embargo, allowing attackers to identify changes in the code.
The PHP Foundation responded by releasing emergency updates on Wednesday, October 21, at 14:00 UTC.
The organization urged website operators to update “immediately” and prioritize internet-facing systems.
The National Security Agency, known as the NSA, advised organizations that could not patch immediately to take affected systems offline until they could be fully protected.
Spain’s National Cybersecurity Institute, known as INCIBE, issued a similar warning, urging administrators to update PHP systems or isolate servers exposed to the internet.
Cloudflare | National Cybersecurity Institute of Spain
The disclosure of the PHP2Shell vulnerabilities triggered a rapid wave of attack attempts across the internet.
Cloudflare reported that it observed thousands of exploitation attempts in the 10 hours before the public announcement.
After the details became public, the number rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions shortly afterward.
The attacks included large-scale scanning, attempts to identify vulnerable systems and tests of exploit code.
Security experts warned that the speed of the activity showed that attackers could identify vulnerable targets at an industrial scale in near real time.
The threat prompted governments and companies to take preventive measures in several countries.
In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA, East Japan Railway and Tokio Marine temporarily suspended some online services.
Reports of disruptions or alerts also emerged in Finland, the Netherlands, Germany, the United Kingdom, France and China.
The Wikimedia Foundation disabled several systems as a precaution. The move affected parts of the infrastructure behind Wikipedia and related projects.
Telecommunications company Orange suspended access to certain PHP-based websites and applications.
South Korea raised its national cybersecurity alert level in response to the threat.
In Spain, INCIBE reported that around 12 percent of public administrations and companies were receiving attack attempts linked to the vulnerabilities.
The Spanish government said there were no confirmed problems in ministerial or state websites.
Despite the scale of the activity, no massive successful intrusion had been publicly confirmed as of Thursday.
Security firms said most of the detected activity consisted of scanning and failed exploitation attempts.
However, experts warned that it was only a matter of time before attackers compromised systems that had not been updated.
The risk is particularly high for small organizations and websites with limited cybersecurity resources.
Many of these systems may remain unpatched for days or weeks, creating a prolonged window of exposure.
Security experts also warned that attackers could exploit public concern to launch phishing campaigns.
Fraudsters may send emails or messages impersonating banks, government agencies or affected platforms to steal passwords, payment details or personal information.
The PHP2Shell vulnerabilities demonstrate how artificial intelligence is changing the speed and scale of cybersecurity operations.
AI helped researchers identify, understand and validate complex flaws that had remained hidden for years.
Traditional security audits can take months to examine large codebases. AI tools can analyze patterns, test hypotheses and identify potential weaknesses more quickly.
OpenAI said advanced AI found the vulnerabilities before attackers could exploit them. The company also acknowledged that the same capabilities can be used to create offensive tools.
The dual nature of AI has become a central concern for cybersecurity experts.
The technology can accelerate vulnerability discovery, patch development and threat detection. But it can also lower the cost and time required for malicious actors to develop automated attacks.
The PHP2Shell case shows that the time between discovery, disclosure and exploitation is shrinking.
Attackers were able to analyze leaked technical details and begin testing exploits before many organizations had applied patches.
Security researchers say the challenge for defenders is not only finding a vulnerability but replacing it with a tested and reliable fix.
Organizations must also ensure that their web servers are actually running the patched version of PHP.
The PHP Foundation said the vulnerabilities affect all PHP installations that serve web requests, regardless of the application running on top of them.
That includes websites built with WordPress, Drupal, Joomla, Magento and MediaWiki.
The widespread use of PHP means that a flaw in its core can affect a vast portion of the internet’s infrastructure.
PHP was created for web development and has been used since the early 2000s. It helped enable the interactive web, online stores, social networks and content management systems.
The language remains central to many of the world’s most visited websites and digital services.
The PHP2Shell vulnerabilities have implications beyond technical security because they expose the fragility of global digital infrastructure.
Critical systems often depend on open-source software maintained by small teams, volunteer communities or nonprofit organizations with limited funding.
The PHP Foundation acknowledged that resource constraints contributed to the delay in fixing the flaws.
The incident has renewed debate over how governments and large technology companies should support the maintenance of open-source software.
Many public services, financial institutions, hospitals and private companies rely on software that is free to use but expensive to secure.
The crisis also highlights the geopolitical importance of cybersecurity. Attacks on web infrastructure can disrupt banking, transport, communications, government services and commerce.
The rapid global response reflected the interconnected nature of the internet. A vulnerability in one programming language affected organizations across multiple continents.
The incident could increase pressure for international cooperation on cybersecurity standards, vulnerability disclosure and incident response.
It may also accelerate investment in AI-driven defense systems, as governments and companies seek to identify threats before attackers can exploit them.
For ordinary users, the immediate risk is not to fix PHP themselves but to follow official guidance from the services they use.
Users should change passwords if a platform requests it, enable two-factor authentication where available and avoid suspicious emails or messages related to the crisis.
The PHP2Shell vulnerabilities are a warning that cybersecurity is no longer only a technical issue. It is now a matter of economic stability, public trust and national security.
Northern Germany probably isn’t the first place you’d think of to look for a U.S. Navy and Marine Corps classic attack jet. However, contract aggressor company Top Aces flies a squadron of deeply upgraded Douglas A-4N Skyhawks to support European air arms for their “red air” training needs.
Nearly 3,000 A-4s were built between 1956 and 1979, and TWZ’s Jamie Hunter traveled to the Germany Navy base at Nordholz for the latest episode of our “Special Access” to witness some of the last, and by far the most modern, Skyhawks operating up close.
There he learned what it was like operating the iconic but nearly antique jets against some of the world’s most capable fighters. He also discovered that significant developments are on the horizon for Top Aces in Europe, principally the arrival of F-16s that will further enhance the company’s aggressor services for its growing list of European customers.
Enjoy the show!
The post A-4 ‘Super’ Skyhawks Playing The Bad Guys In European Skies appeared first on TWZ.
Login