Cloud & Business Apps
Cybersecurity
Data & AI
IoT & Connectivity
Industry
Health
Banking and Finance
Public Sector
Retail
Tourism and Leisure
Transport & Logistics
Energy & Utilities
Smart Cities
Cybersecurity Weekly Briefing, 17-23 October
Update on php2shell: exploitation attempts, public PoC and risk of widespread outages on PHP sites
Cloudflare and Amazon have detected attack traffic targeting php2shell, the critical vulnerabilities in the PHP runtime CVE-2026-109618 (CVSSv3 9.8) and CVE-2026-109619 (CVSSv3 9.8), which were patched on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The details were leaked prior to the coordinated disclosure, and the company has observed pre-patch exploitation attempts, with attackers modifying the payload to bypass the WAF rules that Cloudflare applies by default, including on its free plan.
Furthermore, a researcher has published a functional proof-of-concept (PoC) on GitHub targeting unpatched versions of PHP, bringing closer the scenario of widespread exploitation that Wiz anticipates—involving the deployment of webshells—which it compares to Log4Shell.
The potential impact of php2shell is enormous: PHP powers around 70 per cent of websites (including WordPress, Drupal, Joomla and Magento, amongst others); Censys counts 54.9 million web properties using PHP; and, according to Krebs on Security, widespread site outages are to be expected whilst patches are being applied, with European government websites already taken offline, according to Reuters. It is essential to update PHP itself; simply updating the application or plugins is not enough.
UNC7017 manipulates AOMEI Backupper update servers to distribute a backdoor, with victims in Spain
The Google Threat Intelligence Group has detailed a supply chain compromise of AOMEI Technology attributed to the UNC7017 cluster. Between April and July 2026, the actor altered AOMEI Backupper’s update configuration files within windows of just five to ten minutes and then restored them to their original state to avoid detection. Systems checking for updates during those minutes downloaded the CROSSROAD downloader. This creates the scheduled task ‘RadminComponentRuntime’ and deploys the SHINYROAD backdoor via DLL sideloading onto a legitimate Radmin binary.
On some machines, Adaptix C2—disguised as Nitro PDF—was subsequently added, and in July, an invisible 1x1-pixel window was introduced that forces the transmission of NetNTLMv2 hashes via WebDAV. Affected organisations include those in the IT services, telecommunications and higher education sectors across 11 countries, including Spain and Portugal.
The fix that AOMEI applied to its servers does not clean machines that are already infected.
ConnectWise suspends its backup services following a breach of Microsoft 365 application identities
ConnectWise has disabled seven application identities and temporarily suspended Cloud Backup, SaaS Security and Cloud Management after detecting unauthorised access to Microsoft 365 environments. The attackers are believed to have misused application credentials to authenticate via Microsoft Entra ID and gain access to services such as Exchange Online, SharePoint and Teams, with the potential to escalate privileges and create new persistence mechanisms.
Huntress identified login activity associated with nearly 1,000 Entra tenants, with approximately 300 successful authentications, although this does not imply that all were compromised. It also confirmed the misuse of the Teams application in at least one environment.
Revoking the original connections does not remove credentials, permissions or additional identities created during the incident.
The FBI attributes more than 600 victims in the US and Europe to the SafePay ransomware Group
A joint advisory from the FBI and cybersecurity agencies in Germany and the UK ranks the SafePay ransomware group amongst the most active in 2026, with at least 600 organisations compromised in the United States and Europe since August 2024, and the most recent incident recorded in August. SafePay gains access through password guessing, phishing and the automated exploitation of vulnerabilities in exposed systems, including known flaws in Cisco ASA/FTD, Veeam Backup & Replication and SonicWall SonicOS.
Once inside, it creates or hijacks accounts, changes the passwords of legitimate users, moves around using system tools, disables security measures and exfiltrates compressed data before deploying the encryptor via AnyDesk or TeamViewer. The group demands a percentage of the victim’s turnover in cryptocurrency and pressures them with telephone calls. Some of its code is reminiscent of LockBit. Among its recent victims are the British firm Microlise and Conduent, whose attack affected Medicaid, toll and food aid services in the US.
GitLab patches a CVSSv3 10.0 vulnerability that allows remote code execution without authentication
GitLab has released emergency updates for CVE-2026-110264 (CVSSv3 10.0 according to GitLab), an integer overflow in the regular expression compiler (Onigmo) that allows an unauthenticated attacker to execute arbitrary code on the server. The vulnerability affects both GitLab Community Edition and Enterprise Edition and affects versions from 7.0 onwards, meaning it impacts both older and newer deployments equally; it has been fixed in branches 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. The advisory includes two detections for self-managed clients (“Onigmo native worker crash” and “Org mode render error burst”), although GitLab has not confirmed any active exploitation.
Given that this is a widely deployed DevOps platform and that the exploit requires neither privileges nor user interaction, administrators of self-managed instances should update immediately; GitLab.com is already running the patched version.
◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →
