Week of October 19, 2026: SafePay Ransomware Advisory and PHP2Shell Flaws Dominate Patch Alerts

Security leaders spent the week of October 19, 2026 responding to a joint CISA-FBI advisory on SafePay ransomware, which had affected roughly 600 victims, and to emergency guidance on two critical PHP remote-code-execution flaws nicknamed php2shell. CISA also added eight vulnerabilities to its Known Exploited Vulnerabilities catalog, spanning Plex Media Server, Siemens Software Center, Collabora Online, and Arista VeloCloud Orchestrator, while DHS named a new Assistant Director for Cyber Integration.

CISA, FBI Detail SafePay Ransomware's 600-Victim Campaign

CISA, the FBI, the US Secret Service, and international law enforcement partners published a joint advisory on SafePay ransomware, describing it as one of the most active ransomware groups of 2026 with roughly 600 victims across North America, South America, Europe, and Australia. The group gained initial access through compromised credentials and known vulnerabilities in internet-facing devices, often via VPN services, before deleting backups, stealing data, and encrypting systems. The advisory urged organizations to patch known exploited vulnerabilities, require multifactor authentication, and maintain offline backups. (CISA)

CISA Demands Immediate Patching for Critical PHP RCE Flaws

CISA issued an alert urging organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed php2shell, which allow unauthenticated remote code execution across PHP installations including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. CISA directed organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take affected systems offline if patching was not immediately possible. The alert referenced parallel guidance from NSA, NCSC-UK, ASD's ACSC, NCSC-NL, NCSC-NZ, and Canada's Cyber Centre. (CISA)

CISA Catalogs Six Actively Exploited Flaws Spanning Plex and Siemens

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including four Plex Media Server flaws, an OS command injection bug in EG Secure Solutions SiteGuard Server Edition, and an uncontrolled search path vulnerability in Siemens Software Center. The agency's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed flaws on publicly exposed assets that grant full control post-exploitation, and CISA encouraged all organizations to adopt the same risk-based approach. (CISA)

Collabora Online Command Injection Flaw Added to KEV Catalog

CISA added a Collabora Online built-in CODE Server OS command injection vulnerability, CVE-2026-110447, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition fell under Binding Operational Directive 26-04, which sets remediation deadlines for Federal Civilian Executive Branch agencies for vulnerabilities that grant attackers total control of an asset after exploitation. CISA again encouraged all organizations, not only federal agencies, to prioritize patching catalog entries on internet-facing systems. (CISA)

Arista VeloCloud Orchestrator SQL Injection Joins KEV List

CISA separately added an Arista VeloCloud Orchestrator SQL injection vulnerability, CVE-2026-114625, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. As with other catalog entries, Binding Operational Directive 26-04 obligates Federal Civilian Executive Branch agencies to remediate the flaw on publicly exposed assets that grant total control post-exploitation, and CISA urged all organizations to adopt the same risk-based prioritization for internet-facing systems. (CISA)

CISA, Canadian Cyber Centre Issue AI Token Consumption Guidance

CISA and Canada's Canadian Centre for Cyber Security released joint guidance, Managing AI Token Consumption for Operational Resilience, warning that unmanaged token usage tied to third-party super intelligence services can drive rising costs, reduced availability, degraded performance, and denial-of-tokens or denial-of-wallet attacks. The guidance recommended prioritizing token allocation, designing efficient workflows, improving prompting practices, using caching and reusable context, and monitoring consumption, so critical infrastructure owners could plan for reduced AI service availability during outages or high demand. (CISA)

DHS Names Mona Harrington Assistant Director for Cyber Integration

The Department of Homeland Security named Mona Harrington Assistant Director for Cyber Integration, moving her from her prior post as Assistant Director for Operational Programs and Policies at DHS. Harrington previously served as Assistant Director of the National Risk Management Center at CISA and as CIO and CISO at the Independent Commission USEAC. The appointment was one of several executive moves reported for the week, including Vasu Jakkal joining Kevin Mandia's Armadin as Chief Strategy and Business Officer after serving as corporate vice president of security at Microsoft. (SecurityWeek)