PHP2Shell Patch Alert, ConnectWise Breach, and eMudhra CA Key Flaw Lead This Week

Security leaders need to move fast on two fronts today: CISA's urgent call to patch the critical PHP2Shell remote-code-execution flaws, and the fallout from ConnectWise's Cloud Backup credential compromise that let attackers reach Microsoft 365 tenants across managed service providers. Rounding out the week are a joint SafePay ransomware advisory, six new CISA KEV Catalog entries, continued exploitation of a Palo Alto GlobalProtect flaw, a critical weakness in eMudhra's certificate authority signing keys, and a new CISO at Hertz.

ConnectWise Suspends Cloud Backup After Microsoft 365 Credential Abuse

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after attackers used a compromised credential belonging to the Cloud Backup application (formerly SkyKick) to access customers' Microsoft 365 accounts through its application identity. Huntress confirmed unauthorized access tied to a hosting-provider IP address active between 06:13 and 08:34 UTC on October 15. ConnectWise disabled seven application identities and revoked certificates on October 17, but warns that previously issued access tokens may remain usable and that each affected organization must independently find and remove any access attackers created. Microsoft has described the incident as a supply chain attack. (Help Net Security)

CISA Urges Immediate Patching of Critical PHP2Shell Vulnerabilities

CISA issued an alert urging organizations to immediately patch CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities nicknamed "php2shell" that permit unauthenticated remote code execution across any PHP installation serving web requests. The agency recommends updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and advises taking systems offline if they cannot be patched, particularly those still running PHP 8.1 or earlier unsupported versions. CISA says it has not observed active exploitation as of publication but warns the flaws pose significant risk, and urges organizations to inventory PHP installations since the software is often an embedded, hard-to-spot component. (CISA)

CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, covering four Plex Media Server bugs, an OS command injection flaw in EG Secure Solutions SiteGuard Server Edition, and an uncontrolled search path vulnerability in Siemens Software Center. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed flaws on internet-exposed assets that grant total control post-exploitation. CISA encourages all organizations, not only federal agencies, to adopt risk-based vulnerability management and remediate these catalog entries promptly. (CISA)

CISA, FBI Warn of SafePay Ransomware Hitting 600+ Victims

CISA, the FBI, U.S. Secret Service, and international partners released a joint advisory on SafePay ransomware, describing it as one of the most active ransomware groups in 2026, with roughly 600 victims across the Americas, Europe, and Australia. SafePay actors compromise credentials and exploit known vulnerabilities in internet-facing devices, often through VPN services, then use legitimate IT tools to move laterally, disable or delete backups, steal data, and encrypt systems. The advisory urges organizations to patch known exploited vulnerabilities, require multifactor authentication, maintain tested offline backups, and segment networks to limit impact. (CISA)

eMudhra CA Signing Keys Found Trivially Guessable, Then Revoked

Indian certificate authority eMudhra had eight intermediate certificates secured with private keys so weak that researchers recovered them from the public certificates in under a second, a flaw that could let attackers forge HTTPS certificates for any domain. The weakness traces to a faulty script used during an April 2025 key ceremony that generated a second, weaker set of keys that staff mistakenly selected. Chrome and Firefox blocked the certificates the day the issue was reported, Apple and Microsoft followed within two days, and eMudhra revoked them on October 18, estimating about 30,000 customer certificates need replacement. (Help Net Security)

Ransomware Gangs Exploiting Palo Alto GlobalProtect Flaw Since June

Multiple ransomware groups, including Qilin and Inc, have been exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks' PAN-OS GlobalProtect patched in May, to breach organizations across healthcare, education, government, and energy. The flaw lets unauthenticated attackers bypass multifactor authentication and establish unauthorized VPN connections; Unit 42 has investigated related intrusions since early June. In one case, attackers moved from a compromised VPN gateway to vCenter, disabled ESXi hypervisor security controls, and extracted domain-wide credentials offline. ReliaQuest cautions that patching alone may not remove access already established before remediation. (Help Net Security)

Hertz Appoints John Koester as Chief Information Security Officer

Hertz has named John Koester as Senior Vice President and Chief Information Security Officer. Koester previously served two years as Vice President and CISO at Graphic Packaging International, and before that spent more than eight years at HD Supply in cybersecurity leadership roles including Vice President and CISO. Earlier in his career he served as Director of Security Operations at Viewpost. In a LinkedIn announcement, Koester said he looks forward to building on Hertz's existing cybersecurity foundation and helping shape the company's security future. (National CIO Review)