Cybersecurity News — 2026-10-23

Generated: 2026-10-23 | Sources: PHP, Amazon, Cloudflare, Sophos, Rank Math, Wordfence, ConnectWise, Huntress, Microsoft, ManageEngine, Google Threat Intelligence, Mandiant, OVHcloud, LiteLLM, Wiz, Arista, JPCERT/CC, Chrome Root Program, Mozilla, ICO, Rapid7, The Hacker News, BleepingComputer, SecurityWeek, Krebs on Security

1. A Flaw in PHP Itself Put Millions of Websites at Risk, and Patches Are Out

PHP is the language behind most of the world's websites, including WordPress, Magento, Drupal and countless bespoke sites. Two flaws tracked together as PHP2Shell — CVE-2026-109618 and CVE-2026-109619 — let an attacker with no account run code on the server just by sending requests. Emergency patches landed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Censys counts 2.58 million internet-facing PHP hosts. Exploit attempts reached the millions within two days, but as of 23 October no security firm has confirmed a successful break-in, and Sophos suggests attackers are struggling to build a reliable exploit. Amazon saw the first attempt on 17 October, while the flaws were still embargoed.

Why it matters for your business: ask your web host or developer one question — what PHP version are we on, and is it patched? Most small businesses depend on a host to do this, so get the answer in writing rather than assuming. If your site runs PHP 7, 8.0 or 8.1, it is out of support and this is your prompt to move. Patch, then look for unexpected files.

2. A Popular WordPress SEO Plugin Was Serving Backdoored Downloads From Its Own Website

Rank Math is one of the most widely used WordPress SEO plugins. For about eleven hours — between 20:02 UTC on 15 October and 07:12 UTC on 16 October — downloads of the paid version, PRO 3.0.123, from the vendor's own website carried malware that plants hidden backdoors, contacts rank1cdn[.]com and can expose database credentials and API keys. The free version from WordPress.org was unaffected. Rank Math says a limited number of customers received it and fixed the problem in 3.0.124. Crucially, updating or deactivating the plugin does not remove the backdoor: the vendor says the plugin folder and the malicious database entries must be deleted.

Why it matters for your business: if you run Rank Math PRO and it was downloaded in that window, treat the site as compromised. Restore from a clean backup if you have one, or follow the vendor's manual cleanup, then rotate every password, key and salt. Updating alone leaves the attacker's access in place.

3. Attackers Reached 162 Microsoft 365 Accounts Through an IT Provider's Backup Tool

ConnectWise Cloud Backup, formerly SkyKick, backs up Microsoft 365 data for IT providers and their customers. Attackers signed in as the backup application itself using its secret, through an automated script — and because no person logged in, multi-factor authentication never applied. The application's existing broad permissions gave access to mail, OneDrive, SharePoint and Teams data; in some tenants the attacker also granted itself administrator roles. Huntress counted at least 162 affected tenants, and ConnectWise took the service offline on 17 October. How the credentials were stolen, and the full victim count, remain unknown.

Why it matters for your business: if an IT provider manages your Microsoft 365, ask whether they used this product and whether your tenant's sign-in logs were checked. Then ask a standing question: which third-party apps hold permissions in our tenant, and does each still need them? Disabling an app does not cancel tokens already issued.

4. Backup Software Downloaded Malware From Its Maker's Own Update Servers

AOMEI Backupper is Windows backup and disk-cloning software. Researchers at ManageEngine, working with Google and Mandiant, found that attackers had briefly altered configuration files on AOMEI's servers so the software downloaded and ran a malicious archive with no user interaction — and changed the expected checksum so it passed verification. The tampering was live for only about 21 minutes in total, across three windows on 28 May, 16 July and 20 July. Any machine that happened to check for updates in those minutes could have been infected. A fix at the vendor's end stops new infections but does not clean machines already affected.

Why it matters for your business: a vendor saying "resolved" is not the same as your computers being clean. If you use AOMEI Backupper, ask whoever manages your machines to check the published indicators of compromise, looking for unexpected scheduled tasks and remote-access tools such as Radmin installed since May.

5. Two Developer Tools Were Poisoned Through Their Release Channels

On 19 October an attacker with access to a developer's GitHub account modified existing OVHcloud CLI releases — v0.11.0 to v0.15.0 — to steal secrets stored on disk; the tampered files were live for roughly 90 minutes. On 21 October LiteLLM, an AI gateway, had version 1.107.0 published to PyPI and Docker Hub carrying a credential stealer and a component that gave remote access; investigators traced the entry to a leaked GitHub token. That makes four incidents this week, with Rank Math and AOMEI above, where the attack arrived not through a flaw in the software but through the trusted channel used to deliver it.

Why it matters for your business: if anyone builds or maintains software for you, ask them to pin exact dependency versions rather than taking whatever is newest, and to treat any machine that ran an affected release as compromised. Secrets on that machine have to be rotated, not just the tool updated.

6. A Network Management Flaw Being Exploited Turns a Basic Login Into Full Control

Arista's VeloCloud Orchestrator manages SD-WAN networks — the equipment linking branch offices and sites. CVE-2026-114625 is a SQL injection flaw letting any authenticated user with basic privileges and access to the web interface escalate to superuser, with no user interaction and little skill required. Arista says it has been exploited in attacks and has published two attacker IP addresses to block; fixes are in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later. It is the fourth actively exploited flaw in this product during 2026, following others in May, July and September.

Why it matters for your business: you are unlikely to run this yourself, but if your network is managed for you, ask whether VeloCloud is involved and whether it is patched. One product needing four emergency fixes in a year is also a fair prompt to ask your provider what their plan is when that keeps happening.

7. The Firewall Protecting Websites Was Itself Being Broken Into

A web application firewall is a product bought to filter malicious traffic before it reaches your website. CVE-2026-106931 is a command-injection flaw in the statistics feature of SiteGuard Server Edition — switched on by default — that lets an attacker run commands as root or SYSTEM on the machine. Japan's JPCERT/CC says it is being exploited in the wild and the vendor confirms abuse, though the scale is unknown. Note what else was attacked this week: a network orchestrator, a backup tool, a certificate authority. Protective products sit directly in the traffic path, which makes them targets rather than refuges.

Why it matters for your business: patch to 8.00 Update 5, or 7.00 Update 6 on FreeBSD. Before you do, download the diagnostic information from the management interface — the vendor warns that applying the fix can erase the evidence of whether you were attacked, and that evidence is the only way to answer the question later.

8. Guessable Certificate Keys Mean About 30,000 Websites Must Replace Their Certificates by 27 October

Certificate authorities issue the certificates that make the padlock in a browser work. On 17 October a researcher reported that eight of eMudhra's intermediate certificate authority private keys were numbers below 256 — recoverable almost instantly, where they should have been astronomically large random values. Chrome and Firefox blocked the affected intermediates within hours; Mozilla removed trust in the emSign ECC Root CA - G3 on 20 October, and Chrome does the same on the morning of 27 October. Around 30,000 unexpired certificates chain to that root. On 22 October eMudhra's board decided to exit the global SSL/TLS business.

Why it matters for your business: if your certificate chains to that root, visitors will meet a full-page security warning from 27 October. Check who issued your certificate — most small businesses use Let's Encrypt or their host and are unaffected. If it is eMudhra, replace it now with another authority: automatic renewal may not act before the deadline.

9. A Test Account From 2012 With the Password 'Password1' Led to a Ransomware Attack and an ICO Reprimand

The ICO reprimanded Ogi Networks and Data Cymru on 20 October over a ransomware attack that encrypted 182.7GB of data and took the personal information of 3,300 people, most of them children. The way in was a test account called 'Test2', created in January 2012 without any password-strength rule applied and never audited, protected by the password 'Password1' — rated very weak and crackable in under a second. It had been live for more than twelve years. Local administrator accounts on three affected systems had also shared one unchanged password for over twelve years, which let the attacker move between them.

Why it matters for your business: two jobs, both free. Get a list of every account on your systems and delete the ones nobody can account for — dormant test and former-staff accounts are among the most reliable ways in. Then make sure administrator passwords differ from machine to machine, so one break-in does not open the rest.

10. Chrome Now Warns When a Web Page Talks You Into Running a Command

ClickFix has become one of the most common ways malware reaches a business: a web page claims something needs fixing, shows you a command to copy, and asks you to paste it into Windows. Because you run it yourself through the terminal, nothing is downloaded and the browser's protections never engage. Google has now added detection — for Enhanced Protection users, Chrome watches for a suspicious command being copied and warns if Safe Browsing rates it dangerous. It has also added a lower-confidence "suspicious site" warning alongside the existing red page, and a prompt before connecting to any unencrypted HTTP site.

Why it matters for your business: give staff one rule, because it defeats the whole technique. No legitimate website, IT provider or error message ever asks you to copy a command and paste it into a Windows box. If a page does, close it and tell someone. Switching on Chrome's Enhanced Protection takes a minute.

11. Serious Flaws Are Now Being Exploited About Three Days After They Are Announced

Rapid7's quarterly report puts a number on how fast patching has to be. Across the high-severity flaws it tracked in the third quarter, exploitation began on average about three days after disclosure, and 71% were exploited within the first seven days. Seventy-nine percent were what it calls "holy grail" flaws: exploitable remotely, needing no credentials and no action from a user. Ransomware remained the dominant threat, with business services, manufacturing and healthcare the most targeted sectors. AI appeared as an operational component in only 8% of incidents; humans still chose every target.

Why it matters for your business: a monthly patching cycle is now slower than the people attacking you. Switch on automatic updates everywhere they exist, and agree with whoever manages your systems what counts as an emergency — a remotely exploitable flaw in something facing the internet should be fixed in days, not at the next convenient window.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News