WEEK OF OCTOBER 26, 2026

The week's defining event: PHP2Shell — two unauthenticated RCE flaws affecting every web-serving PHP installation — forced emergency patches a day ahead of schedule after details leaked, under a CISA alert telling organizations to patch immediately or take PHP offline. Amazon logged exploit attempts four days before disclosure and Cloudflare watched attackers adapt payloads in real time, though no successful intrusion is yet confirmed and the flaws are not in KEV. Around it: the Plex2Shell chain is actively exploited to plant miners and proxy backdoors and drew a federal patch order; Qilin and INC ransomware are exploiting last week's PAN-OS flaw to bypass MFA; Arista patched a VeloCloud Orchestrator zero-day under exploitation; and BeyondTrust Remote Support drew its own dedicated CISA alert. Eight KEV additions, all current. Breadth and emergency posture exceed last week's targeted peak — rising. Confidence is high.

Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, which used the ARTEX agentic AI framework to turn stolen app credentials into sign-in attempts at more than 2,250 Microsoft 365 tenants — reaching privileged access in under three hours in some, with MFA bypassed by the stolen application credential. Separately, eight eMudhra intermediate CA keys proved computable from their public certificates after a flawed 2025 key ceremony; browsers and Go shipped emergency distrusts within days, and the operator reports no misissuance and no evidence of exploitation. LiteLLM's release pipeline was hacked to ship a credential stealer, Railway urged secret rotation after a potential breach, OVHcloud CLI releases were hijacked, and GhostAction planted stealers in 94 repositories. Every item sits in one source class, so the two-source rule holds the signal steady — a government advisory on any of these would raise it. Confidence is medium.

Two independent source classes support the raise: joint advisory AA26-293A documents the SafePay ransomware operation, and GMO Internet confirmed attackers installed malware on up to 26,739 Onamae Desktop Cloud customer servers, forcing an all-plan shutdown — the second Japanese cloud provider compromised in three weeks, with OANDA Japan delaying customer withdrawals as a knock-on. Capcom disclosed a breach of 11.7 million account records discovered October 19 — in-window, though limited to emails and account metadata, with attacker password changes on 196 accounts. APT28's two-month intrusion at a NATO naval shipbuilder (July entry, newly reported by Symantec) is held as disclosure-lag. Against the rise: INTERPOL's African crackdown arrested 1,462 suspects and disrupted nearly 11,000 cybercrime networks. Confidence is medium.