The Vulnerability Was Never The Hard Part
On Tuesday evening the PHP project warned that two flaws in the language could be used to take full control of a web server. By Wednesday morning, PHP's maintainers were shipping emergency fixes, Cloudflare had pushed web application firewall rules at 03:02 UTC, and government sites across Europe were serving error pages. Censys counts roughly 2.58 million internet-facing hosts and 54.9 million web properties running PHP. Wiz, which discovered the bugs alongside Calif and OpenAI, says nearly 70 percent of websites need a core software update. The CVEs are CVE-2026-109618 and CVE-2026-109619, both rated 9.2, and the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get nothing.
The detail that matters sits in the Wiz research note, and it is not about PHP at all. The flaws had been present for decades. Demonstrating exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models reduced that barrier and turned a long-standing flaw into a working exploit.
Put that beside SOCRadar's finding of seven exposed servers belonging to affiliates of INC and The Gentlemen ransomware, holding 8,257 AI messages across 133 OpenCode sessions, 46 custom INC encryptor builds prepared for six named victims, and more than $23,920 of AI API spending. These are not sophisticated operators. They are criminals renting commercial models by the session. The same capability is doing work that used to require either a research team or a specialist developer.
I spent much of my career telling boards that the asymmetry in security favoured the defender who patched. The bottleneck was attacker skill. That bottleneck has been widened considerably and nobody sent a memo.
The patch is the easy half
Every PHP version released in the last decade is affected by at least one of the two flaws, according to Wiz. Ubuntu shipped updated packages. PHP embeds itself in Drupal, Joomla, Magento and WordPress, and it runs behind hosting providers, CDNs and several million independently managed servers. Wiz compared the situation with Log4Shell, fairly on scale, though not on difficulty. Log4Shell was a single library. This is the runtime language of the web.
Wiz predicted mass exploitation to install web shells, a browser panel that lets an attacker keep control of a site after the patch is applied. That is the trap. Patching on Wednesday closes the front door. It does not remove the person already inside. Organisations that treat the emergency release as the whole response will spend the next quarter finding backdoors.
The certificate story carries the same lesson at smaller scale. eMudhra revoked eight intermediate certificates after a researcher working as Wayne found on 17 October that their P-384 private keys had numerical values smaller than 256, so anyone could recover them by trying at most 256 numbers. One key, for the certificate labelled EM OV TLS CA G3C, had a value of 4. Flüpke published it on GitHub and BleepingComputer verified the match. eMudhra blames a script error in April 2025 that generated a second, weaker set of keys, with a labelling similarity causing the wrong ones to be selected for signing. Mozilla blocked the certificates through OneCRL on 17 October, Chrome blocked six of them the same day, Apple followed on 19 October, and Go shipped 1.27.3 and 1.26.10 under CVE-2026-111943.
Your browsers may already be protected through updates you never scheduled. The devices and applications that keep their own trust stores, or that do not check revocation, are a different matter. Mozilla's Dennis Jackson published an incident tracking page listing affected software and patched versions. Debian and FreeBSD were still listed as pending when I read it. If you run embedded devices, build appliances or internal services pinned to a CA bundle, nobody patched those for you.
Trust in the supply chain is being spent faster than it is earned
TeamUpdraft disclosed unauthorised access to its website over the weekend of 17 and 18 October, and believes the attacker reached the customer database: password hashes, two-factor settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. UpdraftPlus has more than four million downloads. Patchstack estimates around 10 percent of sites using it hold an UpdraftCentral or Migrator key, putting roughly 400,000 websites in the blast radius. Attacks began on 18 October at 15:32 UTC, installing administrator accounts and at least 99 malicious plugins with names designed to look like maintenance tools, such as Site Health Cache.
The detail from Nethemba is the one to put in front of your board. Three of its own WordPress sites were targeted. Two were compromised. All three ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, patched against the June flaw CVE-2026-10795. The attacker broke no server, exploited no configuration error, and signed its commands with a valid private dashboard key. The vendor's initial 1.26.12 and 2.26.12 release was meant to strip UpdraftCentral Cloud keys and a bug stopped it doing so. Patchstack's Oliver Sild says the campaign may be worse than the earlier wp2shell wave.
Zeabur tells the same story from the other side. The developer hosting platform is shutting down after its second breach in two months. The October 14 and 15 intrusion used leaked internal credentials stored in plaintext, no rotation since January 2024, admin tokens with no expiry, and administrative portals exposed to the public internet. Attackers took roughly 3.2 million environment variable records and data on 321,810 accounts, signed in as root on 101 GCP servers, added SSH keys to 50, and attached 16 customer disk copies to their own machines. Zeabur had already been breached in late August and did not rotate all administrator credentials after the first incident. That is not a sophisticated attack either.
Ransomware is doing the same thing it always did, better
The joint advisory from CISA, the FBI, the Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the National Crime Agency and the North West Regional Organised Crime Unit puts SafePay at more than 600 critical infrastructure victims since August 2024, across North and South America, Europe and Australia. SafePay operates without affiliates and runs double extortion, stealing data before encrypting. Initial access comes from exposed credentials, brute force, and VPN access, with the advisory naming Mullvad VPN IP addresses. Once inside, actors delete shadow copies and reset network-attached storage devices holding backups.
The recommendations are the familiar ones: restrict administrative tools, enforce MFA and identity governance, and patch edge devices listed in the known exploited vulnerabilities catalogue. The gap between the advice and the attacks is where CISOs should look. Six known exploited vulnerabilities were added to that catalogue on 20 October alone, and the advisory describes automated scripts hitting internet-exposed edge systems. An organisation that cannot demonstrate that every internet-facing VPN and firewall is patched on a schedule and recorded centrally is one of the 600, statistically speaking.
CISA also published ICS advisories on 19 October for Hitachi Energy's RTU500 and MicroSCADA X SYS600, Moxa's AIG-302 ThingsPro Edge and HMS Networks' PEAK-System PCAN Windows drivers. BRONZE SANDCASTLE, tracked by Sophos between August 2025 and August 2026, places a legitimate Sandboxie executable beside a malicious DLL to load an encrypted backdoor from config.ini, using Java, Krita, NVDA, LINE and Sysinternals as cover. Victims were recorded in the Philippines, Taiwan, Afghanistan and Namibia. The payload stays encrypted on disk and decrypts only in memory, so signature scanning has little to bite on.
Where the losses actually land
Two stories show the shape of downstream cost better than any breach count. A cyber incident at BAE Systems Inc., the US subsidiary of the British defence group, has halted the production and distribution of bankruptcy notices since 9 October. The Administrative Office of the US Courts confirmed it on 15 October. The Bankruptcy Noticing Center sites are offline, the National Creditor Registration Service is unavailable, and individual bankruptcy districts have rewritten notice procedures and adjusted deadlines. No chief information security officer I know has a plan for the day their outage becomes a procedural change in another organisation's legal process.
The other is California. The Department of Education is warning every public school student in the state that assessment contractor Educational Testing Service suffered a months-long breach in which student data was copied through a secure file transfer site from May. The exposed fields include dates of birth, home addresses, disability and Section 504 status, Title I eligibility and English language proficiency results, for students enrolled between 2023 and the current year plus those who left since 2006. More than 5.7 million students were enrolled in 2025. The dataset was built by regulation, held by a testing vendor, and the children have no relationship with the vendor at all.
The 23andMe successor took the same idea to its conclusion. Chrome Holding Company will pay California $6 million over the 2023 breach that exposed data on nearly seven million people, pending approval in the Eastern District of Missouri. The company is in bankruptcy and its assets passed to a nonprofit. Six million dollars. I have watched organisations spend more on a breach response and call it a good outcome.
ClickFix rounds out the picture. Push puts it at 52 percent of its detections through Q2 and 67 percent in August, with four in five ClickFix pages reached from search engines. The newest lure is AI tooling: ANY.RUN linked 1,258 sandbox analyses to fake AI tool campaigns between April and October, and 81 percent impersonated Claude, ChatGPT or Codex. The habit that makes it work is one we taught our own staff. Developers install software with a pasted terminal command, so pasting a command from a web page looks entirely normal.
What to do this week
Patch PHP everywhere it runs and inventory it properly. Your main site is the easy one. Ask for a count of servers, containers and vendor appliances running PHP 5.4 or later, and a named owner for each. Where 8.2.35, 8.3.36, 8.4.27 or 8.5.12 cannot be deployed yet, ensure WAF rules are in place and logging is on.
Then assume a web shell already exists. Hunt for recently modified PHP files, unexpected outbound connections from web servers, and administrative accounts you cannot attribute.
Rotate and reauthenticate everything connected to UpdraftCentral, and treat 18 October onward as hostile for any WordPress estate. Check for plugins installed since then, especially anything named as a health, cache or optimisation tool that nobody approved, and audit administrator accounts created in the last four days.
List every device and application that maintains its own certificate trust store and confirm whether it has dropped the eight eMudhra intermediates. Browser updates covered your staff. They did not cover your appliances.
Ask your network team whether commercial VPN endpoints appear in your authentication logs, on the strength of the Mullvad detail. If nobody can answer in an hour, that is the finding of the week.
Go back to Wiz's sentence about frontier models. If AI has lowered the cost of finding exploitable bugs in code that has shipped for decades, ask every software vendor you depend on what their model-assisted vulnerability research has found in their own codebase, and when. The answer will tell you more about supplier risk than any questionnaire score.
PHP 8.1 and older will never be patched. Whatever runs there is permanently exposed, and the only remedies are replacement or isolation. Make that list this week.