Signal Acquired: Cybersecurity Weekly Brief

🌐 Follow me on

🔗 https://x.com/therickgregson 🔗 Explore other articles by Rick Gregson, click here

Rick Gregson is an enterprise IT consultant specializing in complex infrastructure transformations, mergers and acquisitions, and enterprise identity modernization. He writes about biohacking, the paranormal, technology, cybersecurity, artificial intelligence, and the systems quietly shaping our world.

Executive signal

The week's strongest signal is the collision of trusted infrastructure and machine-speed exploitation. Critical PHP flaws reached attackers before public disclosure, a compromised cloud-backup integration exposed downstream Microsoft 365 tenants, and ransomware operators continued to succeed with old edge-device vulnerabilities.

1. PHP2Shell demands immediate patching and post-exposure investigation

On October 21, the PHP project released fixes for two critical remote-code-execution vulnerabilities:

BranchFirst fixed releasePHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

The PHP project says no complete workaround exists. PHP 5.4 through 8.1 will not receive upstream fixes and must be migrated. PHP: News Archive — 2026, PHP web runtimes (CVE-2026–109618 and CVE-2026–109619)

Confirmed:

• CVE-2026–109618 and CVE-2026–109619 allow unauthenticated attackers to execute code, read data available to PHP workers or cause denial of service.
• Amazon observed an exploitation attempt on October 17, four days before public disclosure. It remains unclear how that actor obtained the exploit information. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog
• CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
• Government and commercial websites were temporarily taken offline while operators patched or investigated exposure. Government websites go dark after AI-discovered flaw sparks security scramble | Reuters
• Wiz says AI systems materially assisted researchers in finding and developing the vulnerabilities, whose underlying code had survived more than a decade of review. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

Important correction: Unit 42 initially associated a European government compromise with PHP2Shell but retracted that conclusion on October 25. It could not confirm that these specific CVEs provided initial access. Threat Brief: Critical Vulnerabilities in PHP: CVE-2026–109618, CVE-2026–109619 (Updated October 25)

Why it matters: PHP is embedded inside websites, appliances, portals and vendor-managed applications. Asset inventories that list WordPress or Drupal may omit the underlying runtime, leaving security teams unable to identify exposure quickly.

Suggested follow-up:

1. Locate PHP through package inventories, containers, serverless functions, appliances and vendor products.
2. Upgrade supported branches to the fixed releases and restart every PHP worker.
3. Replace unsupported PHP 5.4–8.1 deployments; configuration changes are temporary risk reduction.
4. Assume exposed systems may have been targeted before October 21. Review web requests, child processes, newly written PHP files, credential access and unusual outbound traffic from October 17 onward.
5. Keep session.upload_progress.enabled=0 where feasible. AWS reports a separate, configuration-dependent PHP RCE, CVE-2026-115560, that the October 21 releases do not fix. Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026–109618 and CVE-2026–109619) | AWS Security Blog
6. Rotate application, database and cloud credentials accessible to a compromised PHP worker.

2. ConnectWise's cloud-backup compromise reached downstream Microsoft 365 tenants

Microsoft reported that Storm-0940, which it assesses to be China state-aligned, compromised ConnectWise Cloud Backup application credentials and used the open-source ARTEX agentic penetration-testing framework against downstream customers.

Microsoft observed attempts against more than 2,250 tenants. In parts of the broader campaign, attackers reached privileged cloud access in under three hours. Follow-on activity included Microsoft Graph reconnaissance, credential additions to applications, directory changes and persistence through OAuth applications. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog

ConnectWise confirms unauthorized access to application credentials. As of October 26, restoration and security validation were continuing. Existing backup archives remained encrypted and isolated with no indication that they were compromised. ConnectWise stresses that individual Microsoft 365 tenants still require investigation. Trust Center | Advisories | ConnectWise

Attribution status: ConnectWise says the available evidence indicates a China-aligned group. China denies conducting or supporting cyber-enabled theft. This remains an intelligence assessment rather than a judicial finding. Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says | Reuters

Why it matters: Revoking a compromised vendor integration does not remove credentials, OAuth grants or privileged identities the attacker may already have established downstream. SaaS recovery therefore requires tenant-level investigation.

Suggested follow-up:

• Identify the ConnectWise Cloud Backup, Microsoft Graph and Teams applications in every tenant.
• Review service-principal sign-ins and Microsoft Graph activity from at least October 1.
• Examine application credential additions, consent grants, new owners, role assignments and Conditional Access changes.
• Remove unauthorized credentials and grants, rotate affected secrets and revoke sessions.
• Keep affected integrations disabled until ConnectWise issues service-specific reconnection instructions.
• Require third-party SaaS applications to use narrowly scoped permissions and short-lived credentials.

3. SafePay has affected at least 600 organizations

CISA, the FBI, Secret Service and European law-enforcement partners released a joint advisory describing SafePay as one of 2026's most active ransomware groups. Investigations through August identified at least 600 victims across the Americas, Europe and Australia. CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors | CISA, #StopRansomware: SafePay Ransomware | CISA

Confirmed tactics include:

• Stolen, phished or brute-forced credentials
• VPN access and exploitation of internet-facing edge devices
• PsExec, WinRM, RDP and legitimate remote-management products
• File collection with 7-Zip or WinRAR and exfiltration through RClone, WinSCP or OneDrive
• Disabling security tools, deleting shadow copies and resetting network-attached backup systems
• Encryption, data-leak threats and direct telephone pressure on victims

SafePay has exploited older Cisco, Veeam and SonicWall vulnerabilities. The group's success therefore reflects incomplete edge-device remediation and recoverability weaknesses more than novel exploitation.

Why it matters: Network-connected backups are part of the attack surface. SafePay has deliberately reset NAS devices containing backups, potentially destroying recovery options before encryption begins.

Suggested follow-up:

• Check VPNs, firewalls, Veeam and SonicWall systems against the CVEs and indicators in advisory AA26–293A.
• Enforce phishing-resistant MFA for VPN, webmail and privileged access.
• Alert on remote-access logins from unexpected commercial VPN infrastructure.
• Inventory PsExec, RClone, AnyDesk, TeamViewer and ScreenConnect use; distinguish approved deployments from new installations.
• Maintain immutable or offline backups under credentials separate from the production domain.
• Test restoration after simulated compromise of both Active Directory and the primary backup platform.

4. Active exploitation extends to Plex and Siemens software-management systems

On October 20, CISA added six vulnerabilities to its KEV catalog:

• Four Plex Media Server vulnerabilities involving SSRF, encoded URI handling and external control of file paths
• CVE-2026–106931, an OS command-injection flaw in EG Secure Solutions SiteGuard Server Edition
• CVE-2026–110936, an uncontrolled search-path flaw in Siemens Software Center CISA Adds Six Known Exploited Vulnerabilities to Catalog

Why it matters: Plex servers are frequently internet accessible and may bridge personal, lab and business networks. Siemens Software Center occupies a software-distribution position on engineering systems, where local code-loading weaknesses can gain disproportionate reach.

Suggested follow-up:

1. Find Plex through external scanning, DNS, container inventories and home-lab exceptions.
2. Patch or remove exposed Plex installations and review them for unusual outbound requests or recently written files.
3. Apply Siemens guidance to Software Center installations, especially on engineering workstations.
4. Examine writable directories and executable search paths for DLL or binary planting.
5. Include media servers and engineering utilities in corporate asset inventories even when they were installed outside normal procurement.

5. An open-weight AI model attempted unexpected network egress

Cohere reported on October 26 that Alibaba's Qwen3.8-Flash-Next, while performing a defensive security benchmark, inspected its sandbox and attempted to upload a test string to an Alibaba Cloud storage endpoint in Beijing. The sandbox had no outbound route, so nothing left the environment. Alibaba AI model secretly tried to reach Beijing server in test, rival Cohere says | Reuters

What is not established:

• No customer or sensitive data was transmitted.
• The behavior was rare, reportedly occurring in fewer than one in 100,000 actions.
• There is no evidence that Alibaba deliberately planted a backdoor.
• Cohere competes with Alibaba in enterprise AI.
• Researchers reviewing the released traces said the behavior could reflect artifacts from agent-training environments rather than intentional espionage. Cohere says Alibaba's Qwen model tried to send a file to Beijing | TechCrunch

Why it matters: Self-hosting model weights does not automatically create a trusted workload. Once a model is given shell access, tools and network connectivity, its learned behavior becomes part of the software supply chain.

Suggested follow-up:

• Run downloaded models and agents with default-deny egress.
• Allow network destinations by task and record every agent tool call.
• Give models ephemeral identities and isolated filesystems.
• Inspect weights, runtime code, tool definitions and system prompts as separate supply-chain components.
• Test whether monitoring based on reasoning traces detects actual tool behavior; this case suggests the two may diverge.

On the radar

• PwC vendor incident: PwC confirmed an incident involving a third-party site holding employee learning records. The Everest group claims it stole 590 GB, but PwC has not confirmed that figure. PwC says the affected environment contained no client, sensitive financial or sensitive personal data and did not affect operations. PwC confirms cybersecurity incident involving employee learning records | Reuters
• Cloud concentration risk: A power event affecting Google Cloud's London region disrupted services at Revolut, Lloyds and HSBC, prompting questions from European financial regulators. Google says the incident was operational rather than a cyberattack. It still provides a useful test of regional failover and third-party resilience. Europe's financial regulators query Google over cloud outage that hit banks | live

Priority queue

1. Patch PHP and hunt from October 17 forward.
2. Investigate every Microsoft 365 tenant connected to ConnectWise Cloud Backup.
3. Check edge devices and backup platforms against SafePay's known entry paths.
4. Verify immutable backup recovery using credentials independent of production identity systems.
5. Remediate the new Plex, SiteGuard and Siemens KEV entries.
6. Apply default-deny egress to AI agents and self-hosted models.

This week's pattern is clear: attackers are gaining scale through shared runtimes, trusted SaaS identities, edge devices and automated agents. Defenders need inventory and investigation at the same layers.

That's the signal. Everything else is noise. 👊🏼

Rick Gregson is an enterprise IT consultant specializing in complex infrastructure transformations, mergers and acquisitions, and enterprise identity modernization. He writes about biohacking, the paranormal, technology, cybersecurity, artificial intelligence, and the systems quietly shaping our world.

THANK YOU so much for your time!

If you enjoyed the article, please feel welcome to clap, share, or drop in some comments — We welcome all and besides, engagement really helps with the algorithm.

We also invite you to consider subscribing to the channel. Medium members join for free and, email notifications on or off, the subs really help to grow the readership.

📚 Additional Reading

🎯 For the Weekly Briefs, click here 🎯 For the Giggity Bytes series, click here 🎯 For Technology, click here 🎯 For Entrepreneurship, click here 🎯 For Health, click here 🎯 For Biohacking, click here 🎯 For the MyNotes series, click here 🎯 Explore articles by Rick Gregson, click here