Weekly Cyber Update: 23 October 2026

The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indicators, curated by our CISO, Nick Harris. Here’s our pick of the top stories, and why you should care

PHP2Shell – why some teams did well

Let’s not dwell on a story that has dominated headlines over the past two days. What happened, which organisations were impacted, the fix, and the threat hunting required are all well documented.

It’s worth a quick look at the AI angle, though. The bugs were not new. Wiz says the flaws had existed for decades, but proving they could be exploited demonstrated how frontier AI models lowered that barrier. The research came from Calif, Wiz and OpenAI via the “Patch the Planet” initiative. As we’ve regularly reported, the lesson is that the CVE list is getting big, but the KEVs aren’t growing. Here we have an AI-discovered vulnerability, on a huge spread of public-facing assets, leaked with poor OPSEC and of a simplicity that means an exploit can be rapidly built and deployed.

It’s now time to really look at this risk. From what I have seen and imagine, the organisations that came through this well tended to have:

• An accurate inventory (SBOM). Those with an up-to-date inventory knew where to find it, knew their supply chain and switched off only what was needed. Those without spent a lot of time just discovering the scale of the problem and very likely pulled the plug on more than what was needed
• Third-party assurance. Hosting providers, agencies and SaaS vendors running PHP on a client’s behalf needed to be asked, and to answer, whether they had patched. Good customers already knew their suppliers’ inventory and version levels
• Supported versions already in place. This goes for anything, but in the PHP case only versions 7.4 to 8.1 receive source backports, and v5.4 to 7.3 get no fix at all. Anyone on legacy PHP has no simple patch to apply. Those who kept their tech stack up to date were many steps ahead already
• A patch process that works out of hours and out of cycle. PHP published advance notice on 20 October, so prepared teams were staged and waiting rather than starting from scratch. Whatever the issue, having a fast process to take a published patch and rapidly deploy it allows for some speed after the stagnant phase of waiting for the vendor to release it
• An understanding of proactive shutdown. Those who knew what the effect of a proactive shutdown would mean, could make the decision quickly
• Delegated decision-making. Where the decision was delegated rather than held up high, effective organisations who couldn’t immediately patch were able to take fast and decisive action
• Compensating controls. In this case it was a web application firewall (WAF) or CDN, but compensating controls need considering for all risks. Specifically for this example, we saw that Cloudflare deployed rules for known exploit vectors to all customers including those on the free tier, while describing them as a stopgap only. Microsoft also announced WAF rule changes
• Alternative ways of working. Not everyone has an alternative to being online, but those who could switch to manual processes could keep operations going
• Good logs. Without the logs, threat hunting for the IOCs couldn’t be done
• Threat intel. PHP2Shell was all over BBC news, so the information was a fire hose. For quieter incidents with a smaller impact and less coverage, good organisations are well connected to discovered flaws, related to their tech stack.

Three doors into the same house: supply chain security is the theme of the week (again)

Three of this week’s stories look unrelated: a flaw in PHP, a compromise of ConnectWise Cloud Backup, and an ICO reprimand for two Welsh organisations. Each is a different type of supplier risk, and none of the affected organisations caused the weakness themselves.

PHP2Shell: As covered above, the flaw sat in PHP which is present in many web apps, most of which are WordPress. Businesses with secure code of their own were still exposed because of what that code runs on.

The apps you have trusted: Microsoft assesses that Storm-0940, a China-state aligned actor, was responsible for the ConnectWise compromise of a multi-tenant application. The attackers took control of identities belonging to several ConnectWise cloud applications and used the stolen credentials to authenticate into customer environments. The lesson is that a backup tool with broad permissions is a privileged identity in its own right.

The people who run your IT: A ransomware attack on 1 November 2024 encrypted 182.7GB and took 42GB from Data Cymru’s systems, exposing data on 3,300 people, mostly children. Its IT provider, Ogi Networks, had created a “Test2” account in January 2012 with the password “Password1”. We put a lot of trust in third parties and need to do the due diligence on their practices.

In each case, trust was extended once and never revisited: a runtime nobody inventoried, an app permission nobody reviewed, an account nobody owned. Even the most secure of organisations still has weak spots.

EU opens fraud probe into Booking.com

The European Commission has opened a Digital Services Act investigation into whether Booking.com does enough to stop scams, phishing and smishing on its platform. One commission official reportedly described the platform’s fraud defences as “absolutely substandard”.

The probe has three strands: fraudulent listings by people posing as property owners, failure to counter phishing, smishing and social engineering, and advertising transparency. The commission also suspects consumer and business user data is not sufficiently protected.

The scams work by criminals taking over a property owner’s account and contact details, then messaging guests asking for additional payments. To the guest, the request arrives through a channel they already trust, from a booking they genuinely made. The other tactic is to send a WhatsApp message to a customer with convincing booking details asking for the final payment for the holiday – obviously to a fake account.

Officials cited Booking.com’s own June 2024 admission of a 500 to 900% rise in travel scams over 18 months. In the Netherlands alone, more than 1,000 fraud notifications in early 2026 caused €82,000 (£69,000) of damage, a tenfold annual increase.