If you do one thing this week, find every system that runs PHP and update it. Two critical PHP flaws, nicknamed PHP2Shell, let an attacker run code on a web server without logging in, and Amazon saw exploitation attempts before the fixes even shipped. NAS devices, firewalls, and appliances bundle PHP too, so this is an inventory job, not one update.
Patch now
| Product | Issue | Action |
|---|---|---|
| PHP (web servers, NAS, appliances) | CVE-2026-109618, CVE-2026-109619: unauthenticated code execution, exploitation attempts seen | Update PHP or apply the vendor’s patched package |
| Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator | Critical and high severity fixes, CVE details due November 10 | Upgrade to the fixed builds below |
| BeyondTrust Remote Support (self-hosted) | CVE-2026-102764: zero-day, exploited, on CISA KEV | Apply BT26-05-RS and review the appliance for compromise |
PHP2Shell (CVE-2026-109618, CVE-2026-109619)
What it is: Two memory-handling flaws in PHP itself, so a site with clean code is still exposed. The Canadian Cyber Centre alert says every PHP install serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php at greatest risk. Amazon Threat Intelligence logged a first attempt on October 17, four days before disclosure, and now sees broad attempts in the wild, though it is unclear whether they succeed.
Who is affected: Anyone running a WordPress or other PHP site on their own server or VPS, plus devices that bundle PHP. Palo Alto lists all PAN-OS and Panorama versions as affected, with risk highest when management is reachable from the internet. Synology lists its DSM PHP packages, Mail Station, and Synology Calendar.
What to do:
- Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or your Linux distribution’s patched package, then restart Apache or PHP-FPM. Updating WordPress does not update PHP.
- PHP 8.1 and older get no project updates. Get a backport from your OS vendor or upgrade.
- Synology: in Package Center, update the PHP packages (for example PHP 8.2 to 8.2.35-0171 or later), Synology Calendar to 3.0.4-21435 or later, and Mail Station, per Synology-SA-26:14. PHP 7.3 will get no fix, so uninstall it if nothing depends on it.
- Palo Alto: the Palo Alto advisory lists PAN-OS hotfix targets of October 26 through 30 by branch, Panorama TBD. Until then, limit management access to trusted internal IPs and enable Threat IDs 543004 and 97622 through 97625 if you have Threat Prevention.
- If you cannot patch, isolate the application from the internet. Start any compromise review from October 17.
Fortinet security hardening release
What it is: On October 21 Fortinet announced critical and high severity fixes found through its AI-assisted testing, with FortiOS, FortiManager, and FortiAnalyzer builds out October 22 and CVE details due November 10. Fortinet warns that patches reveal where the weaknesses are and calls this a priority change, not routine maintenance (Fortinet announcement).
What to do: Back up configurations, then upgrade internet-facing units first to these versions or later:
- FortiOS: 8.0.2, 7.6.8, 7.4.13, or 7.2.14
- FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, or 7.2.13
- FortiMail: 8.0.2, 7.6.7, or 7.4.9. FortiMail 7.2 must move to 7.4 or later
- FortiAuthenticator: 8.0.4 or 6.6.11
Until then, restrict HTTPS and SSH admin access to trusted IPs or disable it on external interfaces, keep FortiManager off the internet, and enforce admin MFA.
BeyondTrust Remote Support (CVE-2026-102764)
What it is: A flaw rated CVSS 9.3 that lets an unauthenticated attacker perform file operations on Remote Support (formerly Bomgar) appliances. Google Threat Intelligence attributes zero-day exploitation since late August to a suspected China-linked group that gained root, dumped stored credentials, and pivoted internally. CISA added it to the KEV catalog on October 16 (SecurityWeek).
What to do: SaaS tenants were patched October 9. Self-hosted 24.3.1 through 26.2.3: apply BT26-05-RS from the /appliance interface. Older versions: upgrade, then patch. Google says to treat any internet-reachable appliance that ran a vulnerable version as potentially compromised until reviewed.
Other items this week
Microsoft 365 token theft leading to payroll fraud
What it means: Huntress tracked an attacker who replayed stolen Microsoft 365 session tokens into mailboxes at 79 organizations between July 14 and September 22. Tokens came from fake sign-in pages relaying the real Microsoft login and MFA prompt, and from device-code phishing, so MFA was already satisfied. The attacker registered rogue Entra devices, swapped MFA methods, hid mail with inbox rules, and in one case sent a payroll-related email to an outside accountant.
What to do:
- For a suspect account, revoke sessions and reset the password, then remove rogue devices and MFA methods.
- Review Entra devices named DESKTOP- plus eight hex characters, and remove authenticators the user does not recognize.
- Look for inbox rules with punctuation-only or very short names, or that move mail to RSS Feeds or Conversation History.
- Require MFA through Conditional Access for all users, all cloud apps, and all client app types, restrict device-code flow, and turn off user consent to new apps. Our cybersecurity services cover this hardening.
SafePay ransomware: joint FBI and CISA advisory
What it means: Advisory AA26-293A, published October 20, says SafePay has hit at least 600 victims since August 2024. Entry points include stolen or guessed passwords, VPN access, and known bugs: CVE-2020-3259 and CVE-2023-20269 (Cisco ASA and FTD), CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication), and CVE-2024-40766 (SonicWall SonicOS). The group has reset NAS devices holding backups to factory settings to block recovery.
What to do: Confirm those five CVEs are patched. Require MFA on VPN and webmail. Keep one backup copy offline or immutable and test a restore, the core of our backup and disaster recovery work. Segment so VPN users cannot reach backup storage.
Exchange Online is turning off EWS
What it means: Microsoft is disabling Exchange Web Services tenant by tenant. Apple Mail on macOS, classic Outlook for Mac, some add-ins, outdated Outlook for Windows, and third-party backup tools can break with repeated password prompts. Admins can turn EWS back on, but only until April 2027 (Microsoft Exchange Team).
What to do: Search Message Center for “EWS will be disabled in your tenant in 7 days” or “EWS has been disabled in your tenant.” If something broke, re-enable it in Baseline security mode in the admin center or with Set-OrganizationConfig -EWSEnabled $true, then get EWS-free versions from each vendor before April 2027. That planning is part of our cloud services.
This week’s checklist
- List every server, VPS, container, NAS, and appliance running PHP, with its patched version or vendor status.
- Confirm every FortiGate, FortiManager, and FortiAnalyzer runs a fixed build with no WAN admin access.
- If you self-host BeyondTrust Remote Support, confirm BT26-05-RS is applied.
- In Entra, review registered devices and MFA methods, and check inbox rules on finance and payroll mailboxes.
- Check Cisco ASA or FTD, Veeam, and SonicWall against the SafePay CVEs, then test one restore from an offline or immutable backup.
- Search Message Center for EWS notices and list apps still using EWS.
This week comes down to knowing what you run and verifying each update landed. For a senior engineer who tracks advisories, rolls out patches, and confirms them, see our managed IT services.
