Compiled on October 24, 2026 from the sources listed at the end. Items marked “reported” or “claimed” come from a single outlet or from attacker claims. Details may change.

---

The week in one paragraph

Two critical flaws in PHP, nicknamed PHP2Shell, dominated the week. They forced some Canadian government and Quebec websites offline as a precaution, drew exploitation attempts within days, and ended the week with a third PHP flaw confirmed. Meanwhile, attackers kept hitting firewalls, VPNs, and management tools, another AI software package was compromised, and memory prices kept pointing up.

---

1. PHP2Shell: the story of the week

Timeline

– October 17: Amazon’s threat intelligence team records the first exploitation attempt, four days before fixes exist.

– October 20: Details and exploit code leak ahead of the planned release, so PHP moves its patch release up by one day.

– October 21: PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA, the FBI, the UK’s NCSC, and CERT-EU urge immediate action. The Canadian Centre for Cyber Security issues alert AL26-026. Some Government of Canada websites go offline as a precaution, along with Quebec’s STM, SAQ, and SAAQ services.

– October 22: Exploitation is reported in the wild by watchTowr and Cloudflare, and CISA says it had not observed exploitation at the time of its alert.

– October 23: SecurityWeek reports Mirai-style botnet operators adding the flaws to their toolkit, and a security firm shows an exploit that gets past ASLR in a recommended production configuration. PHP confirms a third remote code execution flaw, CVE-2026-115560, in the session upload progress feature. The October 21 patches do not fix it. As of the morning of October 23, neither original CVE was in CISA’s exploited-vulnerabilities catalog.

How serious is it? Public exploits fail against default PHP configurations, and attackers need detailed knowledge of a server, according to researchers. Beazley Security Labs says it knows of no confirmed mass exploitation. But attempts are widespread, and exploits are improving. Roughly 70% of websites use PHP, according to W3Techs figures cited in Canadian coverage, and one vendor’s data cited by SecurityWeek suggests about 71% of PHP instances run versions past end of life that won’t get patches.

What to do

1. Update to a fixed PHP version, or plan an upgrade if you’re on 8.1 or older.

2. Apply PHP’s temporary mitigation for CVE-2026-115560 and watch for its next release.

3. Check third-party software that embeds PHP, including CMS platforms, e-commerce, and network appliances.

4. Hunt for web servers spawning shells and for new PHP files in web roots since October 17.

5. Use a web application firewall as a stopgap only.

---

2. Exploited firewalls, VPNs, and management tools

– Palo Alto Networks PAN-OS: Unit 42 and other reports say the Qilin and INC ransomware groups are exploiting CVE-2026-0257, a GlobalProtect authentication bypass, and Cybersecurity Dive reports more groups joining.

– Arista VeloCloud Orchestrator: a SQL injection zero-day exploited in attacks, disclosed October 22.

– Ivanti Connect Secure: CVE-2026-104935, an exploited authentication bypass, with a patch available since October 13.

– BeyondTrust Remote Support: CVE-2026-102764, an authentication bypass that Check Point reports a China-linked group exploited before disclosure.

– GitLab: a critical fix for self-managed servers released October 21 (CVE-2026-97229 per Check Point’s report).

– Atlassian Data Center: CVE-2026-21589 exploited, listed by CISA on October 15.

– Siemens Software Center: CVE-2026-110936 exploited in ClickFix attacks, fixed in version 4.0.9.8.

– Oracle: the October quarterly update fixes more than 1,200 vulnerabilities.

Pattern: attackers target internet-facing devices and administration tools first, often within hours or days of details becoming public. Rapid7’s Q3 analysis found that high-severity flaws were exploited within three days on average.

Action: keep an inventory of internet-facing devices, patch them within days, and require MFA on every remote access path.

---

3. Software supply chain

– LiteLLM: The Hacker News reported on October 21 that LiteLLM’s release pipeline was compromised again, with a malicious release pushed to PyPI and Docker Hub, and SecurityWeek reported a fresh compromise on October 23.

– Node.js “Node2Shell”: Imperva demonstrated code execution on an official Node.js 24.22.0 Linux arm64 image through crafted Brotli data (CVE-2026-111497). Fixes shipped October 21.

Action: pin versions, verify releases, and avoid auto-installing brand-new versions of critical packages.

---

4. Breaches and ransomware

– Capcom: about 11 million people impacted, per SecurityWeek.

– PwC (claimed): the Everest group claims about 590 GB of stolen data. The claim is unverified and PwC has not yet responded, according to reports.

– SafePay (reported): a daily digest of security reporting says the FBI and CISA warned that SafePay has hit more than 600 organizations since 2024, using stolen credentials and VPN access.

– Other reported incidents: CenterPoint Energy (more than 1 million Texas residents), Burger King Japan (about 11.18 million app members), and a data exposure involving California student records.

– Sandworm: a Russia-linked group used a new mesh-network backdoor in a destructive attack on a Ukrainian logistics company, per The Hacker News.

Action: test a restore from offline or immutable backups, and confirm MFA is enforced on VPN, email, and admin accounts.

---

5. Hardware, cloud, and AI

– Memory prices keep climbing. TrendForce’s October 20 outlook projects DRAM prices rising about 20% quarter over quarter in the fourth quarter, with gains slowing from earlier in the year. An earlier early-October TrendForce forecast put conventional DRAM at 10% to 15% and NAND flash at 15% to 20%. AI server demand and tight supply support prices. *Action:* get written quotes for planned purchases and ask about price-hold dates.

– AI chip competition. Amazon (TorchNeuron, October 19) and Google (TorchTPU, October 20) released tools that let PyTorch apps run on their own chips with little rewriting, aiming at Nvidia’s software advantage.

– OpenAI on Google Cloud. OpenAI and Google Cloud announced plans to offer OpenAI models and Codex through Google Cloud’s Model Garden, with general availability expected in the coming weeks.

– Microsoft and UK AI data centres. The Financial Times, via FTI Consulting, reports Microsoft cancelled a lease with Nscale after grid delays left the Essex site unpowered this year.

– AI-spending jitters (reported). Chip and cloud shares fell on October 22 after Meta’s results renewed doubts about AI spending, according to financial coverage.

– Anthropic’s “Claude Duet” research preview launched October 21 for a waitlist of U.S. Pro and Max subscribers.

– AI and jobs (reported). A news summary citing a Reuters factbox says 31 companies have announced about 102,800 AI-linked job cuts since October 2025.

---

6. Canada

– Some Government of Canada websites went offline on October 21 and were being restored as patches were applied, according to news reports. The government said there was no indication its systems were compromised.

– The Cyber Centre updated alert AL26-026 on October 23 to cover the third PHP flaw.

– Quebec organizations including the STM, SAQ, and SAAQ interrupted online services as a precaution.

– October is Cyber Security Awareness Month, a good hook for staff reminders.

---

What to watch next week

– Whether CISA adds the PHP flaws to its exploited-vulnerabilities catalog

– PHP’s next regular release and the full advisory on CVE-2026-115560

– More vendor advisories for products that embed PHP

– TrendForce and PC-maker price updates

– Microsoft’s next Patch Tuesday, on November 10

---

This week’s checklist

– [ ] Update PHP and apply the CVE-2026-115560 mitigation

– [ ] Inventory internet-facing devices, and patch PAN-OS, Ivanti, BeyondTrust, Arista, GitLab, and Atlassian

– [ ] Enforce MFA on VPN, email, and admin accounts

– [ ] Test a restore from an immutable backup

– [ ] Pin and verify AI and developer package versions

– [ ] Get written quotes for upcoming hardware purchases

DBR Soft can run a PHP and edge-device exposure check for your business. Contact us for help.

---

Sources

– Canadian Centre for Cyber Security, AL26-026 (Update 1): https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619

– CISA, critical PHP vulnerabilities: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

– SecurityWeek, Mirai botnet operators join PHP2Shell attacks: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/amp/

– SecurityWeek, PHP2Shell mass exploitation looms: https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/

– BleepingComputer, PHP emergency patches: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/

– Help Net Security, PHP2Shell patched: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/

– watchTowr, PHP2Shell: https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/

– Beazley Security Labs advisory: https://labs.beazley.security/advisories/BSL-A1233

– SOCRadar, PHP2Shell: https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/

– Tenable, PHP2Shell FAQ: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

– Qualys, PHP2Shell: https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities

– CTV News: https://www.ctvnews.ca/canada/article/canadian-apps-and-government-websites-go-offline-to-ward-off-online-danger/

– Global News: https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/

– The Globe and Mail: https://www.theglobeandmail.com/business/article-canada-cybersecurity-php-programming-vulnerability-october-21/

– Now Toronto: https://nowtoronto.com/news/canadian-websites-shut-down-php-cybersecurity-threat/

– BetaKit: https://betakit.com/canadian-government-shuts-down-some-websites-amid-global-cybersecurity-scare/

– Hackread, Qilin and INC exploit PAN-OS: https://hackread.com/qilin-inc-exploit-palo-alto-vpn-flaw-ransomware-attacks

– Cybersecurity Dive, ransomware and Palo Alto: https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/

– Check Point Research, October 19 threat report: https://research.checkpoint.com/2026/19th-october-threat-intelligence-report/

– The Hacker News: https://thehackernews.com/

– The Hacker News, Atlassian flaw: https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html

– SecurityWeek, Siemens flaw: https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

– SecurityWeek, LiteLLM: https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/

– SecurityWeek, Capcom: https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/

– Daily cybersecurity digest, October 23: https://github.com/rajshevde-01/Linkedin-Daily-Post/issues/399

– GBHackers, PwC claim: https://gbhackers.com/pwc-allegedly-hit-by-everest-ransomware/

– TrendForce, October 20 DRAM outlook: https://www.trendforce.com/news/2026/10/20/news-dram-prices-seen-rising-20-qoq-in-4q26-despite-slower-gains-ai-demand-tight-supply-support-outlook/

– Evertiq, memory prices in Q4: https://evertiq.com/news/2026-10-02-ai-keeps-memory-prices-climbing-in-q4-as-consumer-demand-weakens

– TechCrunch, Google and Amazon challenge Nvidia: https://techcrunch.com/2026/10/20/google-has-joined-amazon-in-attacking-nvidias-stronghold-with-ai-app-developers/

– OpenAI News: https://openai.com/news/

– Anthropic (Claude) release notes: https://support.claude.com/en/articles/12138966-release-notes

– FTI Consulting News Bytes, October 23: https://fticommunications.com/fti-consulting-news-bytes-23-october-2026/

– AI News Today (Reuters layoffs factbox): https://aiweekly.co/ai-news-today

– Gotrade, chip shares and AI spending worries: https://www.heygotrade.com/en/news/nvidia-nvda-stock-news-october-23-2026/