Three incidents this week turned on how fast attackers now move. Two critical PHP flaws sent governments and Wikipedia offline, with exploitation beginning four days before anyone was told. India’s largest bank confirmed customer records on the dark web and said it still does not know where they came from. And a China-aligned group used an open source AI framework to hit Microsoft 365 tenants faster than defenders could read an alert. Here’s a closer look at this week’s top cybersecurity headlines.
PHP released emergency patches on 21 October for CVE-2026-109618, an out of memory handling bug, and CVE-2026-109619, a use after free error. Both carry a severity score of 9.2 and allow unauthenticated remote code execution. Fixes landed in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier will not be fixed, though minimal source backports were provided for 7.4, 8.0 and 8.1. The timeline is the problem. Amazon detected an exploitation attempt against its MadPot honeypot on 17 October, four days before disclosure and while the flaws were still under embargo, from an anonymised IP. Exploit code circulated publicly a day before the patch. Cloudflare chief executive Matthew Prince logged tens of thousands of attempts within 45 minutes of announcement, hundreds of thousands within two hours, and millions afterwards. Wikipedia, the Internet Archive and government services in the Netherlands and Finland took systems offline as a precaution. Citing VirusTotal, BleepingComputer counts more than 5.1 million PHP hosts exposed online.
PHP states that all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that risk is highest for mod_php, where a demonstrated exploit triggers before any application code runs. Its interim mitigations, which it stresses are incomplete, include capping memory limits and request sizes, and disabling session upload progress tracking.
State Bank of India told the stock exchanges on 21 October that it had identified 3,897 customer records containing personally identifiable information within roughly 375,000 records found on the dark web. The bank was alerted on 16 October by its threat intelligence service provider, the Defence Cyber Agency and CERT-In. Exposed fields include registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file identifiers, lead IDs, and metadata associated with loan and lead records. The claim originated with a threat actor using the name Siriusim, posting on BreachForums and flagged by the monitoring account CyberPulse, who advertised 375,000 CSV rows and 2,722 PDF documents including loan applications and account opening forms. SBI has activated incident response and containment protocols and engaged a CERT-In empanelled agency for independent assessment. It says the incident has no material impact on core operations. Critically, the bank says a detailed investigation is still required to establish the data’s authenticity, source and extent.
Experts note that unverified provenance is itself the risk. Data recycled from older breaches or from third parties in a supply chain still enables convincing phishing against the named institution’s customers, regardless of where it originated.
Source: Hindustan Times, Times of India, TechRadar
Microsoft attributed the ConnectWise compromise to Storm-0940, a China state-aligned actor active since 2021, using the open source agentic AI penetration testing framework ARTEX. Attackers obtained a client assertion credential for ConnectWise Cloud Backup, formerly SkyKick. Because the application is multi-tenant, anyone holding that credential could request access tokens in any tenant where it was installed, with no customer action and bypassing multi-factor authentication. Microsoft reports ARTEX was used to reach more than 2,250 Microsoft 365 tenants at 2,900 sign-in attempts per minute, with multiple environments going from initial targeting to privileged cloud access in under three hours. Huntress observed sign-in activity across nearly 1,000 Entra tenants, over 300 apparently successful, and confirmed unauthorised sign-ins in 162. In some tenants the compromised identity elevated its own privileges and added credentials to other applications, preserving access after the original app was disabled. ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management, beginning phased restoration on 21 October.
Experts stress that disabling the affected application is not remediation. Teams must preserve evidence, then audit service principal sign-ins, application credential additions, consent grants and role changes across all previously authorised integrations.
Source: The Record, CyberScoop, SecurityWeek, TechCrunch
Speed is the common thread. PHP’s maintainers lost four days of advantage before anyone could patch. SBI learned of its exposure from outside agencies rather than its own monitoring. ConnectWise customers faced 2,900 authentication attempts a minute against a credential they could not revoke themselves. In each case the defensive window closed before the defenders knew it had opened.