Spearstone
A closed laptop and two notebooks on a conference table at dawn, with the city behind glass
All articles

Weekly Brief: Patch PHP, Then Audit the Accounts That Already Copied Data

Spearstone Weekly Cybersecurity Brief for October 26, 2026. PHP is being attacked before many teams have patched it. CISA catalogued seven more exploited flaws. In three separate disclosures, a login that still worked was enough to copy data.

This brief covers October 19 through October 26, 2026. Four items are worth a leadership hour. Each one rests on a public statement. Where a researcher has gone further than an agency, the brief says so.

We will publish this note each Monday. It stays with primary sources, and it keeps a honeypot result separate from a confirmed compromise of a named network.

Patch PHP before you finish the rest of the queue

PHP2Shell is the pair of vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. They allow unauthenticated remote code execution in PHP installations that serve web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. PHP published fixes on October 21. CISA's alert, updated October 23, tells organizations to move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Systems still on PHP 8.1 or earlier should be taken offline until they can be replaced. A web application firewall is a stopgap, not a fix. As of that October 23 update, CISA said it had not observed successful exploitation.

On October 26, SecurityWeek reported a clearer result. Researcher Adel Karimi recorded 35 shells on October 24 against honeypots running PHP 8.4.26 under Apache mod_php with a single worker. Two addresses launched them. He was explicit that this profile is favorable, and that the capture is not a measure of how reliably the same chain works on other worker counts, builds, or applications. No second-stage download was observed. Amazon, also reported by SecurityWeek, saw probing as early as October 17, four days before the patch, and proof-of-concept traffic against its sensors once the fixes were public. As of the morning of October 26, CISA had not added either CVE to the Known Exploited Vulnerabilities catalog.

Vendors are already moving. On October 22, ConnectWise said Axcient x360Recover and the Backup for Files legacy portal had been remediated for these PHP flaws, and that the legacy portal was restored. Backups continued through the portal interruption. That is a vendor containing its own product. It does not inventory yours. PHP is often a component inside a portal, an appliance, or a site nobody still calls a PHP application.

  • Inventory every PHP runtime this week, including the ones inside products you did not build.
  • Patch internet-facing systems first, to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
  • Take PHP 8.1 and earlier offline if you cannot replace them immediately.
  • Watch for PHP worker processes launching a shell or downloading a tool. CISA included a Sigma rule in the October 23 update.

Seven newly exploited vulnerabilities

CISA added six vulnerabilities to the Known Exploited Vulnerabilities catalog on October 20, and one more on October 23. Entry requires evidence of active exploitation.

  • Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The set covers server-side request forgery, unsafe handling of encoded URI schemes, and external control of a file name or path.
  • EG Secure Solutions SiteGuard Server Edition, operating-system command injection: CVE-2026-106931.
  • Siemens Software Center, an uncontrolled search path: CVE-2026-110936.
  • Arista VeloCloud Orchestrator, SQL injection: CVE-2026-114625, added October 23.

Federal civilian agencies have a binding duty to prioritize catalogued flaws on exposed assets. The same list is the right queue for every other organization. Match these seven identifiers to the asset inventory. Patch or remove any copy that is reachable. A media server on a flat office network is a common miss, because nobody filed it as production.

A login that still works is the incident

Three disclosures this week are the same control failure. The software in front of the data mattered less than a credential that had not been retired.

Educational Testing Service, under contract to the California Department of Education, notified families that an unauthorized party used a compromised login on an SFTP site and copied student assessment files between May 22 and September 18, 2026. ETS identified the activity on September 25, disabled the account, and took the site offline. Notices began on October 16. The files cover students enrolled in the three previous school years. What was copied varies by student and can include name, date of birth, address, school, statewide and local student identifiers, demographics, disability and Section 504 status, program eligibility, and assessment results. ETS says the files did not include Social Security numbers, financial account data, passwords, or parent information, and that its monitoring has not found the data posted publicly. Affected families are being offered two years of Experian IdentityWorks.

The credential worked for nearly four months. A file-transfer account that can copy a directory needs a named owner, an alert on bulk retrieval, and a date when the password dies. A login shared with a vendor does not meet that bar.

GMO Internet confirmed on October 20 that a third party had installed malicious programs in some Onamae.com Desktop Cloud servers. It listed 26,739 servers as potentially affected and shut down every plan from 4:00 JST on October 21. That figure is the population in scope. GMO has not published a separate count of confirmed infections. On October 21 the company said it had not confirmed leakage of personal information it holds, and that it does not store card data. The October 24 group disclosure is the later fact: customer information was taken outside, and some customers reported trading-account transactions they do not recall. GMO will not resume the service on the infrastructure that was accessed. If a hosted desktop runs a trading terminal or any other privileged session, rotate those credentials and reconcile transactions before you ask when the server will be switched on again.

PingCAP's October 19 report describes the same pattern inside a cloud vendor. Between September 9 and October 7, stolen service-account credentials were used to reach internal systems, copy data, and obtain source code. PingCAP learned of the activity on October 7 and began disabling the credentials that day. By October 14 it had invalidated the identified credentials and blocked the identified paths. The external review found no evidence of attacker commands or persistent access in the production systems it examined, and no evidence that data stored in customers' TiDB databases was accessed. The CEO's note adds that a compromised GitHub account was part of the entry, and that customer-related records were copied from internal analytics, storage, and support systems. Keys left in a repository, and secrets pasted into a support ticket, are how this class of incident starts. Pull both.

If people are leaving, the laptop is still a system

Separate from the intrusion news, several employers filed layoff notices in the same window. eBay's California filing covers 229 positions in San Jose, processed and effective October 21. Netflix filings processed October 19 cover 227 positions in Los Gatos and 267 in Los Angeles. Vermont Information Processing described 66 cuts on October 20 as a permanent reduction in force. A notice counts jobs. It does not collect the laptop that is already at home.

Disable the identity the hour the decision is communicated. Revoke sessions, tokens, and VPN access in that same hour. If the device was enrolled before it left, lock or wipe it then, and reimage it if it comes back. DriveStrike is the product Spearstone builds for that lock and wipe. It reaches devices you enrolled. It does not reach hardware that never was. The offboarding order is the one in When the Employee Leaves and the Laptop Does Not Come Back.

Before Friday

  1. Finish the PHP inventory and patch or isolate every internet-facing runtime. Confirm the four fixed versions above, not a nearby point release.
  2. Run the seven new catalog identifiers against the asset list. Start with anything that accepts a connection from outside the building, including Plex.
  3. List the file-transfer and service accounts that can copy a directory. Rotate shared logins, alert on bulk downloads, and disable an account the day a vendor says a credential was used.
  4. For any departure or missing device this week, revoke access first. Lock or wipe the hardware if it is enrolled. If it is not, treat the disk as outside your control and rotate every secret that lived on it.

If you want a second set of eyes on the PHP inventory or the file-transfer accounts, contact Spearstone.

Keep reading

Questions worth answering directly

Has CISA confirmed that PHP2Shell is being exploited?

As of its October 23 update, CISA said it had not observed successful exploitation, and it had not added CVE-2026-109618 or CVE-2026-109619 to the Known Exploited Vulnerabilities catalog by the morning of October 26. The same week, a researcher reported confirmed code execution against honeypots running a favorable Apache mod_php setup. Patch now. Do not wait for a catalog entry.

What should change because of the ETS file-transfer incident?

Give every account that can copy a directory a named owner, an alert on bulk retrieval, and a rotation date. ETS says the compromised login was used from May 22 through September 18, 2026, and that the activity was identified on September 25. The copied files held student assessment data. They did not, on ETS's account, hold Social Security numbers, financial data, or passwords.

Sources