For this month’s cybersecurity roundup, we saw critical flaws in PHP push government websites offline, a backup service used by MSPs suspended after its own credentials were abused, an actively exploited VPN flaw that worked against a fully patched appliance and supermarket groups in France and the Netherlands disrupted at scale.
We also look at the end of security updates for Exchange 2016 and 2019, another record Patch Tuesday and recent arrests linked to the ShinyHunters group.
Read more below:
Cyber-attacks in the news
Critical PHP flaws push government websites offline across the UK and Europe
PHP released emergency fixes on the 21st October for two critical vulnerabilities in the programming language, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on the CVSS scale and could let an unauthenticated attacker run code on a web server. According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified, including those built on platforms such as WordPress. Details leaked online on the 20th October, ahead of a planned disclosure on the 22nd, so the fixes were released a day early.
Cloudflare’s chief executive said the company had recorded millions of exploitation attempts after the disclosure, and other security firms reported attempts before the fixes were available. The NCSC and CERT-EU advised organisations that could not patch immediately to consider taking systems offline, and websites belonging to UK councils, the Metropolitan Police and European governments went dark as a precaution.
Because the flaws sit in PHP itself, every installation needs the update, including PHP bundled inside hosted applications and appliances, and PHP services need restarting afterwards for the fix to take effect. Official fixed releases cover PHP 8.2 to 8.5, with minimal source backports for 7.4, 8.0 and 8.1, so clients on older branches may depend on their Linux distribution or hosting provider for a patch. For partners, the first job is finding where PHP is running across each client estate.
ConnectWise suspends Cloud Backup after attackers abuse application credentials
ConnectWise suspended its Cloud Backup service, on the 17th October after unauthorised access to application identities linked to the product. It disabled seven application identities and, the following day, also suspended the integrated SaaS Security and Cloud Management services as a precaution.
Huntress confirmed that the Cloud Backup identity signed in to 162 Microsoft 365 tenants between the 15th and 16th October. The sign-ins were made as the application itself, so no user, device or MFA prompt was involved. ConnectWise said it has no evidence that customer backups were accessed.
ASOS confirms breach after rogue “ASOS hacked” app notification
Customers of UK fashion retailer ASOS received an unauthorised push notification on the 6th October claiming the company had been hacked and its Snowflake data environment compromised. ASOS confirmed in a stock exchange filing that third-party platforms it uses to communicate with customers had been accessed, and that names and contact details may have been exposed.
ASOS later said attackers gained access through an employee account by impersonating a trusted contact to obtain login credentials. It does not believe payment card details or passwords were affected.
Cyber incidents disrupt supermarket groups in France and the Netherlands
Hundreds of French supermarkets were hit overnight on the 11th October by an attack on connected refrigeration systems. Temperatures were raised as high as 50°C, causing food losses and some fires, and the French finance minister said around 700 of the country’s 10,000 supermarkets were affected.
The French cybersecurity agency ANSSI is investigating, and a source in the prime minister’s office said it had identified a vulnerability in software supplied by Danfoss. Danfoss said most of the affected systems were older products that no longer received security updates.
Ivanti Connect Secure zero-day chain gives attackers root access to patched VPNs
Security firm Volexity found an unknown attacker chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances from the 3rd October, gaining unauthenticated root access to an appliance running the latest available version. Ivanti confirmed limited exploitation and released a patch on the 13th October for the authentication bypass and remote code execution flaws, tracked as CVE-2026-104935. The fix for the third flaw, a privilege escalation, was still to come at the time of reporting.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue. Volexity reported that the attacker left no malware on the device, re-ran the exploit chain for each command and altered logs to hide its activity.
Misused supplier access exposes Denmark’s population register
Danish authorities said unidentified individuals misused a private company’s legitimate access to the Central Person Register, exposing the names, addresses and personal ID numbers of around 8.8 million people. The activity took place in September and was discovered on the 2nd October.
The Danish Data Protection Agency described a large number of automated searches aimed at identifying valid ID numbers. The company’s access has been blocked; police are investigating and the digitalisation minister has ordered a security review of the system. Authorities said it was too early to say who was behind it. People registered for name and address protection were not affected.
The cybersecurity landscape
Microsoft’s October Patch Tuesday sets another record
Microsoft fixed more than 1,400 vulnerabilities on the 13th October, a new monthly record and up from 974 in September on Microsoft’s own count. One zero-day is being actively exploited: a Windows Shell flaw, CVE-2026-96951, that bypasses Mark of the Web protections. Two others were publicly disclosed before fixes were released.
Microsoft has been using AI tools to find bugs, which is one reason monthly totals keep climbing.
Security updates for Exchange 2016 and 2019 end on the 31st October
Microsoft has confirmed that the extended security update programme for Exchange Server 2016 and 2019 ends with October 2026 and will not be extended. After that, any new vulnerability affecting either version will go unpatched, even for organisations enrolled in the programme. Microsoft recommends moving to Exchange Server Subscription Edition or Exchange Online.
For partners with clients still running on-premises Exchange, the deadline is close enough to make migration options and timing an immediate conversation.
Law enforcement closes in on the ShinyHunters group
Dutch police arrested a 24-year-old man from Amsterdam on the 15th September as part of an investigation into ShinyHunters. A suspected member was reportedly detained in Jordan on the 29th September and is said to be helping the FBI, according to Reuters sources. On the 9th October, the FBI announced the arrest of another suspected co-conspirator in connection with an incident involving the bureau’s jobs website.
ShinyHunters is known for social engineering, including calling employees while posing as IT support. A new leak site appeared shortly after the first detention, so the group’s activity has not stopped.
Threat landscape snapshot
Exploitation can start before a fix is available
Security firms saw PHP2Shell exploitation attempts before the fixes were released, and Cloudflare recorded millions of attempts after the announcement. Organisations need to know where software such as PHP runs, and who can approve an urgent update, before the next disclosure rather than during it.
Application identities need the same controls as people
The ConnectWise incident shows that sign-ins made as an application sit outside user-focused controls such as MFA. Third-party application permissions and their sign-in activity need regular review.
Patching does not always show a device is clean
The Ivanti flaws were exploited before fixes were available, and the attacker worked against a fully patched appliance. For exploited edge devices, compromise checks and credential rotation belong alongside the update.
Impersonation and supplier access remain common routes in
ASOS lost control of a communications platform after an employee account was impersonated, and Denmark’s register was searched through a private company’s legitimate access. In both cases the attacker used access that looked normal, which puts more weight on verification and supplier reviews.
End of support is a security deadline
Exchange 2016 and 2019 stop receiving security updates on the 31st October, and most of the affected French refrigeration systems were older products with no security updates. Software without updates leaves clients exposed to every new flaw, so end-of-support dates are worth tracking across client estates.
Supplier tools and connected equipment need regular review
None of this month’s entry points were core systems. They were a backup service, a VPN gateway, a customer messaging platform, appliance software and the PHP engine behind many websites, all trusted tools at the edge of the business.
At Elovade, we help channel partners protect their clients with our selected vendor portfolio of cybersecurity and IT technologies, product specialists and dedicated support. For more cybersecurity news and other articles like this one, visit our partner news & articles page. To explore our vendors or talk through your security offering, visit our vendor page or get in touch with the Elovade team.
