Critical Vulnerabilities, Supply Chain Attacks Dominate Cybersecurity News

Microsoft has officially attributed the ConnectWise Cloud Backup supply chain attack to Storm-0940, a China-linked advanced persistent threat (APT) group. The attack, which occurred between October 15th and 17th, 2026, leveraged a stolen application credential to gain unauthorized access to customer tenants in both Microsoft 365 and Google Workspace, expanding the previously known scope. Threat actors utilized automated tools, including an open-source AI penetration-testing tool named ARTEX, to rapidly authenticate against thousands of tenants. This attribution and new technical details highlight the sophisticated nature and broader impact of the incident.

The critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been collectively named 'PHP2Shell'. A significant update is the retraction of the previous report linking these CVEs to a specific compromise of a European government agency; while an attack was observed, definitive attribution to these specific flaws could not be confirmed. The new report also provides substantially more detailed guidance on cyber observables, hunting hints, detection methods (including MITRE ATT&CK and D3FEND mappings), and mitigation steps, reinforcing the need for immediate patching despite the unconfirmed exploitation.

New intelligence from Amazon Threat Intelligence reveals that exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) was observed as early as October 17, 2026, prior to public disclosure. This indicates a more advanced and prolonged threat landscape than initially understood. The flaws critically impact widely used platforms like WordPress, Drupal, and Magento. Furthermore, PHP versions 8.1 and older, which are unsupported, will not receive official patches, leaving millions of legacy websites permanently vulnerable unless they undergo costly and complex upgrades. This significantly elevates the long-term risk and operational burden for many organizations.

Further analysis of the LiteLLM supply chain attack (version 1.107.0) confirms the presence of a sophisticated backdoor in addition to the infostealer. This backdoor allows threat actors to execute arbitrary commands on compromised developer machines, significantly increasing the risk beyond credential theft. The incident now maps to additional MITRE ATT&CK techniques including T1555.005 (Credentials from Password Stores), T1059.006 (Python execution), and T1048 (Exfiltration Over Alternative Medium). This expanded capability means attackers could pivot into corporate networks, inject malicious code into company software, and exfiltrate proprietary data, escalating the overall severity and potential for widespread organizational impact.

Further details have emerged regarding the critical GitLab vulnerability. It has been assigned CVE-2026-110264 with a CVSS score of 10.0, confirming it as an unauthenticated remote code execution (RCE) flaw. The vulnerability is rooted in the third-party Onigmo regular expression library used by Ruby. It affects all self-managed GitLab instances from version 7.0 up to 19.5.0, significantly broadening the scope of potentially vulnerable systems. Administrators are urged to upgrade to version 19.5.1 immediately, and to assume compromise if publicly exposed instances were not patched promptly.