The week in one line: Vendor access was the way in again, and switching it off did not undo the damage. Attackers used application identities a backup vendor held inside Microsoft 365 tenants, a cloud platform that stored customers' secrets, and a poisoned release of an AI gateway library. A critical PHP flaw was probed before its patch shipped, and CISA and partners said one ransomware group has breached at least 600 organizations through stolen credentials, VPNs and unpatched edge devices.
23 distinct items across three daily editions (October 20, 21 and 22), counted from each edition's lead, supporting and Also Notable slates, with repeats counted once. Nine products or flaws drew reported exploitation or abuse: ConnectWise Cloud Backup identities, PHP (PHP2Shell attempts), Plex Media Server, Siemens Software Center, SiteGuard, FortiOS and FortiManager, Palo Alto GlobalProtect, UpdraftCentral connection keys and the poisoned LiteLLM release. Reported scale ranged from 3,897 customer records at State Bank of India to 11,774,247 CAPCOM ID accounts, more than 300 Microsoft 365 tenants with successful attacker sign-ins, at least 600 organizations breached by SafePay and an estimated 5.1 million internet-exposed PHP hosts (VirusTotal). Oracle's October Critical Patch Update carries 1,295 patches.
Compilation note: the window is the seven U.S. Eastern days ending October 23. Daily editions on file cover October 20, 21 and 22, and none ran from October 16 to 19. The October 15 edition was counted in last week's weekly. The October 22 edition was awaiting approval when this weekly was drafted, so its items link to the Breach Intelligence hub.
- SaaS, cloud platforms and developer tooling: 6 (ConnectWise Cloud Backup, Railway, LiteLLM, GitLab, UpdraftPlus and UpdraftCentral, Onamae.com Desktop Cloud)
- Web platforms and enterprise software: 6 (PHP2Shell, Drupal, Oracle's October Critical Patch Update, Plex Media Server, Siemens Software Center, SiteGuard)
- Network edge, security products and PKI: 3 (FortiManager and FortiOS (PEERSTITCH), Palo Alto GlobalProtect, eMudhra certificate authority keys)
- Retail, e-commerce and consumer: 3 (Ahold Delhaize, Capcom, the Cairn campaign against e-commerce and manufacturer sites)
- Education and healthcare: 2 (ETS and California student records, Paradigm Healthcare Services)
- Financial and professional services: 2 (State Bank of India, PwC (an unverified extortion claim))
- Threat actor activity and government advisories: 1 (CISA and partner advisory on SafePay ransomware)
- Access you granted to vendors was the way in. ConnectWise Cloud Backup identities signed in to Microsoft 365 tenants, Railway held customers' environment variables, a compromised login at an ETS file transfer site exposed California student records, and a telecom provider's FortiManager exposed configurations for more than 500 firewalls. In the Cairn campaign, two of the three named victims reported the affected asset was a side site or a vendor-run site. The question for your team is not who you buy from but which vendor applications, accounts and platforms can reach your data.
- Turning it off or patching it did not undo it. ConnectWise's advisory says disabling its apps does not reverse changes already made in a tenant. Railway asked every user to rotate secrets, not only those it later identifies as affected. LiteLLM's malicious package left a background process on hosts that ran it. GitLab's October 21 release puts instances that took the October 12 fix back in the affected range. Remediation and containment are different jobs.
- Secrets were the prize. The LiteLLM stealer went after cloud keys, SSH and GPG keys and AI tool configs. Railway's exposure covers environment variables and private registry credentials. NorForge reports that 11 percent of secrets seen in data exposed by the Cairn campaign were verified valid, and UpdraftCentral connection keys were used to plant backdoors on WordPress sites. A rotation runbook you can execute in hours is now a basic control.
- Disclosure lagged behind the attackers again. Details of the PHP2Shell flaws leaked on October 20, ahead of a planned October 22 disclosure, so PHP shipped patches a day early. Amazon reports attempts four days before the patches, per SecurityWeek's October 22 update, and Hadrian reported exploitation at scale hours before the fixes. Separately, Reuters reports Cairn agents breached more than 100 sites at roughly $50 per success. Plan for exposure before the advisory, not after it.
The week's most significant incidents
1. ConnectWise Cloud Backup identities used to sign in to Microsoft 365 tenants
CRITICAL · SAAS AND MSP SUPPLY CHAINConnectWise says it identified unauthorized access to application identities in its Cloud Backup environment on October 14, then disabled Cloud Backup on October 17, followed by SaaS Security and Cloud Management. Huntress reports sign-in activity from the attacker's address across nearly 1,000 Entra tenants, more than 300 of them successful as of October 17, up from the 162 cited earlier. In some tenants the apps were given directory roles, in two cases Global Administrator, and extra credentials were added for persistence. ConnectWise's advisory, as quoted by CoreView, says disabling the apps does not reverse changes already made inside a tenant. ConnectWise has not identified confirmed downstream compromise and says it cannot see inside customer tenants. The lesson is about evidence: check role assignments, client secrets and Conditional Access changes from October 1 to 17, and ask your MSP in writing which vendor apps sit in your tenants.
Re-verified against The Record (October 19), which matches the service suspension, the October 13 and 14 password spraying against four law firms and the 162-tenant count. The 300-plus figure is from Dark Reading and SecurityWeek as cited in the daily edition. See the October 20 edition for the full checklist. Sources: The Record, Dark Reading, CoreView, The Hacker News
2. PHP2Shell: two critical PHP flaws allow unauthenticated code execution
CRITICAL · WEB PLATFORM AND ACTIVELY PROBEDCVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 per SecurityWeek, affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed across nearly all releases back to 5.4. An unauthenticated request can run code as the web worker account, and remote code execution was confirmed on Apache with mod_php. Fixes shipped October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4, 8.0 and 8.1. Cloudflare and Patchstack saw attempts on October 21, and SecurityWeek's October 22 update cites Amazon seeing attempts four days before the patches. VirusTotal estimates more than 5.1 million PHP hosts are exposed online. A WAF rule buys hours, not a fix, and the PHP security team says interim settings do not make a host safe. The hard part is finding PHP, which hides inside CMS platforms, vendor portals and container images.
Re-verified against SecurityWeek, which matches the CVE IDs, CVSS and fixed versions and adds the Amazon detail in an October 22 update. See the October 21 edition for the checklist. Sources: SecurityWeek, BleepingComputer
3. Railway tells customers to rotate secrets after possible environment variable access
CRITICAL · CLOUD PLATFORM AND SECRETS EXPOSURERailway disclosed on October 21 that an unauthorized party may have accessed encrypted environment variables and, for some customers, the decrypted contents. It describes the affected group as a subset of users, out of about 4.8 million users and more than 16 million hosted services, but it has asked every user to rotate stored secrets and private registry credentials. Railway paused deployments, restored builds in stages starting with Pro and Enterprise workspaces, and linked the incident to a series of attacks on platform companies aimed at AI inference providers. No actor has been named. A researcher's report of crypto wallets drained after their keys were stored on Railway is unconfirmed. If one platform account held a production database password, a payment API key and a cloud token, one exposure means three rotations and three log reviews.
Re-verified against BleepingComputer (October 22), which matches the disclosure, the rotation guidance and the staged recovery. As of the status page it cites for October 22, builds for Hobby, Free and Trial workspaces had not resumed. The October 22 edition is awaiting approval, so see the Breach Intelligence hub for it. Sources: BleepingComputer, The Hacker News
4. LiteLLM 1.107.0 poisoned on PyPI and Docker with a credential stealer
HIGH · SOFTWARE SUPPLY CHAIN AND AI TOOLINGStepSecurity reports that all seven PyPI wheels of litellm 1.107.0 and the v1.107.0 Docker image carried a startup file named cook.pth. Python runs it on every interpreter start, so the stealer ran without anyone importing LiteLLM, and a background process polled a GitHub-hosted location hourly for more code. Targets included cloud and developer credentials, SSH and GPG keys, browser data and AI tool configs. The package reached PyPI about 11:39 UTC on October 21 and was removed by 13:23. LiteLLM says malicious actions ran through three engineers' GitHub accounts, likely using stolen GitHub CLI OAuth tokens, and that the original attack vector is not yet traced. Pin to 1.106.2 by digest, and treat any host that ran 1.107.0 as compromised, replacing it rather than cleaning it in place.
Re-verified against StepSecurity, which matches the version, the cook.pth mechanism, the timeline and the clean version. It adds that the attacker account used as a drop point was deleted and could be re-registered by someone else to serve code to infected hosts. Sources: StepSecurity, The Hacker News
5. CISA and partners say SafePay ransomware has hit at least 600 organizations
HIGH · RANSOMWARE AND CRITICAL INFRASTRUCTUREA joint advisory from CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and the UK National Crime Agency says SafePay has breached at least 600 organizations since August 2024 across North America, South America, Europe and Australia. The group does not use affiliates, and its leak site lists only victims who did not pay, so the true count is likely higher. Entry points are credential exposure, brute force, VPN access including phished account profiles and automated exploitation of edge device flaws. BleepingComputer reports the group deletes shadow copies and resets network-attached storage devices that hold backups. Treat the advisory as a checklist you can score yourself against: edge patching, MFA on remote access, credential hygiene and whether a production administrator can change your backups.
Re-verified against BleepingComputer, which matches the 600 figure, the entry methods and the backup targeting. The advisory ID AA26-293A appears in the CISA URL as cited by BleepingComputer, and the CISA page itself was not fetched. See the October 21 edition for the checklist. Sources: BleepingComputer, Infosecurity Magazine, HIPAA Journal
Also across the week
- ETS and California student records: a compromised login on an ETS file transfer site was used to copy student files from May 22 to September 18. The data includes disability and accommodation details for some students. ETS detected it September 25, and the total affected has not been published.
- Cairn AI agents: Reuters reports an operator used the open-source Cairn platform to breach more than 100 company sites at about $50 per success. Deere, SharkNinja and Cummins responded, each describing a contained or ongoing review.
- PEERSTITCH: Unit 42 describes how one compromised FortiManager at a telecom MSP exposed configurations and credentials for more than 500 FortiGate firewalls. CVE-2025-61624 is on CISA's KEV list, and sources differ on the date, October 16 or 19.
- CISA KEV additions: Plex Media Server (four CVEs, one chain), Siemens Software Center and SiteGuard Server Edition were added October 20. The CISA catalog could not be fetched for that edition, so the entries came from two agreeing secondary sources.
- GitLab: CVE-2026-110264 (CVSS 10.0) is a regular expression flaw in self-managed GitLab fixed October 21 in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab reports no exploitation and offers no workaround.
- Capcom and PwC: Capcom confirmed unauthorized access to 11,774,247 CAPCOM ID records, with 196 accounts having passwords changed without the owner's action and no card data involved. The Everest group claims 590 GB of PwC data, which PwC has not confirmed.
- Ahold Delhaize: the grocer confirmed malicious actors were behind an outage at most of its U.S. and European brands, with no evidence of stolen sensitive data and no attack type disclosed.
- Drupal, eMudhra and GlobalProtect: Drupal fixed critical remote code execution flaws and warned of fast exploitation, Mozilla blocked eight compromised eMudhra intermediate certificates, and Unit 42 reports Qilin and INC attempting CVE-2026-0257 on Palo Alto GlobalProtect.
- Onamae.com, SBI and UpdraftCentral: GMO's Onamae.com Desktop Cloud may affect up to 26,739 servers, State Bank of India found 3,897 customer records in a dark web set, and UpdraftCentral connection keys were used to backdoor WordPress sites. Each was covered by one source reviewed.
- Oracle and Paradigm Healthcare: Oracle's October Critical Patch Update carries 1,295 patches, and Paradigm Healthcare Services reported more than 970,000 people affected roughly 11 months after detection.
What to watch next week
- Railway's affected count and attribution. Watch for how many accounts were confirmed compromised, whether an actor is named, and any confirmation or denial of the reported crypto wallet drains. Rotate stored secrets now rather than waiting for the count.
- PHP2Shell exploitation. Expect reported compromises and a possible CISA Known Exploited Vulnerabilities listing. Confirm every internet-facing PHP host is on a fixed build or a vendor backport, and review web logs from October 20 onward.
- ConnectWise restoration and downstream impact. The service has no stated restoration date, and the company still has not confirmed customer compromise. Watch for attribution and for any new indicators.
- LiteLLM's origin and follow-on abuse. BerriAI has not traced how the release was published, and infected hosts still poll for code. Check build logs for 1.107.0 and rotate reachable credentials.
- GitLab exploitation. A CVSS 10.0 flaw with no workaround and a published fix invites reverse engineering, so confirm your version against the October 21 list.
- PwC and Capcom follow-ups, plus the Plex KEV deadlines. PwC has not confirmed the Everest claim, Capcom is still determining the full extent, and two Plex entries carried an October 23 federal due date.
FAQ
What was the biggest breach story of the week?
ConnectWise Cloud Backup, where attackers used application identities to sign in to more than 300 Microsoft 365 tenants as of October 17, per Huntress. In some tenants the apps held directory roles, and ConnectWise says disabling the apps does not reverse changes already made.
Is PHP2Shell being exploited?
Cloudflare, Patchstack and WatchTowr reported attempts around the October 21 patch release, and Amazon reported attempts four days earlier. Hadrian reported exploitation at scale. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply your vendor's backport.
Do I need to rotate secrets stored on Railway?
Yes. Railway asked all users to rotate environment variables and private registry credentials, not only users it later identifies as affected, and to check service logs for unusual activity.
How do I know if I installed the poisoned LiteLLM release?
Search build logs, lockfiles and container registries for litellm 1.107.0 and for image pulls on October 21. On any host that ran it, look for cook.pth, then rotate every credential that host could reach and replace the machine.
What should a CISO do first on Monday?
List the vendor applications and platforms that can reach your Microsoft 365 tenant, your cloud accounts or your secrets, confirm your PHP inventory and patch state, and test that your teams can rotate stored credentials within a day.
More from the community: the CISO Platform Breach Intelligence hub, and peer resources on third-party risk, vulnerability management, and ransomware.
Join a vendor-neutral community of senior security leaders who share what actually works.
Join the CISO Platform community (free)
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments