Top 5 Cybersecurity News

This week’s Top 5 Cybersecurity News for October 23, 2026 is about time. Attackers needed hours, and in one case started four days before public disclosure. Recovery asked for days: restores from clean backups, rotated credentials, client updates and, at one grocery group, more than a week without e-commerce. A flaw in PHP, the language behind much of the web, was turned into an exploit with the help of frontier AI, and the BSI expects mass exploitation within hours of the patch. SafePay ransomware resets the storage that holds backups. A certificate authority generated keys so weak that anyone could recover them. A premium WordPress plugin shipped a self-rebuilding backdoor from its own download channel. And Ahold Delhaize took systems offline across two continents. Five exposure layers, one question for every executive: how long would recovery take in your organisation?

1) PHP2Shell Puts PHP Web Servers Worldwide at Risk, and an Attack Attempt Came Four Days Before Disclosure

On October 21, the PHP project released emergency updates for PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a web server without logging in. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Germany’s BSI had already warned earlier that day, ahead of the patches expected that afternoon, that all known PHP versions back to at least PHP 5 are vulnerable. Wiz researchers say the flaws had existed for decades and that frontier AI models lowered the barrier to a working exploit, and Amazon’s honeypot network recorded an exploitation attempt on October 17, four days before disclosure (both per Help Net Security).

Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php and LiteSpeed. Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected and has no fixed release yet; the risk is highest where a management interface accepts internet connections. Fortinet is checking 12 products and Cisco 31 products and cloud services, with none confirmed vulnerable so far. VulnCheck reports (per Help Net Security) that most public proof-of-concept code does not work yet because address randomization blocks it on x86-64, though on ARM64 it can be brute-forced relatively easily. It still expects widespread attempts, so a flood of log entries says little about whether a server is exposed.

The BSI’s vice president, Thomas Caspers, called large-scale exploitation within a few hours of the updates likely, because attackers can analyse patches with AI-supported tools and generate exploits quickly. Here the patch itself starts the clock. The long tail is the harder part: the PHP project no longer supports 8.1 and older, although it released minimal source backports for 7.4, 8.0 and 8.1 and some vendors ship backported fixes, and appliances cannot be fixed by the customer until the vendor ships a release. For mid-sized organisations the practical first step is an inventory of everything that runs PHP, including appliances and vendor-run sites, followed by a verified patch status and tighter access to management interfaces.

Read more on: BSI Press Release · Help Net Security

2) SafePay Resets Backup Storage to Factory Settings, and the Advisory Counts at Least 600 Victims

On October 20, the FBI, CISA, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit published advisory AA26-293A on SafePay. The group has been active since August 2024 and has affected at least 600 victims across critical infrastructure sectors in North and South America, Europe and Australia. Entry comes through exposed credentials, brute force and VPN access, plus five known flaws: CVE-2020-3259 and CVE-2023-20269 (Cisco edge devices), CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication) and CVE-2024-40766 (SonicWall SonicOS). The advisory states that SafePay halts the Volume Shadow Copy Service and resets network-attached storage holding backups to factory settings.

The vulnerabilities date from 2020 to 2024, and the first key action in the advisory is to patch edge devices. The more uncomfortable detail is the order of priorities: the group takes over or creates administrator accounts, moves with PsExec, WinRM and RDP, and goes after the copies a victim would restore from. In our reading, any backup target that accepts the same administrator credentials as the domain is within reach. Recovery also solves only half of the problem, because SafePay exfiltrates data first and publishes it on a leak site if the victim does not pay.

For ransomware crews, backups are no longer an obstacle on the way to encryption. They are the asset that decides whether a ransom gets paid. The question for a board is therefore not whether backups exist, but whether an administrator account can delete them and when a restore was last tested end to end. The advisory’s own answer is offline, encrypted, immutable copies kept in a physically separate place.

Read more on: IC3 / CISA Advisory AA26-293A · HIPAA Journal

3) Eight Certificate Authority Keys Turned Out to Be Guessable

The private keys of eight intermediate certificates issued by the Indian certificate authority eMudhra in April 2025 were generated with too little randomness. Mozilla’s Dennis Jackson described them as effectively all zeroes apart from the last byte, recoverable almost instantly, and noted that several people had recovered them independently. Mozilla and Google blocked the certificates on October 17, Apple followed on October 19 and Microsoft on October 20; eMudhra revoked them, Sectigo took revocation steps for related certificates and Cloudflare patched its services. Google warned that the keys could let anyone forge trusted HTTPS certificates for any website against clients that still trust the intermediates.

The blocking works only as fast as clients update. SecurityWeek notes that some software needs an update before it stops trusting the intermediates, and Jackson has published a tool to check this. In practice that means more than browsers: runtimes, containers, appliances and embedded devices carry their own trust stores and often receive updates late. There is no evidence in Certificate Transparency logs of misuse before revocation, but not every client enforces those logs. eMudhra says a script flaw created a second, weaker key pair that was used by mistake because the labels looked similar, and that it will re-verify every key ceremony over the next week.

Trust anchors are infrastructure, and this one failed through process rather than mathematics: a modified script and two sets of keys with similar names. A revocation helps only where the revocation list reaches. Organisations rarely know which trust stores sit in their environment or who updates them, and that inventory is the part that can be done before the next authority makes the same mistake.

Read more on: Mozilla Bugzilla 2083449 · SecurityWeek

4) A Rank Math PRO Update Carried a Backdoor That Rebuilds Itself

Rank Math reports that PRO version 3.0.123, downloaded between October 15 at 20:02 UTC and October 16 at 07:12 UTC, contained malware that could compromise a site once the plugin was activated. The company removed the files and released 3.0.124; the free plugin from WordPress.org is not affected. According to the vendor, the malware recreates a hidden backdoor whenever someone visits the site. Indicators include outbound connections to rank1cdn.com, administrator accounts starting with wpsupport_, a fake core file named class-wp-cache-util.php and .htaccess rules that execute .cache files as PHP. Secondary sources list CVE-2026-111862 (CVSS 9.8). How the attackers got into the distribution channel has not been disclosed.

Anyone who activated 3.0.123 in that window should treat the site as compromised. Rank Math recommends restoring from a backup made before October 15, 20:02 UTC; deactivating the plugin is not enough, and deleting single files fails while the rebuilding mechanism is still active. The manual route starts with removing the entire plugin folder and the malicious database entry before anything else is cleaned up. Every secret the site could reach, from database credentials and WordPress salts to payment and SMTP keys, hosting and SSH access, has to be replaced. Sites that update premium plugins automatically may have taken the package without anyone deciding to.

Premium plugins arrive through the vendor’s own channel, outside the review that applies to WordPress.org, and they run with the full privileges of the site. For a mid-sized company the marketing website is often connected to forms, a shop, a mail server and a hosting panel, so the plugin that tunes page titles has the same reach as the code that takes orders. The 11-hour window sounds short. The cleanup, as the vendor’s own checklist shows, is measured in days.

Read more on: Rank Math Security Notice · SecurityWeek

5) Ahold Delhaize Kept Its Stores Open While E-Commerce Stayed Dark for More Than a Week

On October 12, Ahold Delhaize took systems offline after what it called a security issue in its network. On October 19, the company confirmed that the incident was “caused by the malicious actions of others”, said it had notified the Dutch National Cyber Security Centre within 24 hours and filed a police report. It has found no evidence so far that sensitive customer, associate or partner data was stolen; the investigation continues. The nature of the attack and whether a ransom was involved have not been disclosed. Websites, apps and e-commerce were affected across most brands in Europe and the US while all stores stayed open. Albert Heijn’s site and app are back, with home deliveries expected from October 23; Belgium is fully operational again, and US brands such as Food Lion and Stop & Shop were still waiting for “the coming days”.

Ahold Delhaize runs 9,551 stores, employs more than 384,000 people and serves 77 million customers a week, according to BleepingComputer. Taking systems offline across most brands on two continents suggests shared platforms behind brands that look separate to customers. We do not know that from the company; it is how the pattern reads. The outcome shows both sides: physical trading continued, while the digital channel needed more than a week and an unspecified restoration window in the US. This is also the second major incident for the group in two years, after a US breach in November 2024 that affected more than two million people.

The precautionary shutdown is a design decision made long before an incident: what is isolated, in which order, and what still works without it. Most organisations never map which brands, sites or business units depend on one identity, one network or one hosting platform. Missing public detail about the attack is normal during an investigation and says nothing about the cause. The recovery time is what a board can already ask about.

Read more on: BleepingComputer · The Record

If this week tells us anything, it’s this:

The five incidents share an asymmetry of time. Hackers needed hours or less: an 11-hour window for a poisoned plugin, keys that fell out of a certificate almost instantly, a PHP exploit attempt four days before disclosure, a ransomware crew that resets backup storage. Recovery needed days or longer: restores, credential rotation, client updates, a grocery group’s phased return, and for some victims no clean copy at all. The structural exposure is the time between “something is wrong” and “we are running on clean ground”, and most of that time is decided long before the incident, not by any single product.

For boards and CISOs the useful question is not how many of these attacks could be prevented. It is how long recovery of the systems that matter would take from a state the attacker cannot touch, who can delete the backups, which suppliers, plugins, certificates and web applications would have to be replaced under pressure, and whether anyone has timed it. A drill answers that at a fraction of the cost of an incident.

If you would like to talk through what recovery time looks like in your own environment, the DIESEC team is available through our contact page.