A working examiner's read of the week's most interesting compromises. What happened, how it happened and what it means for anyone who has to reconstruct the event afterward.
Last week the edge learned to clean up after itself. This week the clean-up became the main event. Between October 15 and October 21 the language that runs a large share of the web turned out to have two holes that let anyone run code on the server, with no login and before the application even loads. A remote support appliance, the tool help desks use to reach into every machine they manage, was taken over, stripped of its password vault and scrubbed of its logs. And a single credential belonging to a backup app opened the email, files and chats of 173 Microsoft 365 tenants in roughly two hours.
Every one of these stories has the same quiet subplot. The evidence that would settle what happened has a shelf life. Some of it sits in process memory and disappears at the next restart. Some of it sits in logs the attacker deleted. Some of it sits in cloud logs that are only kept if someone switched them on in advance. Here is the week, read the way an examiner reads a disk: not as headlines but as events that leave traces. This week, traces that expire.
PHP2Shell: the patch that wipes the scene
The story of the week is PHP2Shell. For anyone who runs a website it may be the story of the year. It is the name for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on a web server through crafted HTTP requests. The PHP security team rates both 9.2 on CVSS version 4.0. A figure of 10.0 circulated before the advisory, from watchTowr's chief executive in comments to BleepingComputer. The PHP Foundation has since called that score incorrect.
The two bugs live below the application, in the code PHP runs to set up and tear down every request. The first, CVE-2026-109618, comes from out-of-memory handling: PHP can be interrupted while request data is only half built. The clean-up code then treats the broken data as valid. The second, CVE-2026-109619, is stale state. Memory a request owned can survive after it is freed. The next request handled by the same worker can then use it. PHP's advisory lists memory disclosure for the second flaw as well as code execution. Because all of this happens before any script runs, a login page, a role check or a plugin firewall never gets a vote.
The disclosure did not go to plan. On the morning of October 20 a post on Hacker News claimed two critical PHP flaws were headed for public disclosure. PHP published an advance notice the same day. Ubuntu says coordinated disclosure had been set for 14:00 UTC on October 22 and was pulled forward a day because of the leak, so the fixed releases, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, landed at 14:00 UTC on October 21. Branches 7.4 to 8.1 received source backports only, with no official release. Branches 5.4 to 7.3 get nothing from the PHP project. Sansec reported that researchers confirmed unauthenticated code execution against Magento 2.4.9 and ten other PHP applications.
Exploitation reports conflict, which is normal on day one. Cloudflare, as reported by Sansec, saw early attacks at 07:43 UTC on October 21, hours before the release. watchTowr and Datadog reported exploitation activity. CISA said it had not observed exploitation at the time of its alert. Huntress had not seen it across its partner base by late afternoon Eastern time. As of October 21 neither CVE was in the Known Exploited Vulnerabilities catalog. CISA's guidance was still blunt: anyone who cannot update immediately should take PHP-based systems offline until they can be patched or updated. The same applies to anyone who runs PHP 8.1 or earlier.
Two details matter most to an examiner. The first is that the version number lies. Distributions backport fixes without changing it, so Ubuntu 24.04's fixed package still reports PHP 8.3.6, which looks years older than 8.3.36 but is not. The second is that the fix destroys evidence. Patching means restarting every PHP worker. A restart clears the process memory, live connections and worker state that would tell a failed probe from a successful one. Datadog's lab work shows failed attempts tend to leave memory errors "in Unknown on line 0" and worker segmentation faults, while a successful attempt can return a normal 200 response and leave nothing obvious behind.
We published a full treatment on October 21: PHP2Shell: what to preserve before you patch. It covers the fixed versions by branch, how to check a distribution build, the six collection steps that take minutes on a single server and why patching does not evict anyone who already got in. On Linux hosts the system journal is where segfaults and out-of-memory kills land. Our guide to journald forensic analysis shows how to read it. We also updated our free scanner the same day. The Hack Your Own Website tool and the free security scorecard now flag PHP versions in the affected range when a server reveals them. A clean result is not proof of safety, because many servers hide their version.
BeyondTrust Remote Support: the help desk's master key
Last week we flagged this one as it broke. On October 15 BeyondTrust disclosed CVE-2026-102764 in Remote Support, the appliance formerly known as Bomgar that help desks and managed service providers use to take control of user machines. Rapid7 puts it at 9.3 on CVSS version 4.0. It lets an unauthenticated remote attacker perform file operations on the appliance, which in practice means uploading files of their choosing. The patch, BT26-05-RS, covers versions 24.3.1 through 26.2.3. Anything older has to be upgraded first. BeyondTrust's hosted tenants were patched before disclosure. CISA added the flaw to the exploited catalog on October 16 with an October 19 deadline. Rapid7 notes the official KEV feed marks forensic triage as required. That flag is rare. It is also the right call.
Google's Threat Intelligence Group and Mandiant attribute the exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. The intrusions began in late August. Google's write-up reads like an inventory of what an attacker does with a privileged appliance. A POST request to an unusual PHP path staged the way in. The actor then planted SAWFLY, an obfuscated PHP web shell hidden as mangoapi.php that answers with a 404 unless it sees its secret parameter, so a crawler or scanner sees nothing. A tunnelling tool called BARECLAW carried SOCKS5 traffic over WebSockets. A copy of /bin/sh renamed dbus-authd and set to run as root gave the actor privilege on demand. A boot script added a sudoers line so the access survived restarts.
Then came the vault. The actor ran BeyondTrust's own administrative utility, bt-secrets, against the appliance's credential store, falling back to a command that dumps every stored administrative credential. It deleted the utility's log afterward. With administrator credentials in hand it logged into the portal, raised a compromised account's access to Administrator and used real support sessions to request file-system access on downstream machines and copy documents out. Mandiant says the actor removed logs throughout the incident. One recovered command deleted the authentication, SSL and web access logs in a single line.
Here is the detail that should change how responders handle these boxes. Mandiant found its evidence of exploitation in the access, syslog, messages, thin-scc, brain and SSL logs, which sit on a LUKS-encrypted partition holding /home. In other words, the proof was on the appliance but not reachable by casual inspection. Google's guidance is to snapshot virtual appliances with memory and export the disk before any change or reboot. It is equally firm on the order of the next steps: rebuild compromised or uncertain appliances from a clean, patched image and only then rotate credentials. Rotating earlier is a mistake, because new credentials set on an appliance the attacker still controls go straight to the attacker. That list includes "any credential typed into a support session during the window."
A remote support appliance is the help desk's master key, so a compromise of one is a compromise of everything it can reach. Anyone who ran a self-hosted appliance from late August onward should treat the question as forensic, not just a patching task. Look for unknown .php paths and WebSocket upgrades in request logs, for gaps in syslog forwarding from the appliance and for Jump Item roles raised to Administrator. Google published hashes for SAWFLY and BARECLAW. A hash calculator settles a match in seconds. If the logs were forwarded off the appliance as they were written, those copies are the ones the attacker could not delete. Our guide to the first 72 hours after a data breach sets out how to sequence preservation, containment and credential rotation so that one does not wreck the other.
ConnectWise Cloud Backup: one secret, 173 tenants
Last week the backup console was the way in. This week it was the backup app's identity. ConnectWise Cloud Backup, formerly SkyKick, is a backup service for Microsoft 365 sold through managed service providers. To do its job it is consented into each customer tenant with broad rights over mailboxes, OneDrive, SharePoint, Teams and directory data. Someone obtained the credential that app uses to sign in. The Hacker News, reporting Huntress's findings on October 17, said Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants. Counts from other outlets vary. ConnectWise has not said how the credential was stolen.
The timeline is the forensic story. Huntress traced the activity to a single address, 144.172.64.128, which obtained Microsoft Graph tokens on October 15 between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, seconds apart, the signature of a script working down a target list. The same address had password-sprayed four law firm tenants on October 13 and 14 without success. In at least one partner tenant a separate ConnectWise Cloud Management app added itself to the Global Administrator role and then added new client secrets to other applications, including Huntress's own. Microsoft reported Graph reconnaissance and attempts to add credentials to the related service principal, which is how a temporary foothold becomes a permanent one.
ConnectWise shut off Cloud Backup access, suspended related cloud services and said it found no evidence partner backup data was compromised. For tenant owners the work is in the logs. The published guidance is to check the Entra sign-in logs on the service principal tab for the Cloud Backup application ID, 506e08f9-6e9a-4da4-942b-a099a03644ae, from addresses outside Microsoft's ranges, audit for credentials added to any application since October 13 and look for ConnectWise or SkyKick apps adding themselves to directory roles. Todyl warned that tokens already issued can stay valid for up to 90 minutes after the app is disabled, so revoking user sessions does not end the access.
There is a harder lesson underneath. App-only access through Graph does not look like a user logging in. The log that records exactly what such an app read, the Microsoft Graph activity log, has to be switched on before it can help. A tenant that never enabled it may be able to prove the app signed in but not what it touched. That is the core problem of cloud forensics: the evidence lives on someone else's platform, under retention rules you agreed to long before the incident. Our business email compromise forensics guide covers the sign-in logs, mailbox audit records and message trace data that do survive. It also covers how quickly each one ages out.
Plex2Shell: a two-month patch gap, closed by attackers
PHP2Shell was not the only shell of the week. On October 20 CISA added four Plex Media Server flaws, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, to the exploited catalog. Together they are known as Plex2Shell. Individually they range from medium to high severity. The researcher who found them, Zach Main, rates the full chain 9.8. Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. The chain starts with a server-side request forgery in the player timeline endpoint and ends with a file write in the transcoder settings that plants a shared library Plex later loads.
The fix is old news. Main reported the flaws to Plex on July 27 and version 1.43.3.10861 shipped on August 4. Full technical details followed on October 16, reports of in-the-wild exploitation on October 17 and a proof of concept three days after the details. Honeypot reports describe attackers installing cryptominers and proxy software. CISA set October 23 as the deadline for the two most serious Plex flaws and November 3 for the rest. Any server still below 1.43.3.10861 has been exposed since August and attacked since mid-October.
Plex is a media server, so why does it belong in a security roundup? Because it runs on the same home networks as the laptops of people who hold the keys to corporate systems. In 2023 LastPass said the attacker behind its 2022 breach reached a senior engineer's home computer through a vulnerable third-party media software package, widely reported to be Plex. The attacker used that foothold to steal the credentials that unlocked the company's cloud storage. A home server running an old build is part of the corporate attack surface whether IT knows about it or not. When an investigation reaches a remote worker's network, an exposed media server is one of the first things worth checking.
PEERSTITCH: a firewall implant that leaves nothing on disk
The most technically striking report of the week came from Palo Alto Networks' Unit 42, published on October 14 as our last window closed and picked up widely on October 19. It describes PEERSTITCH, an ARM64 implant for FortiGate firewalls found during an investigation into a telecommunications organization breached in September 2024. Unit 42 tracks the actor as CL-STA-0954, which overlaps with Mandiant's UNC5820. It describes the actor as suspected state-sponsored.
Initial access came through FortiJump, CVE-2024-47575, against a central FortiManager. From there the actor registered a rogue virtual FortiGate and pulled a configuration archive covering the FortiManager, more than 500 managed FortiGate firewalls and the victim's network. The haul included running configurations for internal and client networks, management databases, an inventory of serial numbers and public addresses, routing tables, certificates, encoded private keys and encrypted administrator and VPN credentials, which the actor recovered by brute force. A FortiOS path traversal flaw, CVE-2025-61624, patched in April 2026 and exploited as a zero-day, was used to gain root on firewalls and deploy the implant. CISA added CVE-2025-61624 to the exploited catalog on October 16.
PEERSTITCH is built to be invisible to the usual checks. Unit 42 says it leaves no persistent binary on disk, opens no listening ports and starts no outbound connections of its own. It patches itself into two running daemons. One is miglogd, which handles logging. The other is iked, the VPN key exchange service. It then talks through traffic those legitimate processes already carry. The actor killed the logging and syslog daemons before running its scripts, cleared crash logs, deleted the rogue accounts and objects it created and overwrote a configuration file with a decoy to hide a reverse shell.
For responders, Unit 42's hunting table is the useful part. It points to anonymous 16,384-byte memory regions marked read, write and execute inside miglogd and iked, signal 11 crashes for those processes in diagnose debug crashlog read output and configuration revisions containing auto-scripts with ../../ in their names. Every one of those checks is a live-system check. Reboot the firewall first and the memory evidence is gone. And because the stolen archive held configurations, certificates and keys for more than 500 firewalls, Unit 42's advice applies to every one of them: treat the credentials and certificates as compromised until rotated. Firewall management interfaces exposed to the internet appear in our list of firewall misconfigurations we find in every pentest for exactly this reason.
The breaches worth your attention
On October 15 Burger King Japan disclosed unauthorized access to the system that manages its app membership data, affecting about 11.18 million records. Access ran from October 2 to October 7. Reported fields include names, email addresses, phone numbers, dates of birth, gender, member IDs and prefecture, along with flags for mobile ordering history. The company said the system held no card numbers and it had not confirmed any exposure of login passwords. One detail is worth noting for anyone reading breach counts: 11.18 million is a record count. One person can hold more than one record. It extends the run of Japanese incidents we covered last week.
On October 19 the California Department of Education disclosed that an unauthorized party used compromised login details to copy student files from an SFTP site run by its testing contractor, Educational Testing Service, at various times between May 22 and September 18. The exposed fields include names, statewide student identifiers, dates of birth, home addresses, demographic data, disability and program information and test scores. The department says Social Security numbers, financial data and parent information were not involved. No exact count has been given. The access lasted four months on a single file transfer server with a valid login, which is the pattern that makes scope so hard to establish after the fact. For Canadian organizations weighing their own obligations, our guide to what to do after a data breach in Canada walks through the notification decision.
On the watchlist
A few more items for the patch-now list.
Ivanti's third link is still open. As of the latest reporting, Ivanti has fixed the authentication bypass and code execution flaws tracked as CVE-2026-104935 in Connect Secure 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1, but the privilege escalation flaw UTA0576 used to reach root remains unpatched, with a fix promised in the coming weeks. Patched appliances are not out of the woods until that lands.
CISA's October 20 additions also included CVE-2026-106931, an OS command injection in EG Secure Solutions SiteGuard Server Edition, a web application firewall common in Japan, with an October 23 deadline. The same batch added CVE-2026-110936, an uncontrolled search path flaw in Siemens Software Center. A security product with a command injection flaw is a reminder that the tools guarding a server are part of its attack surface.
The forensic read
Pull back from the individual stories and this week makes one argument. Evidence now has an expiry date. Attackers know it.
Look at where the proof of each intrusion lived. With PHP2Shell, the clearest evidence of a successful attempt sits in worker memory that the patch restart wipes. PEERSTITCH lives only inside two running processes, so the first reboot erases it. ARMORY CASTLE deleted the appliance logs. The copies that survived sat on an encrypted partition most responders would never open. In the ConnectWise incident the log that would show what the app read only exists if it was switched on in advance. The stolen tokens outlived the response by up to 90 minutes. None of this is accidental. Each one takes advantage of the order in which defenders do things: patch, reboot, rotate, then ask what happened.
The lesson is to reverse that order where it is safe to do so. Capture memory and disk before the restart. Forward logs off appliances and hosts as they are written, so a deleted local log is not a lost one. Switch on the cloud audit sources before you need them, because you cannot switch them on retroactively. Rotate credentials after the system that holds them is rebuilt, not while the attacker still sits on it. None of these steps takes long. All of them have to be planned before the incident, which is what our Digital Evidence Readiness Self-Audit is built to check.
That is the through-line Sherlock Forensics cares about. An intrusion is not finished when the attacker leaves. It is finished when someone can reconstruct what happened in a form that holds up to scrutiny. This week, that depended on what was captured in the first hour. If an internet-facing server, appliance or tenant of yours is in scope for any of these stories, our incident response team can preserve the evidence and build the timeline. An incident response retainer means the first hour is already planned the next time. See you next week.
Sources
- Security advisory: critical remote code execution vulnerabilities, update now, PHP Group: www.php.net
- php2shell vulnerability fixes available, Ubuntu: ubuntu.com
- php2shell (CVE-2026-109618, CVE-2026-109619): frequently asked questions, Tenable: www.tenable.com
- PHP2Shell: critical vulnerabilities in PHP, detection, analysis and remediation, Datadog Security Labs: securitylabs.datadoghq.com
- PHP2Shell: critical PHP RCE, Sansec: sansec.io
- PHP2Shell: critical PHP vulnerabilities patched, Help Net Security: www.helpnetsecurity.com
- ARMORY CASTLE exploits BeyondTrust, Google Threat Intelligence Group: cloud.google.com
- ARMORY CASTLE and BT26-05: what security teams need to know, BeyondTrust: www.beyondtrust.com
- CVE-2026-102764: critical BeyondTrust Remote Support authentication bypass exploited in the wild, Rapid7: www.rapid7.com
- CISA adds two Known Exploited Vulnerabilities to catalog, October 16, CISA: www.cisa.gov
- Hackers use compromised ConnectWise credential, The Hacker News: thehackernews.com
- CISA: hackers chain Plex flaws in Plex2Shell attacks to breach servers, BleepingComputer: www.bleepingcomputer.com
- CISA orders federal agencies to patch exploited Plex2Shell, Siemens and SiteGuard flaws, The Hacker News: thehackernews.com
- CISA adds six Known Exploited Vulnerabilities to catalog, October 20, CISA: www.cisa.gov
- PEERSTITCH FortiGate implant and FortiManager CVE-2024-47575, Unit 42: unit42.paloaltonetworks.com
- Exploited Fortinet bug linked to stealthy FortiGate implant in telecom hack, SecurityWeek: www.securityweek.com
- Burger King Japan data breach exposes 11 million customer records, BleepingComputer: www.bleepingcomputer.com
- Millions of California students' sensitive data stolen in breach, Malwarebytes: www.malwarebytes.com
- Ivanti zero-day chain gave attackers root access to fully patched VPN, SecurityWeek: www.securityweek.com
Previous in this series: Weekly Security Roundup: October 7 to 14, 2026.