Patch PHP today, then assume someone was already inside. That is the honest summary of this week for any security leader.
On October 21st, 2026, the PHP project shipped emergency fixes for two critical remote code execution flaws now known as PHP2Shell. In the same ten days, Chrome, Node.js and GitLab shipped critical fixes, and a backup vendor’s stolen credential opened a path into Microsoft 365 tenants. Together they show why a patch-only strategy leaves a gap that only detection can close.
PHP2Shell: what happened
Two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 (CVSS v4.0), allow an unauthenticated attacker to run code on a web server with the PHP worker’s privileges. One corrupts memory during out-of-memory handling; the other allows freed request state to leak into the next request on the same worker (Google Cloud).
The scope is unusually wide. Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (Help Net Security). Google puts the vulnerable range at PHP 5.4 through 8.5.11. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA has urged immediate patching.
The timeline is what should worry a CISO. The CVE identifiers leaked on Hacker News on October 20th, a day before the coordinated release (Infosecurity Magazine). Amazon Threat Intelligence reported exploitation attempts starting October 17th, four days before public disclosure. A team that patched within hours of the release had already been exposed for days.
PHP is not just your website. It also sits inside appliances, admin portals, ticketing tools and vendor products; Cisco, for example, has already published an advisory for its own affected products.
The rest of the wave
PHP was the headline, but four other issues landed in the same fortnight, and they hit very different layers of the stack.
The ConnectWise case deserves a second look. The attacker authenticated as a trusted service principal, so MFA never came into play. In at least one tenant, they added new secrets to other apps to keep access after the original credential was reset (Rescana). Disabling the backup app alone does not close that door.
The CISO lens: patching closes the door, detection covers the window
Every item above has the same uncomfortable property: the exposure started before your team could act. PHP2Shell was probed four days before the fix. The ConnectWise credential worked against tenants that had done nothing wrong. Patching is still step one, but it only tells you the door is shut now, not whether someone walked through it last week.
Three questions matter more than “Are we patched?” this week:
- Where do we actually run this? PHP and Node.js hide in vendor appliances, internal tools and containers that no asset list fully covers. Expect to find instances you did not know you owned.
- What would exploitation look like after the fact? A compromised web worker or build server rarely stays quiet. It reaches out to download tooling, opens command-and-control channels, scans neighbours and moves data.
- Can we see it if it happened? Most of that traffic is encrypted, and much of it moves east-west inside the network, where perimeter tools and log-only approaches see little.
That third question is where a board conversation should land. “We patched in 24 hours” is good. “We patched in 24 hours and verified no server behaved abnormally during the exposure window” is the answer that actually reduces risk.
Where Exeon.NDR fits
Exeon.NDR watches for exactly the behaviour that follows a successful exploit, whichever CVE caused it. It analyses network metadata such as NetFlow, IPFIX and firewall logs rather than packet captures, so it works on encrypted traffic and needs no sensors or traffic mirroring.
For a week like this one, that maps to concrete signals:
- PHP and Node.js servers: a web server that suddenly opens outbound connections, contacts a new external host, or starts talking to internal systems it never touched before. These are classic signs of a reverse shell, a tool download or lateral movement, and they look the same regardless of which flaw opened the door.
- GitLab and build infrastructure: a CI/CD server is a high-value pivot point. Unusual connections from it to production, to secrets stores or to the internet stand out against its normal baseline.
- Retrospective hunting: because metadata is lightweight, it can be retained long enough to look back. Teams can review the October 17-21 window for PHP hosts that behaved unusually before the patch landed.
- Encrypted channels: attackers use TLS too. Metadata-based detection spots beaconing patterns and odd destinations without needing to decrypt anything.
Where Exeon.UEBA fits: identities
NDR sees the network; Exeon.UEBA sees identities. The ConnectWise attacker never exploited a bug: they signed in as a trusted app with a valid credential, which no patch or MFA prompt would stop.
Exeon.UEBA analyses log data from user and admin identities, enterprise applications, APIs, service accounts and IAM platforms, including Microsoft Entra ID, and flags accounts that act out of character. For a week like this one, that maps to two signals:
- Service accounts and app identities: a backup or integration account that starts reading data it never touched, gains new privileges, or creates new credentials — exactly the pattern seen in the ConnectWise tenants. Because Exeon.UEBA ingests Entra ID logs, a service principal behaving this way surfaces as it happens, not weeks later in a manual log review.
- Credentials stolen after a server compromise: attackers who land on a PHP or GitLab server usually harvest secrets and reuse them. UEBA flags those accounts when they sign in from new places or reach systems they never used before.
Together, NDR and UEBA cover both halves of this week: servers that behave abnormally after an exploit, and identities that behave abnormally after a credential theft.
Where Exeon.AgentGuard fits: the next trusted identity
The ConnectWise lesson reaches beyond backup tools. AI agents are the newest non-human identities with broad, standing access: they read files, call APIs and act through connected tools under valid permissions. A hijacked agent, or one fed hidden instructions in a document, looks just like the backup app did: legitimate access doing illegitimate things.
Exeon.AgentGuard monitors that layer. It learns which tools, MCP servers, resources and folders each agent normally uses, and flags meaningful changes, such as an agent suddenly calling an unfamiliar MCP server. Adaptable Sigma rules catch credentials and sensitive data in outgoing prompts and files, and AgentGuard surfaces unusual transfer volumes to external destinations. It connects through a web proxy (ICAP) or an AI gateway, and pseudonymises data locally before analysis.
None of this week’s CVEs involved an AI agent. But teams wiring agents into GitLab, CI/CD pipelines or Microsoft 365 are building the next ConnectWise-style trust relationship today. Watching it from day one is cheaper than reconstructing it after an incident.
Your checklist for the next 72 hours
- Inventory and patch every PHP runtime, including those inside vendor appliances; ask vendors for their PHP2Shell status in writing.
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4, and self-managed GitLab to 19.2.8, 19.3.5 or 19.4.2 (or later).
- Push Chrome 156 and confirm browsers have actually restarted.
- In Entra ID, review every third-party app with consented permissions, remove what is unused, and check for client secrets added since mid-October.
- Hunt back to October 17th: look for PHP, Node.js and GitLab hosts that made new outbound or lateral connections.
- Check service accounts and app identities for unusual sign-ins, new privileges or new credentials since mid-October.
- Briefly update leadership on two answers: time to patch, and whether any anomaly was found in the exposure window.
- List the AI agents and MCP servers in use and what each can reach; treat them like any other privileged service account.
The pace of disclosure is not slowing, and AI-assisted research is already showing up in vendor credits, as seen in the credits of Chrome’s recent releases. Organisations that pair fast patching with continuous visibility across networks, identities and AI agents will treat the next PHP2Shell as an operational task, not a crisis. If you want to see what your network looked like during this window, talk to the Exeon team.
Sources:
