PHP2Shell Exploited Pre-Patch and ConnectWise Breach Hits 2,250 Tenants

Two major threats demand immediate attention from UK small businesses today. First, critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were actively exploited four days before patches existed. Amazon’s threat intelligence detected deliberate, pre-disclosure attacks from 17 October, with Cloudflare recording millions of exploit attempts by the time fixes arrived on 21 October. These remote code execution flaws affect the PHP installations powering most UK SMB web infrastructure, including WordPress, WooCommerce and Magento. Second, Microsoft confirms a Chinese state-linked actor exploited ConnectWise infrastructure to access 2,250 cloud tenants. The breach compromised remote monitoring platforms used by UK managed service providers, with attackers achieving privileged access in under three hours using AI-assisted techniques. If your business uses an MSP, there is material probability your provider relies on ConnectWise tooling that grants administrative access to your endpoints, email and backups. Also covered: a maximum severity GitLab remote code execution flaw requiring immediate patching, and The Gentlemen ransomware group surpassing 800 claimed victims. Today’s action items are direct: verify your PHP version was updated after 21 October, and confirm whether your IT provider uses ConnectWise and what incident response they conducted.

Chapters

• Introduction Opening briefing for 22 October 2026. Critical PHP vulnerability was exploited four days before patches existed, with millions of subsequent exploit attempts. ConnectWise breach gave Chinese state actors access to 2,250 cloud tenants through MSP infrastructure.
• PHP2Shell: Active Exploitation Preceded the Patch by Four Days Analysis of CVE-2026-109618 and CVE-2026-109619. Amazon detected deliberate pre-disclosure exploitation from 17 October via commercial anonymisation networks. Both vulnerabilities enable remote code execution through memory handling failures in PHP. Cloudflare recorded millions of exploit attempts by patch release. Guidance on verification, patching and log review for systems reachable before 21 October.
• Call to Action Encouragement to follow the show and share with colleagues.
• ConnectWise Breach: Chinese State Actors in 2,250 Cloud Tenants Microsoft reporting confirms Chinese state-linked intrusion through ConnectWise remote monitoring platforms used by UK MSPs. Attackers achieved privileged access in under three hours using AI agents. Explanation of MSP supply chain risk and downstream impact on SMB clients. Guidance on verifying IT provider incident response, requesting evidence of remediation, and reviewing admin activity logs.
• Also on the Radar GitLab patches maximum severity RCE in Regular Expression Compiler. The Gentlemen ransomware group exceeds 800 claimed victims, offering affiliates up to 90% revenue share and targeting Windows, Linux, NAS and BSD systems with double extortion.
• Closing Summary of immediate actions: verify PHP update status with hosting provider or developer, and confirm ConnectWise use and incident response with IT provider. Sign-off and production credits.

Links

• https://aws.amazon.com/security/security-bulletins/
• https://www.ncsc.gov.uk/guidance/zero-day-vulnerability-management
• https://www.microsoft.com/en-us/security/blog/
• https://www.ncsc.gov.uk/collection/supply-chain-security
• https://about.gitlab.com/releases/categories/releases/