eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
PHP Warns of Critical RCE Vulnerabilities (PHP2Shell)
Bottom Line: PHP has disclosed two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619), that by some estimates impact 70% of all websites. eSentire has observed exploitation attempts targeting the flaws, increasing the criticality of immediate remediation.
On October 20th, 2026, the PHP Group announced an emergency security release, with technical details and patches scheduled for release on October 21st. The two vulnerabilities, collectively referred to by the security community as “PHP2Shell,” are CVE-2026-109618, a Remote Code Execution (RCE) flaw caused by out-of-memory corruption where request cleanup may treat partially initialized internal data as valid, and CVE-2026-109619, an RCE flaw caused by stale global state, where a later request handled by the same worker process may use state left over from a previous request before it is reset. Both vulnerabilities are unauthenticated and carry a CVSS score of 9.2. Researchers at Wiz reported both issues to the PHP Group in August 2026. Patches were released for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier branches are End-of-Life (EoL) and will not receive an official fix.
Amazon observed an exploitation attempt on October 17th, 2026, four days before the embargoed disclosure, originating from an IP address tied to a commercial anonymization network. Given that the vulnerability was still under embargo at the time, it is unclear how the threat actor obtained exploit details ahead of the public release. Proof-of-Concept (PoC) exploits began appearing publicly on October 21st; the lack of widespread successful exploitation suggests that early PoC code was ineffective.
Cloudflare reported that exploitation attempts rose from the tens of thousands to the millions by October 22nd, and watchTowr recorded exploitation activity in its own honeypot infrastructure beginning October 21st. Observed activity included attempts to install a Mirai botnet variant, reported by Sophos, while other researchers reported widespread scanning and probing without confirmed successful code execution, suggesting a reliable exploit chain may be difficult to achieve. eSentire has observed multiple exploitation attempts but has not identified successful attacks at the time of writing.
On October 23rd, 2026, two days after the PHP2Shell patches were released, the PHP Group published an informational advisory for CVE-2026-115560, a separate RCE issue in PHP’s session upload progress handling. Unlike PHP2Shell, this flaw only affects applications that set session.serialize_handler to php_binary or php_serialize in configuration and then change it to php at runtime using ini_set() before calling session_start(), with session upload progress still enabled. Security patches have not been released at the time of writing, but the PHP Group has disclosed alternative mitigations.
eSentire Threat Intelligence Analysis:
PHP’s pervasiveness across the Internet is central to why these vulnerabilities carry such severe real-world impact. As watchTowr notes, “every PHP installation that serves web requests is in scope,” and enterprise networks “commonly run PHP-based content management systems and internal tools”. This broad, often business-critical, footprint is precisely what makes PHP an attractive target. A single unauthenticated, critical-severity flaw in the language runtime itself does not need to target a specific application, it is inherited by every website, Content Management System (CMS), and internal tool built on an affected PHP version. That scale is reflected in how quickly exploitation escalated once details became available, rising from isolated attempts to millions of attempts within roughly a day, per Cloudflare.
Given PHP’s broad footprint and the speed at which exploitation scaled, organizations should treat this as an urgent, Internet-facing risk rather than a routine patch cycle item. Client recommendations include inventorying all PHP installations across the environment, including web servers, vendor appliances, Windows software bundling php.exe or php-cgi.exe, control panels, and CMS platforms, using identification guidance published by VirusTotal and the Dutch National Cyber Security Centre (NCSC-NL). Patches should be applied immediately wherever available; where immediate patching is not feasible, PHP’s temporary mitigation of disabling session upload progress handling should be applied as an interim control. EoL PHP instances, that will not receive an official patch, should be isolated and replaced with maintained versions.
CVE-2026-115560 appears to be less concerning than the previous two vulnerabilities. The PHP Group assesses that exploitation of this flaw is less likely, due to the requirement for a non-standard configuration. Until security patches are released, organizations should still apply the temporary mitigation, out of an abundance of caution.
In response to the disclosure of PHP2Shell, eSentire released two advisories on October 21st, to capture the emerging details. The Threat Response Unit (TRU) conducted threat hunts across the customer base, and created new detections for eSentire MDR of Network and Endpoint. Additionally, eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to both CVE-2026-109618 and CVE-2026-109619.
ConnectWise Suspends Cloud Backup Services
Bottom Line: Threat actors leveraged compromised credentials tied to ConnectWise Cloud Backup to access customer Microsoft 365 environments, creating a potential pathway for data theft, email access, and privilege escalation.
On October 16th, 2026, ConnectWise disclosed that they were investigating “unauthorized access attempts” associated with the ConnectWise Cloud Backup environment, formerly known as SkyKick. In an update on October 17th, ConnectWise stated that they disabled seven ConnectWise application IDs while their investigation was ongoing, including Cloud Backup, which would “interrupt backup services for customers”. ConnectWise suggested that customers review their Microsoft 365 tenants to verify that the associated application IDs are disabled and perform an audit of relevant logs to identify any suspicious authentications and activities.
Security researchers provided additional context on the ongoing activity, confirming that a threat actor had compromised the vendor credentials associated with the impacted applications, and was leveraging them to access customer Microsoft 365 environments. As ConnectWise Cloud Backup, and other impacted applications, are associated with cloud-based backup and recovery services, the applications would be granted broad access to mailboxes, OneDrive, SharePoint, Microsoft Teams, files, and directory data. An attacker with valid tokens to these applications could perform data exfiltration or deletion.
Further updates from ConnectWise attributed the attacks to a China-aligned threat actor, based on intelligence shared by Microsoft, who was able to leverage an agentic AI framework to “automate and speed up its operation”. As of October 23rd, ConnectWise has stated that the impacted applications remain disabled, confirming that their investigation is ongoing, but that restoration testing and security validation should be done “by the end of this weekend” (October 25th).
eSentire Threat Intelligence Analysis:
In a breakdown of observed attacks, researchers identified that the threat actor moved through tenants “in sorted GUID order” a few seconds apart, suggesting that activity involved a script working through a target list. A targeted wave of unsuccessful attacks was also identified, specifically against tenants in the policy, national security, trade, and critical mineral sectors. The attempts failed due to tenants not leveraging the impacted ConnectWise products. These details are notable, following attribution of the attack by ConnectWise and Microsoft to a threat actor linked to the People’s Republic of China (PRC). Microsoft states that the attacker (Storm-0940) leveraged the AI framework ARTEX to conduct the attacks, lining up with the possible automation that was identified. The link to a state-sponsored group is also notable, based on observed failed attempts against industries that may be seen as high value targets for geo-political interests.
This attack also highlights the relationship between Managed Service Providers (MSPs) and supply chain attacks, where one single compromise can have cascading impacts against downstream customers. Examples of these types of attacks include the Kaseya VSA attack in 2021 used to deploy ransomware, the 3CX compromise in 2023 used to deploy malware, and TeamPCP’s attacks against the open-source development community in 2026. Each of these instances demonstrates how threat actors abuse implicit trust relationships to further realize their objectives. Given the success rates and high impact of these attacks, MSPs and other vendors will continue to be targeted by threat actors in the future, with a likely objective of conducting similar supply chain attacks.
ConnectWise identified seven compromised application IDs and disabled them. Organizations that utilize ConnectWise services within their environment should verify that these applications are disabled, and follow further guidance provided by ConnectWise before being re-enabled. eSentire's Threat Response Unit (TRU) conducted threat hunts for known Indicators of Compromise (IoCs), and any impacted customers were notified by the eSentire SOC. eSentire published an advisory for this attack on October 19th and is continuing to track this topic for additional information and detection opportunities.
AI-driven, Large-Scale Nation-State Campaign
Bottom Line: Since September 2026, a Chinese associated threat actor, Storm-0940, used the open-source agentic Artificial Intelligence (AI) framework ARTEX to automate attacks targeting hundreds of organizations globally.
On October 21st, 2026, Microsoft disclosed a large-scale cyber espionage campaign conducted by Storm-0940, a China-aligned threat actor that leveraged the autonomous AI-enabled penetration testing framework ARTEX to automate attacks against organizations worldwide. The activity targeted organizations across numerous sectors, including aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profits.
ARTEX is an open-source penetration testing framework built around multiple Large Language Model (LLM) agents capable of autonomously conducting penetration testing operations. The agents accumulate discovered assets and vulnerabilities into a graph structure, allowing the framework to autonomously identify and execute attack paths.
Between October 10th and 14th, 2026, the threat actor executed an automated password-spraying campaign. During this operation, the actor targeted 327 accounts across eight organizations and generated more than 151,000 failed authentication attempts. Activity peaked on October 11th, reaching approximately 2,900 failed authentications per minute and generating more than 111,000 failed logon attempts in a single day.
On October 15th, public reports began surfacing of a compromise affecting ConnectWise’s Cloud Backup application, with indicators matching the same IP network range. ConnectWise published an initial advisory on October 16th confirming one of its own identified IPs matched exactly.
After obtaining control of multiple ConnectWise cloud application identities, Storm-0940’s AI agents used the same infrastructure to authenticate into downstream customer environments. Using this access, the agents conducted reconnaissance, modified application credentials to establish persistence, and attempted to alter identity, group, and privileged role assignments.
eSentire Threat Intelligence Analysis:
Reporting throughout 2026 has highlighted a growing trend of threat actors integrating artificial intelligence and autonomous agents into offensive cyber operations. Multiple organizations have documented adversaries using AI-enabled frameworks to automate reconnaissance, vulnerability identification, credential attacks, post-compromise activities, and even ransomware operations. Examples include TeamFiltration’s large-scale automated password spraying against Microsoft 365 environments, the JADEPUFFER ransomware operation’s use of autonomous agents to identify and extort databases, and Anthropic’s reporting on increasing malicious use of frontier AI models by state-sponsored and financially motivated actors. Additionally, Unit 42’s documented an AI-enabled espionage campaign targeting Linux infrastructure, while Cisco Talos’ reported on UAT-10147 integrating agentic AI into post-compromise operations. Collectively, these incidents demonstrate that threat actors are increasingly leveraging AI not to develop entirely new attack techniques, but to automate existing tradecraft at greater speed, scale, and consistency.
The activity attributed to Storm-0940 represents one of the most significant examples of state actors operationalizing agentic AI within a real-world supply chain compromise. Zscaler ThreatLabz released similar research highlighting the use of the AI-powered ARTEX framework by threat actors to automate large-scale cyberattacks and data theft operations across global targets. While the underlying techniques remain consistent with previously observed cloud-focused espionage activity, the integration of autonomous AI agents enabled the actor to reduce the time from initial targeting to privileged access to less than three hours in some instances.
In order to reduce such risks, organizations should immediately review all environments where affected ConnectWise applications are currently deployed or were previously authorized. Security teams should investigate service principal sign-in logs beginning on October 15th, 2026, and review Microsoft Entra audit logs for evidence of credential additions, new application registrations, privilege assignments, consent grants, and modifications to authentication configurations. Organizations should also inspect Microsoft Graph activity for signs of reconnaissance, directory enumeration, credential manipulation, and privilege escalation.
For additional details regarding the ConnectWise cloud backup application compromise, associated indicators of compromise, and recommended response actions, please refer to the eSentire Threat Response Unit (TRU) advisory published on October 19th, 2026.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
