2 November 2026 · 4 min read
One new KEV addition to act on, PHP patching is still not done, and developer tooling just became a supply chain risk
CISA added new KEV CVEs on 30 October. If you have not patched PHP since last week's php2shell disclosure, the window is closing. A malicious Cursor extension planted SSH backdoors, a reminder that developer tooling is a soft spot.
The Monday Morning Cyber Brief
Every Monday, Baltimore reviews the previous week's most significant cybersecurity events and translates them into plain English. No fear tactics. No jargon. Just what happened, why it matters to regulated businesses in the Channel Islands, and what questions you should be asking your team.
Previous Briefs
php2shell just made every web server a target, and SafePay is the ransomware group you should have heard of by now
Critical PHP vulnerability allows unauthenticated remote code execution on any PHP web server. SafePay ransomware has hit 600 organisations. CISA added eight new actively exploited vulnerabilities to the KEV catalogue.
Your remote support tool just became the fastest way in, and CISA is not waiting for you to catch up
BeyondTrust Remote Support is in CISA's crosshairs. Ivanti Connect Secure is being actively exploited again. Channel Islands cyber security centres are running free awareness events. This week: remote access is the attack surface.
Want to discuss anything from this week's brief?
Join the conversation on LinkedIn