In 30 seconds
- Critical PHP vulnerability ("php2shell"): Two CVEs (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on any PHP web server. CISA, the UK NCSC, NSA, and Five Eyes partners all issued emergency guidance within 48 hours. Patch immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- SafePay ransomware: A joint CISA, FBI, and international advisory details a ransomware group that has hit at least 600 organisations since 2024, targeting critical infrastructure across four continents. They get in through stolen VPN credentials, Cisco ASA flaws, and Veeam vulnerabilities, then use living-off-the-land tools to move laterally before encrypting and extorting.
- KEV catalogue: CISA added eight new actively exploited vulnerabilities in the week ending 23 October. The pace is not slowing down.
Why it matters
The PHP story is the headline, and it deserves the urgency. PHP runs underneath a significant proportion of the world's web-facing services, from bespoke applications to content management systems, supplier portals, and client-facing platforms. The vulnerability allows unauthenticated remote code execution, which means an attacker does not need credentials, does not need a user to click anything, and does not need to be inside your network. They just need to find an exposed PHP service and send a crafted request.
For regulated Channel Islands organisations, the risk is not theoretical. PHP is embedded in web applications, supplier-managed portals, and internal tools that may not be immediately obvious. The fact that CISA, the UK NCSC, the NSA, Australia's ACSC, Canada's CCCS, and the Netherlands' NCSC-NL all published guidance within days tells you the severity. This is a "patch now, ask questions later" situation.
The SafePay advisory is a reminder that ransomware groups are industrialising. Six hundred victims, living-off-the-land techniques, VPN credential theft, and exploitation of known vulnerabilities in Cisco ASA, Veeam Backup, and SonicWall, all products that sit in the estates of financial services, legal, and government organisations in the islands. The entry points are not exotic. They are unpatched edge devices and weak or stolen VPN credentials.
Questions to ask your team this week
- 1.Do we run any internet-facing services on PHP, including supplier-managed web applications, client portals, or content management systems, and have we confirmed the version and patch status of each?
- 2.For the php2shell CVEs, can we confirm whether we have patched, applied temporary mitigations, or verified that the service is not applicable, and is that decision documented?
- 3.Do we have a current inventory of VPN and remote access products in our estate, and are all of them patched against known exploited vulnerabilities, including the Cisco ASA, Veeam, and SonicWall CVEs referenced in the SafePay advisory?
- 4.If an attacker gained access through a VPN credential today, how quickly would we detect lateral movement using legitimate tools like PsExec, WinRM, or RDP?
One thing to do this week
Run a focused 90-minute "exposure check" across two areas. First, confirm whether any PHP service exists in your estate (including supplier-managed), and if so, validate it is patched or mitigated against php2shell. Second, review your VPN and remote access inventory against the SafePay advisory's entry points (Cisco ASA CVE-2020-3259, CVE-2023-20269; Veeam CVE-2023-27532, CVE-2024-40711; SonicWall CVE-2024-40766). For anything unpatched, escalate immediately and document the decision.
Sources
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (21 October 2026):
cisa.gov - UK NCSC, "Critical security issue affecting PHP":
ncsc.gov.uk - CISA, FBI, and International Partners, "SafePay Ransomware Advisory" (AA26-293A):
cisa.gov - CISA, "CISA Adds Six Known Exploited Vulnerabilities to Catalog" (20 October 2026):
cisa.gov - CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (23 October 2026):
cisa.gov