PHP flaws enter active exploitation as supplier breaches spread across customers

Exploitation began against newly patched critical PHP flaws affecting web-serving installations. Supplier compromises also exposed more than 2,200 ConnectWise tenants and around 40 shipping companies, while compromised certificate-authority keys threatened trust in encrypted connections.

Key developments

PHP patches face active exploitation

PHP maintainers released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws allowing unauthenticated remote code execution, and exploitation subsequently began. The advisory identifies all PHP installations serving web requests as at risk, while researchers warn that assessing exposure and applying effective fixes is not necessarily straightforward.

Attackers can execute code on vulnerable web-serving PHP installations, making effective remediation urgent.

Oct 22–23 · Schneier on Security · Unit 42 · SANS Internet Storm Center

Certificate-authority keys compromised

Eight eMudhra intermediate certificate-authority private keys were compromised, according to Unit 42. The compromise creates risks of unauthorized TLS certificate signing and man-in-the-middle interception.

Unauthorized certificates could let attackers intercept connections that users believe are secure.

Oct 22 · Unit 42

ConnectWise attack reaches thousands of tenants

Microsoft attributed a ConnectWise supply-chain attack to China-linked Storm-0940. The actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

Supplier access combined with automated attack tooling exposed thousands of customer environments through one attack.

Oct 22 · Dark Reading

Shipping companies exposed through IT provider

NonGroup breached a shared IT provider and used that access to reach around 40 maritime and global shipping companies, according to Symantec. Cydome researchers believe the provider was Cyberlogitech, and the group's leak-site demands total more than $1.2 billion.

The provider breach exposed multiple shipping businesses to ransomware threats through their shared IT dependency.

Oct 23 · Risky Business News

Unpatched Tailscale SSH flaws threaten servers

A researcher reported that an attacker controlling one Tailscale device could gain root access to other reachable servers. The attack requires Tailscale SSH port forwarding to be enabled and network access rules allowing the compromised device to connect to its target.

In affected configurations, one compromised device can become a route to root access on additional servers.

Oct 25 · The Hacker News

Also this week

Operational losses

• Hundreds of EU supermarket stores suffered losses totaling millions of euros involving outdated cooling-system firmware that third parties had been responsible for managing. Dark Reading

Attack research

• Microsoft Threat Intelligence detailed how the LiteLLM 1.107.0 compromise used Python startup hooks for credential theft and remote code loading, and provided detections and mitigations. Microsoft Security Blog

• AI-assisted attack reports described a campaign targeting 105 sites using open-weight models and a separate case in which public models gained full domain control for $12. Dark Reading

Coverage and privacy

• Some insurers are developing specialized agentic AI coverage while major carriers are excluding it, potentially leaving enterprises with unrecognized coverage gaps. Dark Reading

• State Bank of India suffered a leak of customer personally identifiable information. Dark Reading

What to watch

• Watch for a fix for the reported Tailscale SSH flaws; release timing has not been announced.