The Red Thread Weekly Wrapup: Issue #28
Friday, October 23, 2026
Categories: IT Risk Management | Information Security | Penetration Testing
From October 16 to October 22, 2026
When I review a patch plan, I look for more than a list of fixes. I want to know what depends on the system, who owns it, and whether anyone can preserve evidence before making a change. This week’s incidents brought those questions together: attackers used access that organizations had already trusted, and some of the evidence needed to understand what happened could disappear quickly.
Last week, I wrote about inventory and ownership. This week showed why those basics matter when access is borrowed through software, appliances, vendors, and contractors. (Issue #27)
PHP2Shell: The Flaw Below the Application
On October 21, PHP disclosed and patched two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Crafted requests can trigger code execution on a web server without authentication. Both flaws sit in PHP itself, before an application script runs, so the application’s login, role checks, and web application firewall do not get a chance to decide whether the request is allowed.
The fixes are in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Branches 7.4 through 8.1 have source backports but no official release, while the PHP project provides no fixes for 5.4 through 7.3. That leaves some organizations without a straightforward upgrade path.
I would not rely on the version string alone. Distributions can backport fixes without changing it; a fixed Ubuntu 24.04 package, for example, may still report PHP 8.3.6. Patching also restarts PHP workers, clearing their memory and live state. Datadog’s lab work found failed attempts could leave memory errors or worker crashes, while a successful attempt might resemble an ordinary HTTP 200. I would identify every PHP application and its owner before treating this as routine maintenance. For prioritizing exposure, I’ve also explained the difference between vulnerability scanning and penetration testing.
BeyondTrust: The Help Desk’s Master Key
CISA added BeyondTrust CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, with an October 19 deadline. An unauthenticated attacker could perform file operations on a Remote Support appliance, including uploading files. BeyondTrust’s BT26-05-RS advisory covers versions 24.3.1 through 26.2.3; older versions need an upgrade first.
The activity attributed by Google’s Threat Intelligence Group and Mandiant to ARMORY CASTLE shows why a patch alone may not be enough. The actor planted a concealed web shell, used tunnelling software, and invoked the appliance’s own bt-secrets utility to access stored credentials. It then deleted logs and used genuine support sessions to reach downstream systems. The Google Threat Intelligence Group write-up describes the investigation.
I would treat a potentially compromised support appliance as a forensic question, not a patching task. Google recommends preserving a snapshot with memory and exporting the disk before changes or a reboot. Only after rebuilding from a clean, patched image would I rotate credentials; changing them while an attacker still controls the appliance could hand over the replacements. This is the kind of work where continuity and practical follow-through matter more than a one-time report.
ConnectWise Cloud Backup: One Secret, 173 Tenants
ConnectWise Cloud Backup has broad access to customer Microsoft 365 data so it can back up mailboxes, files, Teams, and directory information. Huntress reported unauthorized sign-ins across 173 partner and customer tenants using a vendor application credential. The activity came from one address on October 15, moved through tenant identifiers seconds apart, and obtained Microsoft Graph tokens. Huntress’s write-up describes the activity; ConnectWise’s trust advisories provide the vendor’s updates.
App-only access does not look like a person logging in: there may be no user, device, or MFA prompt. The Microsoft Graph activity log must already be enabled to show what the application read. Tokens already issued can remain valid for up to 90 minutes after an app is disabled. I would disable affected applications rather than delete them, audit recently added application credentials, and wait for confirmed resets before re-enabling them.
No customer needed to make a mistake for this exposure to reach their tenant. A vendor’s permissions become part of the customer’s risk. That is especially important in higher education, where a sprawling vendor stack can carry institutional liability.
California Department of Education and ETS: Four Months on One Login
The California Department of Education’s notice says a compromised login was used to access an SFTP site operated by testing contractor ETS at various times from May 22 to September 18. ETS identified the activity on September 25, disabled the account, and took the site offline.
The copied files included student names, addresses, school and grade information, identifiers, disability and Section 504 status, accommodations, program eligibility, and assessment results. Social Security numbers, financial data, and parent information were not involved. ETS has created a new SFTP site and is offering two years of identity protection to affected people.
I see no software flaw in this account. One valid credential was enough to provide quiet access over months, making it difficult to establish the scope afterward. For colleges and universities, the lesson is direct: responsibility for a contractor’s access does not disappear when the system is outside the institution.
Plex2Shell and the Rest of the Patch List
On October 20, CISA added six vulnerabilities to KEV, including four Plex Media Server flaws known together as Plex2Shell. Chained, they can let an unauthenticated attacker run code with the server process’s privileges. Plex fixed them in version 1.43.3.10861, released August 4; technical details followed on October 16, reports of exploitation on October 17, and a proof of concept three days later. CISA’s October 20 alert lists the additions and remediation deadlines.
I would not dismiss a media server as irrelevant to business security. It may run on the same home network as a laptop used to access corporate systems. The same CISA alert included an OS command injection flaw in EG Secure Solutions SiteGuard Server Edition and a search path flaw in Siemens Software Center. A security product can be part of the attack surface, too.
Ivanti has fixed authentication-bypass and code-execution flaws in Connect Secure, but the privilege-escalation flaw used to reach root remains unpatched. A two-month gap between a fix and reported exploitation is time defenders can use, or lose.
The Takeaway
This week, the trusted access came from an application secret, an appliance’s own administrative utility, a contractor’s login, and a web server’s worker memory. None required an attacker to defeat a user’s password at a login screen.
The evidence has a shelf life: patch restarts clear memory, attackers delete appliance logs, and cloud audit records help only if they were enabled in advance. My practical takeaway is to decide before an incident who can revoke vendor access, whether appliance logs are forwarded as they are written, and whether cloud audit sources are already on. Those are decisions no one can make retroactively. If you’re weighing these questions in your own organization, I’m open to comparing notes.
Comments