// day
Oct 17, 2026
2 new incidents, 1 with updates.
## started
- criticallivepartial fixsince Oct 17, 2026
ConnectWise Cloud Backup shut down after M365 app-identity hijack
› ConnectWise Cloud Backup / Microsoft 365 app identity
ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.
- criticallivepartial fixsince Oct 17, 2026
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
CVE-2026-109618CVE-2026-109619
