Machine against machine: the October 2026 cyber emergencies

Cyber-security risk for businesses worldwide from AI-driven attacks by state-aligned groups, the PHP2Shell vulnerability and the credential breaches at software suppliers, as at 22 October 2026. The recommendations reported here are the published advice of governments, regulators and the software companies themselves.

On 21 October 2026 governments in at least six European countries switched off their own websites. Nobody had attacked them. Details of two critical flaws in PHP, the language behind most websites, had leaked before the fix was out. Switching off was safer than waiting.

The same day Microsoft reported that a China-state aligned group it tracks as Storm-0940 had attacked customers of a software supplier, ConnectWise, using a team of AI agents. In several cases the agents went from first contact to privileged access in under three hours.

The PHP flaws are the most urgent problem for most businesses. Behind them, and behind the break-ins at suppliers, sits a change of speed: cyber-security has become a contest between machines, with states among the players. Most businesses still decide at the speed of a monthly board meeting.

Summary: the October 2026 cyber-security emergencies

This article has two purposes. It explains the most urgent problems of 17 to 22 October and reports what the authorities and vendors advised. It then draws the stories together: attack and defence now run at machine speed, driven by AI agents, with states among the players. It reports guidance from primary sources and attributes each item to its issuer. It does not give advice.

• PHP2Shell is the most urgent fix. Two flaws rated 9.2 out of 10 by the PHP team. The advice is update, or take the site offline.
• Node.js and GitLab also need fixing now. GitLab's flaw is rated 10.0.
• Keys and connections held by suppliers were the second failure. Attackers used a supplier's existing access to customers' Microsoft 365, with no user sign-in.
• Attack now runs at machine speed. A state-aligned group's AI agents reached privileged access in under three hours.
• Defenders have AI too. Whether it keeps pace is not yet known.

Five cyber-security risks from 17 to 22 October, ranked by how badly they bite

1. An un-updated PHP website. Two flaws let a stranger run commands on a web server without a password. WordPress, Drupal and Joomla sites run on PHP. The NSA, the FBI and CISA told organisations that could not update at once to take their systems offline.

2. A supplier's connection an AI agent can use. ConnectWise's application already held permissions inside its customers' Microsoft 365. Microsoft says Storm-0940's agents used them with no user sign-in, then changed privileged roles in some environments.

3. Keys held by someone else. Railway, a hosting platform, said customers' stored secrets may have been decrypted. It asked every customer to change them.

4. A backup an intruder can delete. A joint US, German and UK advisory says the SafePay ransomware group has hit at least 600 critical infrastructure organisations since August 2024. It deletes backups and resets the devices that hold them.

5. A certificate from a failed authority. Lower than it looks for most businesses. eMudhra used eight signing keys so small that one was the number 4. Only sites whose certificates chain to the affected root need to act, before 27 October.

PHP2Shell: why governments took their own websites offline

PHP runs the server side of most websites. Wiz puts it behind about 70% of the internet. The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 by the PHP team. Both can allow remote code execution without a log-in. On 20 October the flaw identifiers were posted on a forum. The PHP team brought its release forward by a day, and exploitation attempts began before the fix was out.

The NSA told organisations to update immediately or take systems offline. Japan's prime minister urged website owners to check whether they ran PHP. Reuters listed public-sector sites taken down in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic, including the Port of Rotterdam. Check Point counted roughly 884,000 internet-facing hosts on PHP 8.1 or older, which the PHP project no longer fixes.

Note. Seven incidents, three kinds of fix. Software flaws close with an update. Stolen keys and supplier connections close only when the keys change. The last needs a new certificate.

Node.js and GitLab: the other urgent software fixes

On 21 October Node.js, which runs the server side of many web applications, fixed ten flaws, four of which the Node.js project classes as high severity. One allows remote code execution; two could let an application trust an impostor server. GitLab, where many firms keep their software code, rated its new flaw 10.0, the highest score there is. It affects every self-managed version from 7.0, which dates from 2014.

Stolen keys and supplier connections

The second kind of failure needs no flaw in a business's own systems. ConnectWise, which sells backup and management services to IT providers, confirmed unauthorised access to its Cloud Backup environment, revoked certificates and suspended three services. Its application already held permissions inside customers' Microsoft 365. Microsoft attributes the attack to Storm-0940, a China-state aligned group using AI agents.

Railway reported on 21 October that an unauthorised party obtained customers' stored environment variables, the settings where applications keep their keys, and decrypted some. It paused all deployments. LiteLLM, an open-source tool that connects applications to AI models, disclosed that stolen developer credentials were used to publish a poisoned version, 1.107.0. Installing it was enough to lose every key on the machine.

PingCAP, which runs the TiDB Cloud database service, disclosed an intruder inside its systems for about a month using stolen service-account credentials. Zeabur, a hosting platform, suffered its second breach in two months. It will shut down by 31 December.

When the proof of a website's identity fails

The padlock in a browser rests on certificate authorities, which sign with keys that should be numbers more than a hundred digits long. eMudhra, an Indian certificate authority whose website says it has issued over 60 million certificates, had eight signing keys below 256, including 4, 66 and 237. Google blocked them in Chrome within hours of the report and found no misuse. Chrome removes the root that signed them on 27 October.

The wider week: further cyber-security incidents

Those were not the only incidents. Signal fixed a flaw, rated 9.3, that could leave a caller's microphone on after hanging up. F5 shipped emergency fixes for three critical NGINX flaws. FoxIO showed that one connection can crash several HTTP/3 server implementations. ReliaQuest reports ransomware groups breaking into networks through a Palo Alto Networks VPN flaw.

Some attacks came through the channels businesses trust to deliver software. AOMEI's backup updates delivered a backdoor in brief windows earlier in the year. OVHcloud's command-line tool briefly carried a program that collects secrets. Stolen UpdraftCentral keys planted backdoors on WordPress sites.

California's Department of Education said a contractor's compromised login exposed data, including disability status, on students from the three previous school years. A Medi-Cal billing vendor reported files on more than 970,000 people. Ahold Delhaize and Bullhorn took systems offline. Reuters reported that one hacker's AI agents, run on an open-source platform called Cairn, broke into more than 100 companies.

What the authorities and vendors advise on cyber-security

This section reports the published guidance; it is not TheRiskAgent's advice. CISA and the UK National Cyber Security Centre both put finding every PHP system first. The PHP Group names the fixed versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NSA, the FBI and CISA advise taking offline what cannot be updated. For ConnectWise's applications, Microsoft advises keeping the connections disabled and reviewing sign-ins from 1 October.

On keys, Railway asks customers to roll every environment variable and API key stored with it. LiteLLM advises anyone who ran version 1.107.0 to rebuild and change every key the machine could reach. The SafePay advisory's authors list multi-factor log-in first among their remedies.

Note. These questions follow from the published guidance reported here. The answers sit with a business's own technology providers.

What are the cyber insurance implications?

This reports the position in the primary sources; the terms of any particular policy decide what it covers. None of the sources reviewed makes cyber insurance compulsory for an ordinary business. The UK National Cyber Security Centre describes what it typically covers: recovery after ransomware or a data breach, business interruption, legal and regulatory help and, often, third-party claims.

Two features of the October events touch a policy directly. Since March 2023 Lloyd's has required standalone cyber policies written by its syndicates to exclude losses from state-backed cyber-attacks that significantly impair a state, with a clause setting out how an attack is attributed. Microsoft attributes the ConnectWise compromise to a state-aligned actor; whether any exclusion applies depends on the policy's wording. And the US Treasury's sanctions office warns that cyber insurers and incident response firms that facilitate ransom payments may themselves risk breaching sanctions, on a strict-liability basis.

The law's reporting clocks run whatever the insurer decides. The UK ICO expects a personal data breach to be reported within 72 hours. Under the EU's NIS2 directive, in-scope entities send an early warning within 24 hours. Singapore allows 30 days to assess a breach, then 3 days to notify the regulator. US-listed companies file within four business days of deciding an incident is material.

Do I need to call a lawyer or a cyber-security expert?

The sources point to a handful of scenarios in which an outside party usually enters the picture. Whether a particular business needs one is its own judgement.

Where personal data may have been reached, through a compromised website or a supplier's connection, the breach-notification clocks above start to run, and privacy lawyers and forensic specialists are typically engaged. Where a listed company faces a possibly material incident, securities lawyers usually advise on the materiality decision. Where a ransom is demanded, sanctions exposure and, in Australia, payment reporting bring in lawyers and incident response firms.

Where a supplier's breach reached the business, as with ConnectWise, Railway, Zeabur or LiteLLM, Microsoft's guidance is to preserve logs and configuration before removing anything, which is forensic work.

A supplier's breach does not pause the customer's duty. In the UK a processor must tell the business it works for without undue delay; that business then has 72 hours from becoming aware to report to the ICO. In Australia a cloud provider and its customer must each assess a breach of records they share. The ICO counts a name and a corporate email address as personal data. It expects every breach, reported or not, to be recorded with the action taken.

Machine against machine: AI agents and the states behind them

These were separate incidents. What ties them together is speed. The PHP flaws were found by AI working for defenders, yet once the details leaked, attack attempts began within hours. LiteLLM, an AI tool, became the entry point. Railway, PingCAP and Zeabur each held keys for thousands of customers, so one break-in exposed them all at once.

The ConnectWise attack shows the attacking side. An AI agent does not just answer questions; it acts. Microsoft describes ARTEX as an open-source framework of several such agents, able to run an attack from reconnaissance to data theft with little human input. It says Storm-0940 used ARTEX from as early as September 2026 against hundreds of organisations. Its agents tried to sign in to more than 2,250 Microsoft 365 tenants, at 2,900 attempts a minute. Actors in several other regions use the same framework.

Defenders run agents too. Calif and Wiz each found the PHP flaws with AI models. Wiz says one researcher did in a week what would previously have taken a world-class team months. OpenAI, whose model was used, warned that the same capabilities can help attackers rapidly develop exploits. No public figure yet shows whether defending agents are keeping pace.

The official outlook points one way. In May 2025 the UK National Cyber Security Centre judged that AI will almost certainly make cyber threats more frequent and intense, cutting the time from disclosure to exploitation further. On 9 October Japan declared a state of emergency in cyberspace. Further out, quantum computing threatens the encryption keys themselves: a NIST draft disallows today's common 112-bit RSA and ECDSA keys after 2035.

What machine-speed cyber-security means for an executive or owner

The decision cycle is now slower than the attack. A board that meets monthly, a supplier that patches weekly and an approval chain that takes days are all slower than an attack that reaches privileged access in under three hours. The authorities' advice to take systems offline assumed someone could make that call at once.

Suppliers' connections are the soft spot. The ConnectWise attack needed no stolen password from any customer: the access had been granted in advance. Microsoft's guidance is to give such applications the least access they need.

Size is no protection. Agents attack hundreds of organisations at once, so trying one more costs the attacker almost nothing. Small firms are reached through the same suppliers as large ones. A business adopting AI agents of its own adds keys to manage: the Five Eyes governments' guidance of May 2026 urges care in adopting agentic AI services.

What the incidents show about cyber-security prevention

The incidents describe what reduced or would have reduced the damage; they do not prescribe for any one business. Organisations without a list of their systems began the PHP emergency by compiling one. Unsupported versions, PHP 8.1 and older and Node.js 18 and 20, received no fix at all. PHP 8.2 reaches end of life on 31 December 2026.

Keys left unchanged were reused. Zeabur's second breach reportedly came through administrator tokens left unchanged after its first. Railway's customers needed a record of every stored key on 21 October. Microsoft's guidance after the ConnectWise compromise is to give connected applications the least access they need and to monitor for new credentials and privilege changes.

Two clocks

The attackers' clock now runs in minutes and hours, driven by agents that do not tire or wait. Most businesses still run on a clock of meetings, tickets and supplier release cycles. The contest between attacking and defending machines will be fought largely by suppliers and states. The decisions that limit the damage remain human: who can act, how fast and on whose authority.

The position is still moving. ConnectWise cannot yet tell customers whether their environments were breached. Railway has yet to name affected customers. Exploitation of the PHP flaws is likely to grow now the fix is public. The concrete test for any business is one question: who can switch off a supplier's connection tonight, without waiting for a meeting?

Drawn from TheRiskAgent's cyber risk report on the events of 17 to 22 October 2026. Figures checked against Microsoft Threat Intelligence, the PHP Group, Node.js, GitLab, LiteLLM and Railway advisories, Google's security blog, UK NCSC and NIST publications, the joint SafePay advisory and named reporting. A summary of fast-moving events as at 22 October 2026. Reference material, not advice.