Threat Analysis : Cyber News for Small Business

Today’s briefing covers three active threats exploiting trusted infrastructure. CISA has added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming in-the-wild exploitation linked to North Korea’s Lazarus Group. The campaign targets government, financial, manufacturing, logistics, and transportation sectors through unauthenticated remote code execution. Arctic Wolf’s analysis of over four hundred incidents documents how Microsoft Teams’ default external chat settings enable sophisticated social engineering attacks, with attackers creating fake IT support tenants to deliver malware or steal credentials. The third story examines the LiteLLM supply chain compromise from 21 October 2026, where a malicious PyPI package distributed stolen-credential payloads through Python startup hooks. All three attacks exploit legitimate systems working as designed rather than traditional vulnerabilities. The episode provides specific configuration guidance for Microsoft 365 Teams external access settings, PHP patching requirements, and credential rotation procedures for organisations potentially affected by the LiteLLM compromise. The common thread is that defence requires active auditing of what is enabled by default, not simply avoiding mistakes.

Today’s briefing covers three evolving threats with material implications for UK small businesses. First, CVE-2026-1096018 and CVE-2026-1096019, collectively known as PHP2Shell, are now confirmed exploited in the wild by threat actors linked to North Korea’s Lazarus Group. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento installations. Unauthenticated remote code execution is possible on unpatched systems, with web shell deployment providing persistent access. Second, a payment card skimming campaign tracked via deepveindrilling.com has compromised 953 Magento stores since July 2025, injecting malicious JavaScript into CMS blocks and using browser fingerprinting to evade automated scanners. Third, UK Biobank’s prolonged offline period following a data breach attempt illustrates the operational reality of incident response timelines, even for well-resourced organisations. The episode provides actionable steps for confirming PHP patch status, auditing Magento CMS blocks manually, and assessing detection capability for personal data breaches under UK GDPR requirements.

Mauven examines three active threats demanding immediate attention from UK small businesses. PHP2Shell vulnerabilities remain widely unpatched despite active exploitation that began days before public disclosure, with automated scanning targeting WordPress, WooCommerce, and Magento installations. New research reveals ransomware affiliates using commercial AI services as operational infrastructure, spending over twenty-three thousand dollars to automate edge device exploitation at scale. Meanwhile, year-end phishing campaigns are already targeting finance and HR staff with fake compensation notices, invoice approvals, and SharePoint lures timed to coincide with Q4 administrative workload. The episode provides specific patching guidance, edge device management questions, and practical phishing defence steps that can be implemented this week. No technical background required, just clear direction on where the exposure sits and what to do about it.

Mauven examines three active threats with direct implications for UK small businesses. First, the RemControl Android banking trojan is spreading through malvertising, targeting over thirty financial institutions across Western Europe by exploiting accessibility services to steal credentials and two-factor codes in real time. Second, a supply chain compromise in LiteLLM version 1.107.0, a widely used Python library for AI development, contains malicious code designed to steal API keys and credentials before application code even executes. Third, the BlackX UEFI bootkit, attributed to Chinese state-sponsored group APT41, bypasses Secure Boot protections and survives operating system reinstalls by operating at firmware level. The episode closes with a timely warning about year-end phishing campaigns that exploit the legitimate administrative activity typical of Q4. Throughout, Mauven identifies the operational gaps between what IT estates are supposed to protect and what they actually cover, with practical guidance on BYOD policies, supply chain verification, and firmware patching.

Two major threats demand immediate attention from UK small businesses today. First, critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were actively exploited four days before patches existed. Amazon’s threat intelligence detected deliberate, pre-disclosure attacks from 17 October, with Cloudflare recording millions of exploit attempts by the time fixes arrived on 21 October. These remote code execution flaws affect the PHP installations powering most UK SMB web infrastructure, including WordPress, WooCommerce and Magento. Second, Microsoft confirms a Chinese state-linked actor exploited ConnectWise infrastructure to access 2,250 cloud tenants. The breach compromised remote monitoring platforms used by UK managed service providers, with attackers achieving privileged access in under three hours using AI-assisted techniques. If your business uses an MSP, there is material probability your provider relies on ConnectWise tooling that grants administrative access to your endpoints, email and backups. Also covered: a maximum severity GitLab remote code execution flaw requiring immediate patching, and The Gentlemen ransomware group surpassing 800 claimed victims. Today’s action items are direct: verify your PHP version was updated after 21 October, and confirm whether your IT provider uses ConnectWise and what incident response they conducted.

Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365 accounts through a sophisticated device code authentication attack that bypasses MFA. By routing through legitimate infrastructure including Google Sites and Cloudflare Workers, the campaign exploits trusted platforms to make malicious traffic indistinguishable from normal business operations. The attack leverages social engineering to trick victims into completing an MFA flow that authenticates the attacker’s session rather than their own. Cisco Talos and Wiz research confirms this is part of a broader pattern of abusing legitimate platforms across more than 25 services. UK small businesses need to verify PHP patching status today, restrict device code authentication in Microsoft 365 tenants through Conditional Access policies, and ensure finance teams understand what device code phishing looks like. Also covered: a reminder on the AOMEI Backupper supply chain compromise affecting updates between April and July 2026.

Three recent incidents expose fundamental gaps in UK business security practice. AOMEI Backupper, backup software deployed across millions of systems, suffered a supply chain compromise between April and July 2026 when attackers tampered with update infrastructure during brief windows, delivering remote access backdoors to users who triggered legitimate update checks. Citrix NetScaler devices face active exploitation of CVE-2026-88771, a critical remote code execution vulnerability with no workaround, as attackers deploy web shells and chain additional vulnerabilities for persistent access. The ICO has issued reprimands to two Welsh organisations following a ransomware breach affecting 3,300 people, predominantly children, after attackers gained entry through a forgotten test account secured with the password Password1. Additional reporting covers the compromise of a Microsoft 365 API credential belonging to ConnectWise Cloud Backup, which enabled automated bulk access across hundreds of customer tenants. The briefing provides actionable guidance for checking AOMEI exposure, confirming NetScaler patch status, auditing dormant accounts, and interrogating MSP access logging. None of these failures required sophisticated attack techniques. All map to existing NCSC guidance that remains unimplemented across UK SMB environments.

On 15 October 2026, a threat actor authenticated to Microsoft Graph API using a compromised ConnectWise Cloud Backup vendor credential, gaining automated access to hundreds of customer Microsoft 365 tenants. Meanwhile, CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and Gateway, continues to be actively exploited with web shell deployment documented in the wild. This episode examines both incidents through the lens of supply-chain risk in managed service provider relationships. Mauven walks through the structural security implications of vendor-level service principals, the exploitation mechanics of the NetScaler vulnerability, and the practical steps UK small businesses should take to audit third-party access to their environments. Also covered: F5’s out-of-band patches for critical NGINX vulnerabilities. This is not theoretical exposure. These are active incidents requiring immediate response from businesses that rely on MSP-managed infrastructure.

On 16 October 2026, three active threat campaigns demand immediate attention from UK small businesses. First, a zero-day vulnerability in BeyondTrust Remote Support appliances (CVE-2026-102764) has been exploited since late August by ARMORY CASTLE, a suspected Chinese state-linked actor, targeting the IT provider supply chain. Second, an AI-orchestrated exploitation campaign against PaperCut print management software is operating automatically across 45-plus countries, representing a fundamental shift in attack velocity and scale. Third, DragonForce ransomware has evolved from opportunistic operation to sophisticated cartel offering white-label services, with affiliates exploiting vulnerabilities including the nearly five-year-old Log4Shell. A supplementary proxyjacking campaign (skynox-7) has compromised at least 143 network edge devices globally. The common thread: known vulnerabilities, unpatched systems, and IT tooling that business owners have never inventoried. All three campaigns are confirmed active, documented by Mandiant, Hunt.io, ReliaQuest, Bitsight, and GreyNoise. This briefing provides actionable guidance for businesses that may be exposed through their IT providers or their own infrastructure, with specific questions to ask and checks to run today.

Three critical security incidents dominate today’s briefing. Ivanti Connect Secure VPN appliances face active exploitation through a three-vulnerability chain granting unauthenticated root access, with particular risk to managed service providers and their client bases. The PEERSTITCH implant campaign reveals how a 2024 FortiManager compromise led to persistent, memory-resident malware on hundreds of FortiGate firewalls, surviving standard detection methods. The Legal Aid Agency breach now confirms exfiltration of nearly 50 years of records, creating direct pretexting risks for legal services firms. Each incident exposes the gap between patching and verification, between logs that appear clean and systems that actually are clean. For small businesses relying on managed IT infrastructure, this episode provides specific questions to ask providers and concrete steps to verify security posture. The NCSC has also published updated guidance on post-quantum cryptography in TLS configurations, signalling the start of a multi-year migration that requires planning rather than crisis response.