Threat Analysis: PHP2Shell Zero-Day Exploitation and Chinese APT ConnectWise Supply Chain Attack
This is your Daily Threat Analysis for the 22nd of October 2026.
Two items today. Both matter to UK SMBs. One is an actively exploited vulnerability in infrastructure that powers a significant proportion of the web. The other is a supply chain intrusion that could mean Chinese state actors had access to your environment through your own IT provider. Start with the one that has the larger immediate attack window.
PHP2Shell: Active Exploitation Preceded the Patch by Four Days
Two critical remote code execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, were publicly disclosed on the 21st of October 2026. The official line is that patches are now available and organisations should update.
What the official line does not lead with: Amazon Threat Intelligence detected active exploitation attempts in its MadPot honeypot telemetry on the 17th of October 2026, four days before the patches were released. The initial exploit traffic originated from a commercial anonymisation network, which is a detail worth sitting with. This was not opportunistic scanning after a public advisory. Someone was aware of these vulnerabilities during the embargo period and was already testing them against live targets.
By the time patches landed, Cloudflare had recorded millions of exploit attempts. That is not a figure to contextualise as an enterprise concern. PHP underpins the majority of content management systems in active use across UK small businesses, WordPress, WooCommerce, Magento, and the long tail of bespoke PHP applications that small businesses have been running since the mid-2000s and have not fully migrated away from.
What the vulnerabilities actually do
The two flaws exploit different failure modes in how PHP handles memory under pressure. CVE-2026-109618 involves out-of-memory handling corruption: when PHP runs low on memory mid-request, it can interrupt execution while internal request data is only partially initialised. An attacker who can trigger this condition may be able to influence how PHP treats that malformed data. CVE-2026-109619 is a stale global state issue, internal state that belongs to one request can survive after memory is reclaimed, and a subsequent request can inherit it. In both cases, the end result is the same: remote code execution on the server.
If you run any PHP-based web application, this is a straightforward patch-now situation. There is no complex remediation required. The question is whether your hosting provider or web developer has already applied it, or whether you need to chase them.
The pre-patch exploitation window
The NCSC guidance on zero-day vulnerability management is clear that pre-disclosure exploitation fundamentally changes the risk calculation. You cannot rely on the window between a CVE being published and exploitation beginning as a buffer for patching. In this case, that window closed before the CVE existed publicly.
The use of a commercial anonymisation network in the early exploitation attempts suggests this was not a nation-state operation in the traditional sense. It could be a financially motivated actor who obtained the exploit through underground channels, or it could be someone who was involved in the research process and chose to act before disclosure. Either way, the operational implication is the same: if your PHP installation was reachable on the 17th of October and was not patched by the 21st, you have a potential compromise to investigate, not just a patch to apply.
What to do
- Verify your PHP version with your hosting provider or developer. The patched versions were released on the 21st of October 2026.
- If you cannot confirm the patch is applied, treat your web application as potentially compromised and review server logs for anomalous activity from the 17th of October onwards.
- If your site is managed by a third party, ask for written confirmation that the update has been applied and when.
- Web application firewalls will have begun deploying rules for PHP2Shell signatures, but these are a mitigation, not a substitute for patching.
ConnectWise Breach: Chinese State Actors in 2,250 Cloud Tenants
This is the story that will have longer consequences for UK SMBs than the vulnerability above, and it is receiving less attention in the immediate coverage.
Microsoft has confirmed that a Chinese state-linked threat actor exploited a breach of ConnectWise infrastructure to gain access to 2,250 cloud tenants. ConnectWise provides the remote monitoring and management platforms, including ScreenConnect and Automate, that a substantial proportion of UK managed service providers use to deliver their services. These tools give MSPs privileged, persistent access to their clients’ environments. That is the point of them.
The attack used AI agents to conduct the post-breach lateral movement and privilege escalation. According to Microsoft’s reporting, in some environments the attackers achieved privileged access in under three hours. That figure is important. It means that even if an MSP detected the initial ConnectWise breach quickly and began remediation, the window for downstream impact on their clients may have already closed.
Why this matters specifically to UK SMBs
The managed IT services market in the UK is heavily reliant on a small number of remote management platforms. If your business outsources its IT, which most SMBs do, and reasonably so, there is a material probability that your provider uses ConnectWise tooling. That tooling, if compromised at the infrastructure level, gives an attacker the same access your IT provider has: which is typically administrative access to your endpoints, your email, your cloud tenancy, and your backup systems.
The advisory attributes this to a Chinese state actor. What that attribution does not capture is that the techniques employed here, using AI to accelerate lateral movement, operating through trusted third-party tooling, targeting MSPs as a multiplier rather than hitting individual businesses directly, are consistent with a pattern that has been documented across multiple Chinese state-affiliated campaigns since at least 2023. The MSP supply chain has been a target of interest for state actors precisely because a single successful intrusion yields access to dozens or hundreds of downstream businesses. The NCSC has published joint advisories on MSP targeting previously. The fact we are still seeing this at scale tells you how effectively those advisories translated into defensive action.
What to do
- Contact your managed IT provider today. Ask directly: do you use ConnectWise products? If the answer is yes, ask what their incident response to this breach has been, when they were notified, and what steps they have taken to verify the integrity of their ConnectWise installation.
- Ask your provider for evidence, not assurance, that your environment has been reviewed for unauthorised access. Specifically ask about the period from the date ConnectWise became aware of the breach. If they cannot tell you when that was, that is itself a data point.
- If your provider cannot give you a coherent account of what happened and what they did about it, you are entitled to commission an independent review of your environment. That is not a hostile act; it is a proportionate response to a credible supply chain risk.
- Review your own cloud audit logs. Microsoft 365 and Azure both provide sign-in and activity logs. Look for administrative activity you do not recognise, particularly service account creation, role assignments, or access from IP addresses outside your expected geography.
If your IT provider tells you this does not affect you because they are a small MSP with small clients, ask them how many of the 2,250 breached tenants thought the same thing before they showed up on Microsoft’s list.
Also on the Radar Today
GitLab maximum severity RCE. GitLab published patches today for a maximum severity remote code execution vulnerability in its Regular Expression Compiler. If you self-host GitLab, common in UK software and professional services firms running their own development infrastructure, apply this update now. The advisory is a patch-immediately situation with no complex prerequisites.
The Gentlemen ransomware. A Russian-speaking ransomware-as-a-service operation that emerged in mid-2025 has now claimed over 800 victims. Affiliates receive up to 90% of ransom revenue. The group targets Windows, Linux, NAS, and BSD systems and uses a double-extortion model. Relevant for UK SMBs because the high affiliate revenue share attracts a larger pool of operators willing to target smaller organisations. This is not a group that restricts itself to high-value enterprise targets.
The Bottom Line
PHP2Shell needs a patch applied today. The ConnectWise situation needs a phone call made today. Neither of these requires specialist knowledge to initiate. The PHP question is: has my web hosting provider updated PHP? The ConnectWise question is: does my IT provider use it, and what did they do when they found out?
The answers to both questions will tell you more about your actual security posture than any audit.
If today’s Threat Analysis has been useful, follow the show wherever you listen, tomorrow’s briefing lands automatically. And if you know someone who manages IT decisions for a UK business and hasn’t heard of either story today, send this to them. The ConnectWise piece in particular is the kind of thing that should be in front of business owners, not just IT teams.