After a researcher recovered the private keys of eight eMudhra intermediate certificate authorities, Chrome will stop trusting the emSign ECC Root CA - G3, expected to reach users on 27 October, and Mozilla has decided the same. eMudhra says it will leave the global SSL/TLS business. The footprint for most UK SMB clients is small, but any site or appliance using an affected certificate will start showing browser errors, and automated renewal will not swap it on its own.
What to do
Check client certificate inventories for emSign or eMudhra issuers.
Replace any certificate chained to emSign ECC Root CA - G3 before 27 October.
Threat researchers report a first PHP2Shell attempt on 17 October, four days before PHP's 21 October fixes, with several proof-of-concept exploits appearing within hours of release. Reports differ on whether any attempts have succeeded, but attempts against both CVE-2026-109618 and CVE-2026-109619 are still being recorded. The attack can leave almost no trace in application logs, with a single memory-limit fatal error in the web server's error log as the main sign. Patching on disclosure day does not prove nothing happened before it.
What to do
Finish patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the distribution fix) and restart workers.
On internet-facing PHP servers, look back to 17 October for memory-limit fatal errors, PHP workers spawning shells or downloading files, and new files in web roots.
Upgrade or take offline any PHP 8.1 or older that is still online.
Railway, a developer cloud platform, detected suspicious activity on the systems that store customer environment variables and says an intruder may have obtained the decrypted contents of some. It has paused deployments and urges all users to rotate every environment variable and secret, including private registry credentials. Clients with in-house developers, agencies or app vendors often keep database passwords, payment and email API keys and cloud credentials on platforms like this, and the MSP may not know they exist.
What to do
Ask clients and their developers whether they use Railway.
If they do, rotate every secret stored there, starting with database, cloud and payment keys.
Arista published Security Advisory 0199 on 22 October for an SQL injection flaw in on-premises VeloCloud Orchestrator, the portal that manages VeloCloud SD-WAN edges. Any authenticated user, down to the lowest read-only customer role, can gain superuser operator privileges, and Arista says the flaw is known to be actively exploited. It is rated 9.9 (CVSS 3.1), and Arista says the orchestrator is exposed by default. SD-WAN is often run by an MSP or carrier for several clients, so one weak customer login could mean control of every site's network configuration.
What to do
Find every on-premises VeloCloud Orchestrator you or your clients run, including carrier-run ones, and upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Until then, restrict the web interface to administrative networks and block and search logs for 74.82.197.86 and 38.54.50.151.
Review recent administrator activity, audit customer and read-only accounts, and check Edge configurations for changes.
If a carrier hosts it, ask for written confirmation of the version.
GitLab's 21 October critical patch release fixes a flaw in its bundled regular-expression engine that, under certain conditions, lets an unauthenticated user run code on self-managed servers. Every release since 7.0 (2014) is affected, and there is no workaround. No exploitation has been reported, and GitLab.com and Dedicated are already fixed. Treat it as urgent for any internet-facing instance you or your clients run.
What to do
Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, internet-facing instances first.
LiteLLM, a popular Python gateway for AI model APIs, says stolen GitHub tokens were used to publish a malicious version 1.107.0. It steals cloud credentials, private keys, browser data and AI tool credentials, and installs a backdoor that runs as soon as Python starts. The package has been quarantined and the Docker images removed. Clients with in-house developers or AI projects are the ones to check.
What to do
Ask clients with developers or AI projects whether LiteLLM 1.107.0 was installed.
If it was, rebuild the machine or container and rotate every cloud, API and model-provider key it could reach.
Microsoft research published on 21 October attributes a supply chain compromise of a third-party cloud backup service to Storm-0940, a China state-aligned group. From 15 October the attackers controlled the service's cloud app identities and used them to sign in to customer tenants with no user sign-in needed, then in some tenants added app credentials and changed identities, groups and privileged roles. Microsoft warns those changes can remain as a backdoor even after the compromised app is fixed. The same technique applies to any multi-tenant app an MSP has consented into client tenants.
What to do
In affected client tenants, review Entra sign-in logs for service principals from 15 October onwards.
Look for new secrets or certificates on app registrations, new consent grants, and changes to directory roles, groups and privileged accounts. Remove anything unexplained and rotate secrets.
Do not assume re-enabling a service removes anything an attacker added.
Inventory every vendor app with standing access to client tenants.
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS v4.0). Both let an attacker without an account run code on the web server, and the flaw sits in the PHP engine itself, so a site with secure code is still exposed. CISA, the NCSC and CERT-FR all advise patching now or taking affected servers offline. PHP sits underneath WordPress, hosting control panels, client portals and the web consoles of many appliances, so most MSPs will have it somewhere in their client estate.
What to do
Inventory every client server, container image and hosting account running PHP, internet-facing first, including appliances that bundle it.
Install the fixed packages from your distribution or host, then restart Apache, PHP-FPM and long-running workers. Updating WordPress does not update PHP.
For PHP 8.1 and older, upgrade, use a vendor backport or take the system offline, as CISA and the NCSC advise.
Watch for PHP worker processes launching shells or downloading tools.
CISA's known exploited vulnerabilities catalogue added six entries on 20 October. They include Plex Media Server CVE-2026-96656 and CVE-2026-96654 (due 23 October) plus CVE-2026-96652 and CVE-2026-96655 (due 3 November), and Siemens Software Center CVE-2026-110936, a DLL sideloading flaw abused in ClickFix attacks. In the Siemens case attackers shipped a genuine signed program next to a malicious file, so allow-listing by signature alone is not enough. Plex often sits on office NAS boxes and home workers' machines.
What to do
Update Plex Media Server to 1.43.3.10861 or later wherever found.
Update Siemens Software Center to 4.0.9.8 or later, and hunt for SiemensSoftwareCenter.exe running from AppData started by msiexec.exe.
Keep blocking Win+R and PowerShell for ordinary users, and tell staff never to paste commands a website asks for.
The FBI, CISA, the UK's National Crime Agency and partners published a joint advisory on SafePay on 20 October. The group gets in by guessing passwords, phishing and exploiting known flaws in common firewall, VPN and backup products, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. Once inside it uses ordinary remote access tools, stops Windows shadow copies and resets backup NAS devices to factory settings before encrypting. That last step is aimed squarely at the recovery plan MSPs sell.
What to do
Confirm every client firewall, VPN and backup server is patched for the listed CVEs, and that backup servers are not reachable from user or VPN networks.
Put backup NAS admin interfaces on a separate management network with unique credentials and MFA, and keep at least one offline or immutable copy.
Alert on new admin accounts, unexpected remote access tool installs and shadow copies being stopped. Load the published STIX IOCs.
TeamUpdraft, maker of the UpdraftPlus WordPress backup plugin, says attackers got into its website over the weekend of 17 to 18 October and believes its customer database, including UpdraftCentral connection keys, was accessed. Those keys can send commands to every connected site, and attackers used them from 18 October to add administrator accounts and backdoor plugins disguised as maintenance tools. Sites fully patched against earlier flaws were still hit, because the commands were signed with valid keys. TeamUpdraft now urges all Premium users to check their sites, even if they never used UpdraftCentral.
What to do
Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later on every client site.
Log in to each site directly, delete UpdraftCentral connection keys, and check for unknown administrators and plugins, including Must-Use plugins.
Change all admin passwords and rotate remote backup storage keys. If anything looks wrong, restore from a backup taken before 17 October.