Spread the love

6 Cybersecurity Wake-Up Calls Every Business Should Heed

If you run a business, October 2026 has been a useful reminder that cybersecurity is not only a problem for banks and tech giants. In a single week, a core web technology needed an emergency fix, an IT supplier’s breach spilled into thousands of customer companies, and a cloud platform announced it would shut down after attackers used passwords it had left lying around.

None of these stories needs a security degree to understand. Each one comes down to something ordinary: an update not yet applied, a key not changed, a supplier trusted without checking. Here are six real incidents, what happened, and the practical caution each one teaches.

Table of Contents

PHP2Shell: the web’s engine needed an emergency fix

PHP is the language behind a huge share of the web. According to W3Techs figures cited by Tenable, it is used by 69.3% of websites whose server-side language is known, including sites built on WordPress, Drupal, Joomla, Laravel and Magento. Many business portals, booking systems and custom web apps run on it too.

On 21 October 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), nicknamed “PHP2Shell.” Both are rated 9.2 out of 10 under CVSS v4.0 and, under the right conditions, let an attacker with no login run their own code on the server. The US cybersecurity agency CISA urged organisations to patch immediately and said that anyone who cannot update, or who still runs PHP 8.1 or older, should take those systems offline until they can.

Attackers moved fast. Amazon Threat Intelligence, as reported by Tenable, observed an exploitation attempt against its honeypot network on 17 October, four days before public disclosure, and later said PHP2Shell was being broadly exploited in the wild.

“If you run PHP, it is imperative that you update now.”
The PHP Foundation, 21 October 2026

Takeaway: You cannot patch what you do not know you run. PHP often sits quietly inside other software, so keep an up-to-date list of your websites, portals and servers, who maintains each one, and which versions they use. Old, unsupported versions are the biggest risk.

A supplier breach that reached 2,250 companies

Many businesses back up their Microsoft 365 email and files through a third-party service. In October, according to Microsoft researchers cited by TechCrunch, China state-aligned hackers broke into the cloud backup service of IT management company ConnectWise and stole the application credentials that link the service to its customers.

With those credentials, the attackers could sign in to customers’ Microsoft-hosted environments as if they were authorised, and read emails and files. Microsoft said the attackers used AI agents to hit around 2,250 organisations at a rate of almost 3,000 attempted sign-ins per minute. ConnectWise paused access to the backup system while it investigated.

“Little time to detect and respond.”
Microsoft researchers, on the speed of the AI-driven sign-ins, as quoted by TechCrunch

Takeaway: Every tool you connect to your email, ERP or cloud storage holds a key to it. Review which third-party apps have access, remove the ones you no longer use, and ask suppliers how they protect the credentials they hold on your behalf.

Plaintext admin passwords sank a platform

Zeabur, a platform developers use to deploy apps, published a preliminary incident report on 18 October. It said an attacker used leaked internal credentials on 14–15 October to break into its shared cluster, some dedicated servers and internal systems, and eventually read the platform database.

The root cause was painfully simple. Zeabur said long-lived administrator credentials had been stored in plaintext and could be used from the public internet, and that the password changes it made after an earlier breach in August had not covered the credentials used this time. Reporting by The Hacker News put the scale at over 3.2 million environment-variable records and information for 321,810 accounts. Zeabur says it will shut down its services by 31 December 2026.

Takeaway: After any security scare, change every key, not just staff passwords: admin accounts, API keys, server logins and integration tokens. Store secrets in a proper password manager or vault, never in shared documents or code.

Plex2Shell: from published flaw to attack in a day

Plex Media Server is popular software for streaming video and music, and it often ends up on office machines and small servers. On 20 October, CISA added four Plex vulnerabilities, collectively called “Plex2Shell,” to its Known Exploited Vulnerabilities catalogue.

According to a GIRA summary of the disclosures, researchers said the flaws could be chained to run code on exposed servers without valid credentials. Technical details and proof-of-concept code were published on 16 October, and exploitation was seen against a honeypot on 17 October. The observed payloads included a cryptocurrency miner and proxy software.

Takeaway: The gap between a flaw going public and attackers using it can now be a single day. Anything reachable from the internet, even a “harmless” media or test server, needs updates applied quickly, or should be taken off the internet altogether.

When the shop stays open but the website goes dark

Not every cyber incident is a data breach. Retailer Ahold Delhaize, which owns supermarket brands across Europe and the United States, disclosed suspicious activity on 12 October. In a 19 October update, summarised by GIRA, it said the activity was the result of malicious actions by others.

As a precaution, the company took systems offline, including brand websites and apps, affecting most of its brands to varying degrees. Physical stores stayed open. As of that update, the company said it had no evidence that sensitive customer, associate or partner data had been taken, while the investigation continued. It notified the Dutch National Cyber Security Centre within 24 hours.

Takeaway: Plan for the day your systems must be switched off. Know which processes can run manually, how you will take orders and pay suppliers, how fast backups can be restored, and who calls whom in the first hour.

A login check that let strangers in

Laravel is one of the most widely used PHP frameworks for building custom web applications. According to The Hacker News, Laravel has patched a critical flaw (CVE-2026-114509, CVSS 9.2) in its built-in TokenGuard, used to protect APIs.

Under certain MySQL or MariaDB configurations, Laravel said, an attacker could submit a specially crafted value that made the login check match the wrong user, allowing them to authenticate as another existing user without that user’s API token. The fix is in Laravel versions 13.29.0 and 12.68.0.

Takeaway: Custom-built software needs maintenance after launch. If a developer built your portal or app, make sure someone is responsible for updating its frameworks and libraries, not just the server underneath.

What this means for your business

Look again at these six stories and a pattern appears. None required a genius attacker exploiting a flaw nobody could have prevented. Most came down to three things: software that was not updated quickly, credentials that were too powerful or left unprotected, and too much trust placed in suppliers and connected tools.

That is good news for small and mid-sized businesses, because these are things you can control. A short, practical checklist goes a long way:

Keep a list of every website, portal, server and cloud app you use, with versions and owners.
Apply critical security updates within days, starting with anything internet-facing.
Replace or isolate software that no longer receives security updates.
Turn on multi-factor authentication for email, ERP, banking and admin accounts.
Store passwords and API keys in a password manager or vault, never in plain text.
Rotate all keys and admin passwords after any incident or staff departure.
Review third-party apps connected to your email and cloud storage every quarter.
Keep tested, offline or immutable backups, and practise restoring them.
Write a simple incident plan: who to call, what to switch off, how to keep trading.

The bottom line

Attacks are getting faster, and some are now automated with AI. You do not need to match that with a huge security budget, but you do need the basics done consistently: know what you run, keep it updated, guard your keys and check your suppliers.

At SOD Infotech, we build and maintain secure ERP and web systems, keep them updated, and carry out practical security reviews and audits. If you are not sure how exposed your systems are after this month’s alerts, talk to us and we will help you find out.

Sources

BLOG