# MSP Threat Briefing: October 25, 2026

_October 25, 2026 · LNX Inc._

ConnectWise Cloud Backup compromise, PHP2Shell patches, a Microsoft 365 token replay campaign, GlobalProtect ransomware, Fortinet fixes and an Entra deadline.

This week was about trust that attackers borrowed. A stolen vendor credential walked into hundreds of Microsoft 365 tenants without a single user signing in. Two critical PHP flaws landed with exploitation already under way, and the NAS vendors are still catching up. Here is what to do first.

1. Disable the ConnectWise Cloud Backup and Cloud Management apps in every tenant you manage, then hunt for added roles and secrets.
2. Patch every internet-facing PHP install to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and update Synology and QNAP NAS units.
3. Hunt Entra sign-in logs for token replay from hosting networks and for rogue `DESKTOP-` devices.
4. Confirm every PAN-OS firewall with GlobalProtect is on a fixed build; ransomware crews are using the May flaw now.
5. Upgrade FortiOS, FortiManager and FortiAnalyzer to the October 22 builds before the CVEs go public on November 10.
6. Update any Plex Media Server you can find to 1.43.3.10861 or later, and treat older exposed servers as compromised.
7. Check SSPR registration coverage before Entra enforces registered methods in early November.

## 1. ConnectWise Cloud Backup credentials used to enter Microsoft 365 tenants

A credential for ConnectWise Cloud Backup, the product formerly called SkyKick, was used to sign in to customer Microsoft 365 tenants as the application itself. ConnectWise published its advisory on October 16, revoked certificates and disabled seven application identities on October 17, and suspended Cloud Backup, SaaS Security and Cloud Management ([ConnectWise advisory](https://www.connectwise.com/company/trust/advisories)). Phased restoration began on October 21. As of the October 25 update, partner onboarding is targeted for October 26, with restore access first and full re-enrollment after.

[Huntress](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) saw the first sign-ins on October 15 from `144.172.64[.]128`. By its October 17 update it counted almost 1,000 Entra tenants with sign-in activity from that address and more than 300 successful sign-ins. In about 50 tenants, Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator. In one tenant the Teams app made itself Global Administrator and then added client secrets to two other applications, set to expire in 2028.

[Microsoft](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) attributed the campaign on October 21 to Storm-0940, a China state-aligned group, and said it used an open-source agentic AI penetration testing framework to automate the work. Microsoft counted sign-in attempts against more than 2,250 tenants and saw privileged access gained in under three hours in several cases.

**Who is exposed.** Any tenant where these apps were ever consented, including dormant SkyKick connections from years ago. User MFA and user Conditional Access were never in the path, because the attacker authenticated as the app.

**What to do.**

- In Entra, open Enterprise applications, find each app by application ID, and set "Enabled for users to sign-in" to No. Do not delete them; deleting destroys evidence and consent.
- Review directory role assignments and remove roles the apps granted themselves, especially Global Administrator and Privileged Authentication Administrator.
- Review client secrets and certificates on every app registration and enterprise app. Remove any added since October 13 that you did not create, including on your security tooling's apps.
- Check the service principal sign-ins tab, not user sign-ins, filtered by the Cloud Backup app ID, for the window October 15 01:00 UTC to October 16 02:00 UTC and beyond.
- Audit for "Add member to role", "Update application" and "Add service principal credentials" events initiated by ConnectWise or SkyKick apps.
- Keep the apps disabled until ConnectWise sends restoration instructions for your service.

| Indicator | Value |
|---|---|
| Primary attacker IP | `144.172.64[.]128` |
| Password spray IPs | `144.172.64[.]99`, `144.172.64[.]60` |
| Cloud Backup app ID | `506e08f9-6e9a-4da4-942b-a099a03644ae` |
| Cloud Management app ID | `2399d300-6fca-4e6a-a686-399fefe75b83` |
| Cloud Management - MS Teams | `24205314-2b89-4e07-a2a4-579e898a5640` |
| Cloud Management - Exchange Online | `b78f6a77-d4e5-46fb-87e5-d1648bd02519` |
| Cloud Management - MS Graph | `0de14c77-b9b0-4137-9360-34878a929827` |
| Cloud Management - Partner Center | `412dcf96-176d-4b3a-a1b0-4981ad66971e` |
| Cloud Management - SharePoint Online | `b2b55f5b-7758-4719-8d8f-88ae172e6bdb` |
| User agents seen on changes | `Python-urllib/3.12`, `python-requests/2.31`, `curl/7.88.1` |

## 2. PHP2Shell: two critical PHP remote code execution flaws, exploited

The PHP project released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 ([php.net advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). Both can give unauthenticated remote code execution against PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where a demonstrated exploit fires before any application code runs. Details leaked a day early, so the release was pulled forward.

[watchTowr](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/) reports seeing exploitation of both flaws in its honeypots on October 21. [Huntress](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) had not seen exploitation across its partner base as of the afternoon of October 21 but says Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla. Neither CVE was in the CISA catalog as of October 23.

On October 23 PHP added an [informational advisory](https://www.php.net/archive/2026.php#2026-10-23-1) for a third issue, CVE-2026-115560, with no patch yet. It needs an unusual serialize-handler configuration, and the mitigation is the same session upload progress setting.

**Who is exposed.** Every client with a PHP web server: WordPress and other CMS sites, cPanel and Plesk hosts, intranet apps, and the PHP bundled inside appliances. NAS units matter most for MSPs. [Synology](https://www.synology.com/en-global/security/advisory/Synology_SA_26_14) shipped fixes on October 22 for its PHP packages, Calendar and Mail Station. [QNAP](https://www.qnap.com/en/security-advisory/qsa-26-18) released fixed QTS, QuTS hero and QuTScloud builds on October 24, but Note Station 3, QVR Surveillance on ARM32, QNE and TVR OS are still waiting.

**What to do.**

- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official release; use your distribution's backport or PHP's minimal source backports for 7.4, 8.0 and 8.1.
- Where you cannot patch today, set `session.upload_progress.enabled=0` in php.ini or the FPM pool, and restart all workers. Do not rely on `ini_set()` or `.user.ini`.
- Cap request size: `post_max_size` of 8M, or 32M where uploads are needed, with `upload_max_filesize` lower.
- Update Synology packages through Package Center and QNAP firmware through Live Update. Keep QNAP units off the internet until the remaining apps are fixed.
- Hunt for PHP workers spawning `sh`, `bash`, `curl`, `wget`, `python` or `nc`, new files in web roots, and unexpected cron jobs. Start the review at October 17, not the patch date.
- PHP 8.2 reaches end of life on December 31, 2026. Plan the move now.

## 3. Token replay campaign against Microsoft 365, with detections

[Huntress](https://www.huntress.com/blog/token-replay-spray) published a ten-week campaign on October 22 that combined adversary-in-the-middle phishing with token replay at volume. Between July 14 and September 22, 2026 it counted at least 497 successful sign-ins across 79 victim organizations, plus more than 200,000 failed attempts. Stolen sessions were replayed from hosting provider 1337 Services GmbH. The attacker registered at least 48 rogue Entra devices, and in 19 organizations wiped existing MFA methods and registered a new authenticator within three hours of the first sign-in.

**Who is exposed.** Any tenant where Conditional Access has exceptions, and any tenant that still allows device code flow. MFA alone did not stop it, because the session was captured after MFA.

**What to do.**

- Require MFA or block for all users, all cloud apps and all client app types, with no exclusions.
- Block device code flow with an authentication flows Conditional Access policy.
- On suspected replay, revoke sessions and reset the password. A reset alone leaves tokens, rogue devices and attacker MFA methods in place.
- Audit Entra devices named `DESKTOP-` plus eight hex characters, especially those registered from hosting IPs.
- Audit MFA method changes for a clear followed by quick re-registration.
- Review inbox rules with punctuation-only names or that move mail to RSS Feeds or Conversation History.
- Treat error `53003 BlockedByConditionalAccess` as proof of a valid credential, since the block happens after authentication succeeds.

| Indicator | Value |
|---|---|
| Replay hosts (AS210558) | `193.26.115[.]221`, `193.26.115[.]199`, `193.26.115[.]16`, `193.26.115[.]21`, `193.26.115[.]72`, `193.26.115[.]210` |
| Other replay addresses | `124.198.132[.]33`, `45.83.31[.]44`, `192.159.99[.]172` |
| AiTM relays | `185.238.2[.]195`, `2400:8d60:2::1:841d:5dd` |
| Mailbox action host | `167.148.41[.]96` |
| Client app IDs | `d3590ed6-52b3-4102-aeff-aad2292ab01c` (Microsoft Office), `29d9ed98-a469-4536-ade2-f981bc1d605e` (Authentication Broker), `4765445b-32c6-49b0-83e6-1d93765276ca` (OfficeHome) |
| User agents | `node`, bare `Mozilla/5.0` |
| Device name pattern | `DESKTOP-54521F46`, `DESKTOP-BAF88EF4`, `DESKTOP-CA85907C` |
| Inbox rule names | `.`, `sss`, `ss`, `iT`, `,.`, `........`, `s`, `d` |

## 4. Ransomware crews are using the May GlobalProtect bypass

Palo Alto Networks fixed CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway, in May 2026 ([advisory](https://security.paloaltonetworks.com/CVE-2026-0257)). On October 19, [Unit 42](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) updated its threat brief to say ransomware operators, including Qilin and Inc, are exploiting it against unpatched firewalls. The flaw lets an unauthenticated attacker establish a VPN session, bypassing MFA.

Observed follow-on activity includes reconnaissance with dual-use RMM tools, lateral movement over RDP and SMB, and a pivot from the VPN gateway to vCenter to dump credentials from a domain controller's virtual disk, which avoids in-guest EDR.

**Who is exposed.** Any client with a PAN-OS firewall running GlobalProtect on a build older than the fixed releases. Cloud NGFW and Panorama are not affected.

**What to do.**

- Upgrade to a fixed build: 10.2.18-h6, 11.1.15, 11.2.12, 12.1.7 or the listed hotfixes for your branch.
- Until then, disable the Authentication Override cookie options on the portal and gateway, or use a dedicated certificate for them.
- Hunt GlobalProtect logs for the IPs below and for client host names `WINDOWS-LAPTOP-001`, `DESKTOP-GP01` and `GP-CLIENT`. Treat a successful gateway connection from any of them as an incident.
- Confirm the management interface is not reachable from outside on ports 4443 and 3879.

| Indicator | Value |
|---|---|
| Source IPs | `23.128.228[.]6`, `104.207.144[.]154`, `146.19.216[.]119`, `146.19.216[.]120`, `146.19.216[.]125`, `179.43.172[.]213`, `185.195.232[.]139`, `198.12.106[.]60`, `202.144.192[.]47` |
| Client MACs | `aa:bb:cc:dd:ee:ff`, `00:11:22:33:44:55` |

## 5. Fortinet shipped critical fixes before telling anyone what they fix

Fortinet announced a security hardening release on October 21 and shipped the builds on October 22 ([Fortinet announcement](https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products)). It says the release contains critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer. CVE IDs and advisories will be published on November 10. Fortinet does not report exploitation, but it warns that patch diffing can expose unpatched devices before then.

**Who is exposed.** Every FortiGate client, which for most MSPs is most of them. FortiMail and FortiAuthenticator fixes were released earlier.

**What to do.**

- FortiOS: 8.0.2, 7.6.8, 7.4.13 or 7.2.14. FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12 or 7.2.13. Note the management products are one build number behind FortiOS on the 7.4 and 7.2 branches.
- FortiOS 7.0 is not in the table. Plan a branch upgrade for anything still on it.
- Patch internet-facing units first and back up configurations before upgrading.
- If you cannot patch yet, restrict HTTPS and SSH admin access to trusted IPs or disable it on external interfaces, and keep FortiManager off the internet.

## 6. Plex Media Server chain is being exploited for miners and proxies

CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on October 20 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)). Plex's [security notice](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319), updated October 19, says CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 chain into unauthenticated remote code execution. Plex reports active and widespread exploitation, with compromised servers running cryptocurrency miners and proxy software. A public proof of concept appeared on October 16.

**Who is exposed.** Plex turns up on small-office NAS units, staff machines and the odd server a client set up for the break room. If it forwards port 32400 and is older than 1.43.3.10861, assume it is compromised.

**What to do.**

- Update to 1.43.3.10861 or later. The version string "1.43.3" is not enough; build 1.43.3.10828 is vulnerable.
- Look for unexpected child processes of Plex Media Server, unfamiliar `.so` or `.dll` files in the Codecs folder, outbound connections to `proxystream.st`, and sustained CPU with nothing playing.
- If you find anything, reinstall from a clean data directory, sign out all devices and change the Plex password. Treat shares and credentials the Plex account could reach as exposed.
- Disable Remote Access if nobody needs it.

## 7. Entra SSPR will reject unregistered phone numbers from early November

Microsoft message center notice MC1325414 says self-service password reset will accept only explicitly registered authentication methods ([Microsoft Entra blog](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-security-updates-what-organizations-need-to-do-now/4522024); [notice mirror](https://mc.merill.net/message/MC1325414)). Mobile, office phone and alternate email pulled from directory attributes will stop working for verification. The registration campaign began October 5. The notice's title gives November 9, 2026 for enforcement, while its rollout table says November 7. Plan for the earlier date.

**Who is exposed.** Users whose only SSPR option is a phone number an admin typed into their profile. They will be locked out of self-service reset and will call you.

**What to do.**

- In the Entra admin center, open Authentication methods, then User registration details, and filter for users with no registered method.
- Turn on the registration campaign so users are prompted at sign-in.
- Make sure admins have a registered method too.
- Brief the help desk on assisted registration for users who cannot self-register.

## Quick hits

**Arista VeloCloud Orchestrator.** CISA added CVE-2026-114625 to its catalog on October 23 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog)). Arista's [advisory](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199) rates the SQL injection 9.9 and says it is actively exploited; the lowest tenant role is enough. On-premises orchestrators need 5.2.3.18, 6.1.3.10 or 6.4.2.12. Arista lists `74.82.197.86` and `38.54.50.151` as malicious IPs. Hosted instances are already patched.

**Windows 11 24H2 Home and Pro stopped getting updates.** Microsoft's lifecycle page lists the end date as October 14, 2026, and the October security update was the last ([Microsoft lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-home-and-pro); [reported by BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-11-24h2-home-and-pro-reached-end-of-support/)). There is no November patch for these editions. Move them to 25H2 or 26H2 before Patch Tuesday. Enterprise and Education on 24H2 are supported until October 12, 2027.

## Sources

- [ConnectWise security advisories](https://www.connectwise.com/company/trust/advisories)
- [Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access)
- [Microsoft: AI-driven nation-state campaign using ARTEX enables supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)
- [PHP: critical remote code execution vulnerabilities, October 21, 2026](https://www.php.net/archive/2026.php#2026-10-21-5)
- [PHP: informational advisory on session upload progress, October 23, 2026](https://www.php.net/archive/2026.php#2026-10-23-1)
- [watchTowr: PHP2Shell](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/)
- [Huntress: php2shell rapid response](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities)
- [Synology-SA-26:14 PHP2Shell](https://www.synology.com/en-global/security/advisory/Synology_SA_26_14)
- [QNAP QSA-26-18 PHP2Shell](https://www.qnap.com/en/security-advisory/qsa-26-18)
- [Huntress: M365 token spray and replay campaign](https://www.huntress.com/blog/token-replay-spray)
- [Palo Alto Networks advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [Unit 42 threat brief on CVE-2026-0257](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)
- [Fortinet security hardening release](https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products)
- [CISA: six known exploited vulnerabilities added, October 20, 2026](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)
- [CISA: one known exploited vulnerability added, October 23, 2026](https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Plex security update notice](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319)
- [Arista Security Advisory 0199](https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
- [Microsoft Entra blog: security updates organizations need to act on](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-security-updates-what-organizations-need-to-do-now/4522024)
- [Message center notice MC1325414 (mirror)](https://mc.merill.net/message/MC1325414)
- [Microsoft lifecycle: Windows 11 Home and Pro](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-home-and-pro)