Today's briefing

Wednesday 21 October 2026

A London cloud outage that knocked UK banks offline, an emergency PHP patch the whole web is scrambling to install, and a busy day for supply-chain attacks.

10 stories

Outage20 Oct 2026

Google Cloud power failure in London disrupts UK banks, couriers and courts

A "power event" at a third-party facility hosting Google Cloud's europe-west2-b zone in London took services down from just after 7am UK time on Tuesday 20 October. Revolut, Lloyds Bank, Halifax, Bank of Scotland and HSBC customers reported problems, as did Royal Mail and DPD users and the video platform used for remote court hearings in England and Wales. Google says services were restored for most customers by the evening and it will publish a full incident analysis.

Why it matters: One power problem in one zone rippled across the UK economy. UK financial regulators have asked Google for more information, and the outage raises the question of whether firms' resilience plans really cover a major cloud region going dark.

Sources

Vulnerability21 Oct 2026

"PHP2Shell": emergency PHP patch for two critical flaws, as websites go offline worldwide

PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 (critical) that can let an unauthenticated attacker run code on servers that use PHP to serve web pages. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare reported early exploit attempts, and some organisations, including the Finnish government, took sites offline as a precaution.

Why it matters: PHP runs behind WordPress, Drupal, Magento and many hosting control panels, so huge numbers of sites are exposed. CISA and the UK's NCSC say to patch now, or take systems offline if you can't. PHP 8.1 and older get no official update from the PHP project.

Sources

Ransomware21 Oct 2026

CISA, FBI and partners issue #StopRansomware warning on SafePay gang

A joint advisory from CISA, the FBI, the US Secret Service and international partners describes SafePay, one of 2026's most active ransomware groups, with about 600 victims across the Americas, Europe and Australia. The gang gets in with stolen credentials and known flaws in internet-facing devices, often over VPNs, then deletes backups, steals data and encrypts systems. In some cases it phones victims directly to pressure them to pay.

Why it matters: The recommended defences are familiar but effective: patch internet-facing systems, require multi-factor authentication, keep offline backups and test restoring them, and segment networks.

Sources

CISA

Supply chain21 Oct 2026

Stolen UpdraftCentral keys used to plant backdoors on WordPress sites

An attacker broke into TeamUpdraft's website over 17-18 October and got hold of UpdraftCentral connection keys, which can send commands to WordPress sites running the popular UpdraftPlus backup plugin. The keys were used to create admin accounts and install malicious plugins. UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) revoke the old keys, but security firm Nethemba says it still saw the attacker sending commands on the morning of 21 October.

Why it matters: Updating removes the stolen keys but not any backdoor that's already installed. If you run WordPress with UpdraftPlus, check for unknown admins and plugins, change admin passwords, and if anything looks wrong, restore a backup from before 17 October.

Sources

Breach20 Oct 2026

ConnectWise suspends Cloud Backup after its Microsoft 365 app credential is abused

Attackers used a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to request Microsoft 365 access tokens from customer tenants that had approved the app. Because they signed in as the app itself, no user password or MFA was needed. ConnectWise disabled seven application identities and suspended Cloud Backup, and SaaS Security and Cloud Management are also temporarily offline.

Why it matters: This shows the risk of trusted third-party apps inside Microsoft 365. Anyone who has ever used SkyKick or ConnectWise Cloud Backup should review app consents and sign-in and audit logs, and look for new credentials added since 13 October.

Sources

Supply chain20 Oct 2026

OVHcloud CLI releases on GitHub swapped for secret-stealing malware

An attacker took over a developer's GitHub account and replaced OVHcloud CLI releases v0.11.0 to v0.15.0 with malware built to steal secrets from the disk. The bad files were live for about 90 minutes on 19 October before a customer reported them. OVHcloud says v0.10.0 and v0.16.0 are clean and it has now enabled GitHub's release immutability setting.

Why it matters: If you downloaded the CLI in that window, treat every secret on that machine as compromised and rotate it. More broadly, even official GitHub releases can be tampered with unless they're locked down and signed.

Sources

Vulnerability20 Oct 2026

CISA flags actively exploited Plex, Siemens and SiteGuard flaws

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalogue based on evidence that attackers are using them. Four are in Plex Media Server (CVE-2026-96652, -96654, -96655 and -96656). The others are a command-injection flaw in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) and a search-path flaw in Siemens Software Center (CVE-2026-110936).

Why it matters: Lots of people run Plex at home on always-on machines. If yours is reachable from the internet, update it now.

Sources

CISA

Policy20 Oct 2026

US orders DeepSeek AI removed from federal civilian systems

The US Department of Homeland Security made public an order, first issued on 24 July, requiring federal civilian agencies to remove DeepSeek products, including third-party products built on its models, and banning new purchases. DHS cited the risk of sensitive government data reaching China and security vulnerabilities in DeepSeek's models and apps. China's foreign ministry said it opposes the "over-generalization of national security".

Why it matters: AI models are now being treated like any other supply-chain risk. Expect more organisations to check which AI models are hidden inside the tools they buy.

Sources

Defence21 Oct 2026

Chrome now warns you before you paste a ClickFix scam command

ClickFix scams show a fake CAPTCHA or error and tell you to paste a command into Windows Run or the Mac Terminal, which then installs malware. Google says Chrome's Enhanced Protection mode can now spot when you copy a suspicious command. It sends a version with personal details removed to Safe Browsing for checking, and shows a warning if the command is dangerous.

Why it matters: A real website will never ask you to paste a command to "verify you're human". This new warning only works if you've turned on Enhanced Protection in Chrome's security settings.

Sources

Threat20 Oct 2026

333 hijacked Tor exit relays were used to intercept SSH logins

A researcher known as kaba found 333 Tor exit relays, about 10% of all exits, that redirected SSH connections on port 22 to 12 interception servers from 2 October. Users who ignored the "host key has changed" warning and logged in could have their password stolen and their server infected with the Ebury backdoor. The Tor Project's network health team flagged the relays as BadExit on 4 October, and the infected servers were shut down by 5 October.

Why it matters: Never click past an SSH host-key warning. Use SSH keys or hardware keys instead of passwords, so a man-in-the-middle has nothing to steal.

Sources

kaba.cx (researcher write-up)