vNext Cyber Update

Two critical PHP flaws allow unauthenticated attacks on business websites and online shops. Ask your IT or hosting provider to verify the PHP version and investigate activity since 17 October 2026.

ConnectWise has confirmed unauthorised access to Cloud Backup (SkyKick) application identities. Affected Microsoft 365 tenants now require review and log preservation.

A critical flaw in Nextcloud’s optional Collabora Online – Built-in CODE Server app is being actively exploited. Affected organisations should request an immediate update and compromise assessment.

CISA has confirmed active exploitation of CVE-2025-61624 in FortiGate/FortiOS. An attacker must already have privileged admin access, but can then gain root control. IT providers should verify versions and investigate for compromise now.

BeyondTrust Remote Support, formerly known as Bomgar, is used by IT teams and service providers to maintain systems remotely. A critical zero-day vulnerability has already been exploited against self-hosted appliances. BeyondTrust patched its SaaS instances by 9 October 2026, but self-hosted systems require an explicit check. If your company or IT provider operates BeyondTrust Remote Support on its own appliance, ask them now to confirm that BT26-05-RS is installed and whethe

Palo Alto Networks confirms limited active exploitation of CVE-2026-0322. IT providers should update affected firewalls and Panorama systems today and review management access.

Cisco confirms active exploitation of CVE-2026-76519. A crafted email attachment can compromise affected on-premises gateways without authentication and lead to root command execution.

Microsoft confirms active exploitation of CVE-2026-96951 in Windows Shell. IT providers should verify today that the 13 October security updates are installed on PCs and servers.

CVE-2026-104935 in Ivanti Connect Secure is being actively exploited. Affected VPN gateways require an immediate update and a compromise assessment.

Ahsay has corrected its earlier statement: version 10.3.4.0 does not fully protect against the actively exploited flaws. Affected AhsayCBS v10 servers need hotfix 10.3.4.45, a restart and a compromise assessment.

CISA has confirmed active exploitation of an old but critical vulnerability in ONLYOFFICE Document Server. Versions earlier than 5.6.3 are affected when JWT is used, allowing a remote attacker to execute code without signing in. Companies running ONLYOFFICE themselves or through an IT provider should have the installed version checked today.

Critical flaws in HPE Aruba AOS-S expose switch management without authentication. Affected systems should be upgraded to 16.11.0032.

A critical Veeam flaw lets an account with the low-privilege Backup Viewer role execute code on the backup server. Version 12 should be updated promptly.

Active exploitation attempts are targeting CVE-2026-102255 in SonicWall SMA1000. Affected remote-access appliances should be checked and updated immediately.

Citrix has disclosed CVE-2026-107406 in customer-managed NetScaler systems using SAML. The flaw can allow unauthenticated code execution or a service outage, and systems updated recently may need another upgrade.

A critical FortiMail vulnerability is being actively exploited. Businesses using a FortiMail appliance or VM should ask their IT provider to update, secure, and investigate the system now.

Active attacks target Zimbra mail servers: a crafted email can trigger command execution without authentication or user action. Affected organisations should request both patch verification and a compromise assessment now.

Apple has fixed a security flaw already used in targeted attacks against iPhones, iPads and Macs. Businesses should ask their IT provider to confirm that every device has received the 28 September 2026 security updates.

CISA has confirmed active exploitation of CVE-2026-65660 in on-premises Microsoft SharePoint Server. Organisations running SharePoint Server 2016, 2019 or Subscription Edition should have their patch level and signs of compromise checked now.

Microsoft 365, Blue Yonder, CDK Global and Infoniqa show how quickly cloud dependencies can disrupt operations. The key is not to avoid the cloud, but to know your outage tolerance, prepare a Plan B and keep business data independently accessible.