Daily Cyber Threat Brief — October 26, 2026: PHP2Shell exploitation confirmed in the wild as patches race servers

The evidentiary step matters here. Before Karimi's honeypots, vendors including Cloudflare, Hadrian, watchTowr, Previdian and Patchstack had all seen PHP2Shell exploitation attempts — and flagged every one as unsuccessful. Dataminr's TRACE team likewise characterised activity before this confirmation as scanning, fingerprinting and non-working exploits. Karimi's capture changes the assessment in three specific ways: the memory disclosure was usable (a decoded cookie dump and a function address derived from it using the public exploit's offsets), the client acknowledged the full response, and a shell command executed immediately afterwards. Hutchins, who has been tracking a stream of alleged successful exploitation reports, called it "by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far."

For defenders, the practical read is unchanged but now urgent: patch to a fixed PHP build, restart PHP processes so no worker keeps running the old binary, and hunt on any server that was internet-facing and unpatched between disclosure and patching — web-server logs, unexpected processes, and new files or scheduled tasks are the first places to look. The unpatched third flaw, CVE-2026-115560, is exploitable only with what PHP calls "an unusual combination of configuration and application code," but the recommended mitigation — disabling session upload progress — costs little and should be applied where patching the main flaws is still in progress.

GMO Internet Group's Onamae.com Desktop Cloud service — a virtual private server service used to run remote desktops, including for trading — is the incident with the most unusual response of the week. The company began investigating on October 19 after a customer inquiry, confirmed a malicious programme in some customer server environments on October 20, and began shutting down all servers on October 21. Its fourth report, dated October 24, confirms customer information was exfiltrated and reveals that the attackers demanded money, threatening to keep placing destructive orders on accounts at more than 70 Japanese and foreign brokers, to publish customer data, and to launch ransomware. GMO refuses to pay and has handed its communications to police.

The compensation package is notable: verified losses from unauthorized trading and related fees will be reimbursed, every current Desktop Cloud user receives a ¥5,000 consolation payment whether or not they lost money, and affected customers get six months of free access to an alternative desktop platform. The compromised service will not be restored; it is being rebuilt elsewhere. Founder Masatoshi Kumagai has also asked the government to use Japan's active cyber defense powers, in force since October 1, to neutralize the threat — a request officials have not committed to in this case. The scale figure to handle carefully: 26,739 is the number of servers potentially affected, not confirmed infections, and the total financial damage remains undetermined. Payment-card data was stored on separate infrastructure and was not affected, according to the company's reporting.

The City of Columbia confirmed on October 23 that the incident discovered on October 20 was a ransomware attack, in an update from City Manager Teresa Wilson. The city contacted the South Carolina Law Enforcement Division (SLED) on discovery, and SLED is investigating with cybersecurity specialists; the FBI is aware but, as of October 23, not involved, according to local reporting.

The service split is the operational detail worth noting. Still offline: MyColaSC, online Animal Services, Parks and Recreation reservations, and Geographic Information Systems (GIS). Still running: police, fire, 911 communications, Columbia Water, and the Payment Center including online payments. The city says sensitive information was within the affected network but has not confirmed whether any of it was accessed or compromised, and no ransomware group, entry point, ransom demand or restoration timeline has been disclosed. Residents needing MyColaSC-type services are directed to call (803) 545-3300. Until attribution or a data-theft finding lands, this should be read as a confirmed ransomware incident with unconfirmed data impact — not as a confirmed data breach.

Quest Diagnostics, one of the largest clinical laboratory companies in the United States — 7,700 service points, 65,000 employees, serving one in three U.S. adults each year — disclosed in an SEC filing that it learned on October 21 of unauthorized access to its Quanum LSM system, the platform physicians and hospital staff use to place test orders and look up results. The company says it believes some patient records were exposed; the types of data affected have yet to be determined, and the investigation, aided by external experts with law enforcement informed, is ongoing.

Operationally, the company says customer-facing operations have not been disrupted and direct-customer LIS interfaces and EMRs were not impacted. As a precaution it paused access to Essential Insights and LabHQ, stopped Quanum LSM itself, and is directing customers to paper requisitions or Quanum eLabs. No threat group has claimed the attack as of reporting. Context that will shape scrutiny: in 2019, data of about 11.9 million Quest patients was compromised in a breach at billing provider American Medical Collection Agency, leading to consolidated class-action litigation that remains unresolved. That history does not establish anything about this incident's cause, but it does explain why the data-types finding, when it lands, will matter more than the initial disclosure.

Leak-site listings dated October 26 name three further claimed victims: Ernesto Malvestiti S.p.A. in Italy (Aurora), Mah Sing in Malaysia (Scarlettgroup), and Glückauf-Vermessung GmbH in Germany (Payload). These are ransomware-group claims, not victim confirmations, and none of the three has been independently verified in the reporting reviewed for this brief. They are recorded here so defenders tracking those groups or sectors can watch for confirmations — not as confirmed breaches.