COMMZGEAR

October 30, 2026 · Blog

Commzgear Weekly Update — Week of Oct 26, 2026

Welcome to the first Commzgear Weekly Update. The idea is simple: every week I pick the handful of stories that actually matter if you run a small business, work in IT, tinker with your home network, or support a defense contractor. For each one you get what happened, why it matters, and what to do about it. No fluff.

This week was mostly the fallout from last week’s PHP mess, plus two networking stories that hit closer to home than usual (in one case, literally: your Wi-Fi router). I also added one “catching up” item from earlier in the month, since this is the first issue and it’s too important to skip.

1. PHP2Shell is now confirmed exploited. Patch PHP itself, not just WordPress

What happened: On Monday, Oct 26, CISA added the two PHP flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities (KEV) catalog and gave federal civilian agencies until Thursday, Oct 29 to fix them. Over the weekend before that, a researcher’s honeypots recorded a successful remote code execution against an Apache mod_php server running PHP 8.4.26. Amazon says exploitation attempts started on Oct 17, four days before PHP shipped the fixes on Oct 21. Then on Oct 28, CISA added a Linux kernel flaw (CVE-2026-46300) to the KEV list and said attackers can chain it with PHP2Shell to plant webshells and run commands as root.

Why it matters: The bugs live in PHP itself, not in any one app, so updating WordPress or your plugins doesn’t fix them. Wiz Research, which found the flaws working with Calif and OpenAI, showed unauthenticated code execution against WordPress, Drupal and Joomla. And the fixes only cover the supported branches. If you’re on PHP 8.1 or older, there’s no patch coming, and nobody should assume those versions are safe.

What to do:

  • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Internet-facing servers first.
  • Don’t forget PHP hiding inside appliances, containers and vendor products. Ask your vendors.
  • On shared or managed hosting? Ask your host to confirm your PHP version in writing.
  • Still on 8.1 or older? Plan the upgrade now, and restrict access to the site until it’s done.
  • Patch your Linux kernel through your distro’s normal updates. The upstream fixes are in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10.
  • Check your web server logs from Oct 20 onward. If anything looks off, treat it as an incident and rotate whatever credentials the app holds (database passwords, API keys).
  • One more: the PHP team also published a mitigation for a separate, still-unpatched flaw (CVE-2026-115560). It only applies to an unusual mix of configuration and code, but it’s worth a look at PHP’s advisory.

My take: The scary part isn’t the bug. It’s the timeline. Attackers were poking at it before the patch existed, which means “we patch on the second Tuesday” doesn’t cut it for internet-facing web servers anymore. A web application firewall bought some people a few days, but a WAF is a seatbelt, not a fix. If you have a website and you don’t know what PHP version it runs, that’s your homework this weekend.

2. Tailscale fixes the “Tailworm” SSH flaws. Update to 1.104.4

What happened: On Oct 25, researcher Erica Windisch of Cyberdione Labs published a report called Tailworm with 11 findings against Tailscale 1.104.2 and headscale 0.29.5 (the self-hosted control server). She published before any fixes existed, which kicked off a fight over disclosure. The most serious finding: if Tailscale SSH allows port forwarding, an attacker who already controls one permitted device can reach root-only sockets on the servers it’s allowed to SSH into. Tailscale shipped version 1.104.4 and four security bulletins (TS-2026-014 through TS-2026-017) around Oct 28. Headscale had not been fixed as of the latest reporting I could find.

Why it matters: Plenty of home labs and small shops use Tailscale for remote access instead of opening ports. This isn’t an unauthenticated, anyone-on-the-internet attack. It needs a foothold on a device your policy already trusts. No in-the-wild exploitation has been reported. But “one compromised laptop gets root on your servers” is exactly the kind of lateral movement that turns a small incident into a big one.

What to do:

  • Update every node to 1.104.4 or newer, then check it with tailscale version. Don’t assume auto-update did it.
  • Can’t update yet? Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart the service.
  • Tighten your access rules. Replace broad tag- or group-based SSH grants with specific device-to-device rules.
  • Running headscale? Treat every SSH grant as root access, limit those grants, and keep the server off the open internet until a fix ships.
  • If you think a device was compromised, delete it in the admin console. Reimaging it doesn’t revoke a copied device key.

My take: A mesh VPN is still a much better answer than forwarding ports to the internet. But being on the tailnet is not a security boundary by itself, and broad SSH rules were the real problem here. As for the disclosure fight, it’s a sideshow. The fix shipped in about three days, and that’s the part that matters to you.

3. WPSplinter: a 16-year-old Broadcom Wi-Fi bug, and your ISP’s router might have it

What happened: Researcher Quentin Kaiser presented a flaw he calls WPSplinter at the Hexacon conference, and coverage picked up this week. It lives in Broadcom’s old WPS Monitor code, the part of the router that handles the push-button Wi-Fi Protected Setup feature. Someone within Wi-Fi range can reach the vulnerable code before pairing, without the Wi-Fi password, and run code on the router. Kaiser demonstrated it on ISP-supplied gateways in Belgium. Broadcom told him it has known about the bug since 2018 and has been replacing the old code, but it declined to request a CVE, calling the software obsolete. On older eCos-based Broadcom chips (BCM3380, BCM3383, BCM33834) there’s no fix path at all. Newer Linux-based chips can be fixed, but only if each router maker ships the fix. No in-the-wild exploitation has been reported.

Why it matters: No CVE means your vulnerability scanner won’t flag it, and your ISP may never hear about it. Changing your Wi-Fi password does nothing, because the attack happens before login. Even turning off WPS in the settings may not fully disable the vulnerable code, according to Kaiser.

What to do:

  • Turn off WPS anyway. It’s still the right call.
  • Check for firmware updates from your router maker or your ISP.
  • If you rent your gateway, ask your ISP directly whether its firmware still includes Broadcom’s legacy WPS code. Get the answer in writing.
  • If your router is end-of-life or built on one of those eCos chips, replace it.
  • My preferred setup: put the ISP gateway in bridge mode with its Wi-Fi off, and run your own supported router behind it. I covered how to pick one in my home Wi-Fi router guide.

My take: This is the strongest argument I’ve seen in a while for owning your own router. When a chipmaker won’t issue a CVE and a 2018 patch never made it into the gateway sitting in your hallway, you can’t count on the supply chain to protect you. Buy from an authorized seller, pick a vendor with a real firmware support record, and replace gear when it hits end-of-life.

4. CMMC: Phase 2 is still in limbo, but your obligations aren’t

What happened: CMMC Phase 2 was supposed to start Nov 10, 2026. It would have required many contractors handling CUI to get a Level 2 certification from a third-party assessor before contract award. The Pentagon paused it on July 13 for a 60-day review. As of Oct 21, it still hadn’t published the results or a new date. This week, Federal News Network reported on the responses to the review’s request for information (Oct 26 and 27). The top cost complaint wasn’t the CMMC assessment. It was implementing and maintaining the NIST SP 800-171 controls. The responses put the average cost of CMMC itself, separate from 800-171, at about $47,000. Industry sources citing Cyber AB data told the outlet that 2,433 companies held Level 2 certifications as of September. DoD declined to comment.

Why it matters: The pause stopped a deadline, not the requirements. CMMC Phase 1 self-assessments and annual affirmations in SPRS are still in effect. DFARS 252.204-7012 still requires you to protect covered defense information and report cyber incidents. And some large primes have told their suppliers to treat Nov 10 as the deadline anyway. Separately, a proposed FAR rule would push NIST 800-171 Revision 3 and 72-hour CUI incident reporting onto civilian contractors, but it isn’t final yet.

What to do:

  • Keep your SPRS score and annual affirmation current.
  • Keep your System Security Plan and POA&M up to date. They’re the paperwork you’ll need either way.
  • Ask your primes, in writing, what they expect from you by Nov 10.
  • If you work civilian contracts, keep an eye on the proposed FAR CUI rule.

My take: The pause is on the paperwork, not on the threat. If the expensive part is the 800-171 controls (and the RFI responses say it is), stopping now doesn’t save you money. It just moves the bill. The contractors who keep going will be ready the day the requirement comes back, and everyone else will be fighting for an assessor slot.

Catching up: the ConnectWise Cloud Backup breach (mid-October)

This one broke Oct 15 to 18, before this newsletter existed. I’m including it because if you use a managed service provider, it may affect you.

What happened: Attackers used application credentials belonging to ConnectWise Cloud Backup (formerly SkyKick), a Microsoft 365 backup service many MSPs use, to sign into customers’ Microsoft 365 tenants. Because they signed in as the app and not as a user, MFA never came into play. In some tenants, the app gave itself admin roles, and in at least one case it granted itself Global Administrator and added credentials to other apps. Cybernews reported that some of those planted credentials were set to stay valid until 2028. On Oct 17, ConnectWise disabled seven application identities and took Cloud Backup, SaaS Security and Cloud Management offline. It said it had no evidence the backup archives themselves were accessed. Microsoft called it an active supply-chain attack.

What to do:

  • Ask your MSP whether they use ConnectWise Cloud Backup or SkyKick for your tenant, and what they’ve checked.
  • In Microsoft Entra, review service principal sign-ins, app credential changes since Oct 13, unexpected admin role assignments and OAuth grants. Older tenants may show the app as “SkyKick Cloud Manager.”
  • Remember that disabling the app doesn’t undo changes the attackers already made, and existing tokens stay valid until they expire.
  • Audit every third-party app with tenant-wide permissions, such as Directory.ReadWrite.All.

My take: Every backup or security tool you grant tenant-wide access becomes part of your attack surface. It’s the same lesson as the Ubiquiti breach: your vendor’s security is your security. Review your third-party app permissions at least quarterly, and remove the ones you don’t use.

That’s the first issue. Tell me what you want more of, less of, or what I missed.

Jason

Sources

  1. BleepingComputer, “CISA confirms PHP2Shell vulnerabilities now exploited in attacks” (Oct 27, 2026): https://bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks
  2. Recorded Future, “PHP2Shell Exploitation: Two Critical PHP Flaws Explained” (Oct 21, 2026): https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
  3. Cyber Security News, “CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks” (Oct 30, 2026): https://cybersecuritynews.com/linux-kernel-missing-initialization-vulnerability/
  4. The Hacker News, “Unpatched Tailscale SSH flaws…” (Oct 25, updated Oct 27, 2026): https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
  5. PBX Science, “Tailscale Patches ‘Tailworm’ SSH Flaws…” (Oct 28–29, 2026): https://pbxscience.com/tailscale-patches-tailworm-ssh-flaws-that-let-a-compromised-device-gain-root-on-other-servers/
  6. Linux Panda, “Tailworm: Who Needs the Tailscale Security Update?” (Oct 29, 2026): https://www.linuxpanda.com/tailworm-tailscale-vulnerability-security-update/
  7. TechRadar, “A 16-year-old bug could be putting millions of routers at risk…” (Oct 26, 2026): https://techradar.com/pro/security/a-16-year-old-bug-could-be-putting-millions-of-routers-at-risk-despite-broadcom-saying-it-patched-the-issue-years-ago
  8. Federal News Network, “DoD’s reasons for CMMC pause falling apart in face of RFI responses” (Oct 26, 2026): https://federalnewsnetwork.com/defense-news/2026/10/dods-reasons-for-cmmc-pause-falling-apart-in-face-of-rfi-responses/
  9. DevPro Journal, “The CMMC deadline paused, but the obligations didn’t” (Oct 27, 2026): https://devprojournal.com/technology-trends/security/the-cmmc-deadline-paused-but-the-obligations-didnt
  10. BleepingComputer, “Hackers breach Microsoft 365 tenants via ConnectWise supply chain attack” (Oct 17, updated Oct 18, 2026): https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
  11. Cybernews, “ConnectWise breach puts more than 300 companies’ secrets at risk” (mid-October 2026): https://cybernews.com/security/connectwise-cloud-backup-breach-microsoft-365/