The TechLens
The figure captures a growing challenge for security teams. While organisations investigate alerts, coordinate approvals and assess exposure, attackers may already be moving through connected systems.
October has offered three distinct examples: critical PHP vulnerabilities attracting attack traffic, an AI-assisted campaign linked to a software supply-chain compromise, and weak certificate authority keys associated with Indian cybersecurity company eMudhra.
Each exposes a different weakness. Together, they raise a question for technology leaders: what happens when the time needed to respond exceeds the time attackers need to act?
1. PHP vulnerabilities: When patching becomes a race against attackers
On October 21, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Depending on the affected configuration, such flaws can expose applications to serious risks, including remote code execution and service disruption.
Cloudflare reported observing attack traffic targeting its customers as details emerged. Its web application firewall protections provided an additional layer of defence, but they did not eliminate the need to update vulnerable PHP instA cyberattack can move from initial targeting to privileged access in less than three hours. As software vulnerabilities, AI-assisted attacks and weaknesses in digital certificates converge, the real test for organisations is how quickly they can respond.
Three hours. That is how quickly attackers obtained privileged access to cloud infrastructure in several incidents described by Microsoft in its October 21, 2026, security report.
allations.
For businesses running websites, customer portals and internal applications, the challenge is often not obtaining a patch. It is finding every system that needs it.
What makes this difficult?
What should organisations do? Identify affected PHP installations, prioritise internet-facing systems, apply the relevant security updates and verify that the fixes are in place.
A patch that exists but remains unapplied offers no protection.
2. AI-assisted attacks: When trusted software becomes the entry point
Microsoft’s October 21 report described activity involving Storm-0940, a China-aligned threat actor, and ARTEX, an agentic AI penetration-testing framework used to automate attack activity.
Microsoft linked the activity to the ConnectWise Cloud Backup supply-chain compromise. In several incidents, attackers obtained privileged access to cloud infrastructure in less than three hours from initial targeting.
The concern extends beyond one software provider. Businesses routinely grant third-party applications access to backups, business data and critical infrastructure. When those applications or their credentials are compromised, existing trust relationships can become pathways for further intrusion.
Where the risk grows:
Microsoft also cautioned that an affected application or successful authentication does not, by itself, prove that customer data was stolen.
What should organisations do? Review third-party access, restrict privileges to what each application needs, monitor unusual authentication activity and prepare procedures to revoke compromised credentials quickly.
AI is not the entire story. The bigger concern is automation accelerating familiar attack techniques.
3. eMudhra: Why an Indian certificate security incident matters
Digital trust depends on systems most users never see. When someone opens a website, certificate authorities help browsers verify that the site is genuine. A weakness in that chain can have consequences far beyond a single server.
On October 17, a security researcher reported weak cryptographic keys associated with eight intermediate certificate authorities linked to Indian security company eMudhra. Google described measures to protect Chrome and Android users by blocking trust in affected certificates.
eMudhra stated that its root private keys were not affected, its infrastructure had not been breached, and the affected intermediate certificates had not issued end-entity certificates. It also said the keys had been generated using certified hardware security modules, while its investigation into the precise cause continued.
The incident illustrates an important distinction: certified hardware does not automatically guarantee that every cryptographic process using it is secure.
Why this matters in India:
What should organisations do? Check vendor advisories, verify whether their systems trust affected certificates and follow the relevant browser and vendor guidance to remove that trust where required.
The broader lesson is that digital trust needs continuous verification, even when the underlying infrastructure is certified.
Sources: Google Security Blog; eMudhra’s official incident statement.
The Tech Lens takeaway: Speed is now a security control
These incidents expose three different pressure points: vulnerable software, excessive trust in connected applications and weaknesses in the infrastructure behind digital identity.
For technology leaders, the response should be practical:
No organisation can guarantee that every weakness will be discovered before an attacker finds it. But it can reduce the time between discovery and action.
In a threat environment where privileged access can be obtained in hours, resilience is not just about preventing every attack. It is about ensuring that one vulnerability, compromised application or failure of trust does not become a business-wide crisis.
Sources and references
1. PHP Official Security Advisories:
https://www.php.net/archive/2026.php
2. Cloudflare, PHP Vulnerability Analysis and Protection:
https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
3. Microsoft Security Blog, Storm-0940, ARTEX and the ConnectWise Supply-Chain Compromise:
4. Google Security Blog, Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates: https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
5. eMudhra, Official Statement on the Certificate Security Incident: https://emudhra.com/en/post/certificate-security-incident/
Linkedin Caption Content
Three hours can be enough for attackers to gain privileged access. Is your organisation prepared to respond that quickly?
Our latest edition of The Tech Lens examines three cybersecurity developments shaping the current threat landscape: critical PHP vulnerabilities attracting attack traffic, AI-assisted activity linked to a software supply-chain compromise, and cryptographic weaknesses involving eMudhra’s intermediate certificate authorities.
Each incident highlights a different challenge for technology leaders, from patching exposed systems and securing third-party access to protecting the digital trust that underpins online services.
Read the full analysis to understand why response time is becoming a critical security control.
