Weekly Cyber Roundup Oct23 2026

Chuck walks small businesses and medical practices through the week's biggest cybersecurity stories, and what to do about each one on Monday morning. This week: • PHP2Shell: two critical PHP flaws exploited before patches existed; ~1.57M servers still unpatched • ConnectWise Cloud Backup (formerly SkyKick): stolen credential reached 173 Microsoft 365 tenants • FBI/CISA advisory AA26-293A on SafePay ransomware: firewalls, VPNs and Veeam backups • Vishing call leads to a 1.4M-patient breach at Central Ohio Primary Care • CISA KEV additions: Fortinet FortiOS, BeyondTrust, Plex "Plex2Shell", Siemens, SiteGuard • Patch now: Chrome 156, Bricksforge WordPress plugin, Plex, October Windows updates • Breaches & settlements, scams to watch, and a 6-item action checklist CHAPTERS 0:00 Intro 0:53 This week's rundown 2:13 The week in one paragraph 3:21 PHP2Shell: critical PHP flaws 5:14 PHP2Shell: what to do 6:42 ConnectWise Cloud Backup compromise 8:12 ConnectWise: questions for your MSP 9:37 SafePay ransomware advisory 11:18 SafePay: back to fundamentals 12:38 Vishing breach: 1.4M patients 14:10 Vishing: the call-back rule 15:27 Fortinet & BeyondTrust added to KEV 17:17 All KEV additions this week 19:03 Patch now list 20:52 Healthcare breaches & settlements 22:06 More breaches & the pattern 23:32 Scams & threat trends 25:18 Your action checklist 27:00 Wrap-up SOURCES • SecurityWeek: PHP2Shell exploitation (and follow-up) • The Hacker News: ConnectWise credential reset • Cybersecurity Dive: ConnectWise Cloud Backup • HIPAA Journal: SafePay advisory • Cybersecurity Dive: SafePay • HIPAA Journal: Central Ohio Primary Care • cvefeed.io KEV mirror; CISA alerts Oct 16 / Oct 20 • Wiz: CVE-2025-61624; HKCERT Fortinet bulletin • Shattered: BeyondTrust CVE-2026-102764 • Field Effect: Plex2Shell • SecurityWeek: Chrome 156 • The Hacker News: Bricksforge • BleepingComputer: October Patch Tuesday • Daily Hodl: BCHP/XTIUM settlement • Mass. AG: Transformative Healthcare • HIPAA Journal: iRhythm • ClaimDepot: Mid Florida Dermatology • Becker's: Health-ISAC vishing warning • SecurityWeek: Siemens/ClickFix • ScamDrill: October scam trends • Healthcare Dive: phishing marketplace takedown This episode is general information, not legal or compliance advice. Talk with your IT provider or compliance advisor about your specific environment. Narration is AI-generated. TAGS cybersecurity, small business cybersecurity, healthcare cybersecurity, HIPAA, ransomware, PHP2Shell, ConnectWise, SafePay, vishing, CISA KEV, medical practice IT, MSP security, patch Tuesday