In October 2026, most of the security stories that mattered to small businesses started somewhere else. A Microsoft 365 backup service lost control of its access to customer accounts, and the language that runs most of the web needed an emergency fix. A remote support tool that IT providers use to reach their clients’ computers turned out to have been exploited as a zero-day in late August. In each case, the businesses affected learned about it after their supplier did.
For most small firms, none of this calls for a new security product. It calls for one email to each supplier, asking who patches what and how quickly.
What a supply chain attack is
A supply chain attack reaches a business through something it buys or relies on, rather than through the business itself. The target might be a software company, an IT provider, a hosting firm or a piece of open-source code a developer installed. Attackers like these routes because one supplier can lead to hundreds of customers at once.
October produced examples of most of these. Two were supply chain attacks in the strict sense, where a supplier was broken into or its software was tampered with. The other two were flaws in products that suppliers run on their customers’ behalf, which reach businesses the same way.
What happened in October
A backup service became a way in. On 14 October ConnectWise found unauthorised access to its Cloud Backup service, which backs up businesses’ Microsoft 365 accounts. To do its job, the service held standing access to those accounts, and the attackers took over the credentials it used. Huntress, a security firm that monitors many of those accounts, had confirmed unauthorised sign-ins in 162 Microsoft 365 tenants by the evening of 16 October, and in a later update had seen the attacker sign in to almost 1,000 tenants, over 300 of them successfully. ConnectWise cut off the service’s access on 17 October. It says it has no evidence the backups themselves were accessed, and that it cannot tell which customers’ accounts were affected. On 23 October the service was still suspended, and ConnectWise planned to let partners restore from existing backups early in the week of 26 October.
On 21 October Microsoft attributed the attack to a group it calls Storm-0940 and describes as China-state aligned. The service businesses bought to protect their Microsoft 365 data became a way into it.
The language behind most websites needed an emergency fix. At three o’clock UK time on 21 October, the PHP project released fixes for two critical flaws now known as PHP2Shell. PHP runs 69.3% of websites whose server-side language is known, according to W3Techs on 23 October, including every WordPress site. The National Cyber Security Centre (NCSC) warned that the flaws “may allow attackers to execute commands on any web server running PHP”. Ten large hosts said between 21 and 23 October that they had patched, or were patching, the servers they run. Customers who run their own servers had to do it themselves. Our guide for WordPress owners covers how to check a site and what each big host has done.
A remote support tool was exploited before anyone knew. BeyondTrust Remote Support is software that IT providers and internal IT teams use to take control of a computer and fix it. Google’s Mandiant says a suspected Chinese espionage group exploited a flaw in it as a zero-day in late August, and BeyondTrust says it knows of two affected customers. BeyondTrust fixed its own cloud service on 9 October and disclosed the flaw on 15 October. Customers who run the product on their own equipment had to install the update themselves. A day later, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of vulnerabilities known to be under attack.
An AI library was poisoned for under three hours. LiteLLM is open-source software that developers use to connect applications to AI models. On 21 October, a tampered version, 1.107.0, was published to the main Python package repository, where it was live for under two hours, and to Docker Hub for about two and a half. LiteLLM says it contained malware that steals credentials and loads tools for taking control of a machine, and that the attackers got in using three sets of developers’ GitHub credentials. If a developer has built an AI feature for you this year, it is worth asking whether LiteLLM is part of it. LiteLLM’s incident post lists the affected versions and the steps to take.
Between 13 and 21 October there was more of the same. Volexity reported attacks on Ivanti’s Connect Secure VPN, which CISA added to its known-exploited list on 13 October. GitLab fixed a flaw rated 10 out of 10 that affects every self-managed version from 7.0, released in 2014, onward. Its notice does not report exploitation, and CISA had not listed it as of 23 October. Microsoft’s October update fixed 1,453 vulnerabilities in its own products, more than in any month back to 2017 in Microsoft’s own data (September had 999), and one of them was already being used in attacks.
Attacks now start before the fix
Speed matters because attackers no longer wait for a fix to be published. Google’s Mandiant estimated in its M-Trends 2026 report, published on 23 March 2026, that the mean time to exploit a vulnerability is now minus seven days. In its words, “exploitation is routinely occurring before a patch is even released.” PHP2Shell fits the pattern. Amazon reported on 21 October that one of its decoy servers had recorded an attempt to use the flaws on 17 October, four days before the fixes came out.
Fixing is slower than attacking. Verizon’s 2026 Data Breach Investigations Report found that exploiting a software flaw was the most common way into the breaches it studied, at 31%. Among the organisations in its data, the median time to fully fix a vulnerability on the US government’s known-exploited list was 43 days.
AI is making attacks faster
Microsoft’s account of the ConnectWise attack documents a state-aligned group running an AI attack framework at scale. Microsoft says Storm-0940 used ARTEX, “an open-source penetration testing framework that can use any AI model”, to try to sign in to more than 2,250 Microsoft 365 tenants, each one a business’s Microsoft 365 setup. In several cases, the time from first targeting to privileged access was under three hours.
The techniques themselves were familiar. Trying stolen or guessed credentials against sign-in pages is one of the oldest attacks there is. What changed was the pace and the volume. In January 2025, Google’s threat intelligence team found that AI “allows threat actors to move faster and at higher volume”, but that they were “not yet developing novel capabilities”. Its report of 30 September 2026 shows the pace picking up: exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18 a month from January to August 2026. It also described “the first known case of a threat actor in possession of a zero-day exploit script developed with generative AI”, which was intercepted before it was used.
The defences that worked before still work, including multi-factor sign-in, removing access nobody needs and applying fixes quickly. What has shrunk is the time you have to put them in place.
Most breaches now involve a third party
Suppliers are where much of this lands. Verizon found a third party involved in 48% of the breaches it studied, an increase of 60% on the year before. That figure includes breaches through flaws in a supplier’s software.
Few UK firms check. The government’s Cyber Security Breaches Survey, published on 30 April 2026, found that 15% of UK businesses formally review the cyber risks from their immediate suppliers. Among micro businesses it was 12%. Only 34% of businesses have a policy of applying security updates within 14 days. We have written separately about how often UK businesses are breached.
Five questions to send each supplier
Send these to whoever runs your website, hosting, Microsoft 365 or Google account, backups and office IT. Ask for the answers in writing.
1. Which of our systems are you responsible for keeping updated? A list is more useful than reassurance. Anything left off it belongs to nobody, which in practice means it belongs to you.
2. How quickly do you apply critical security fixes? The NCSC’s guide to choosing a managed service provider recommends that critical and high-risk fixes go on within 14 days of release. Treat that as the outer limit. For a flaw already under attack, the answer should be measured in days, and on 21 October the fastest hosts had PHP2Shell fixed the same day.
3. How will you tell us when a critical fix affects us, and when it is done? A two-line email after something like PHP2Shell costs a supplier a few minutes. It also tells you they checked.
4. What access do you hold to our systems, and how is it protected? This covers remote support tools, admin accounts and apps connected to your Microsoft 365. ConnectWise and BeyondTrust both show why it matters. Ask for multi-factor sign-in on every account a supplier uses to reach you, and ask them to remove any access they no longer need.
5. If you were breached, how and when would you tell us? ConnectWise published its advisory two days after it found the problem. Ask each supplier what their own timescale is. The Cyber Security and Resilience Bill, now in the House of Lords, would bring medium and large managed service providers under the UK’s network and information systems rules, including a duty to report significant incidents and to tell affected customers. Small and micro providers would not be covered. Our guide to the Bill explains who it reaches.
What a good answer looks like
A good answer has a name and a number in it. “Our support lead applies critical fixes within 48 hours and emails you when it is done” can be checked. “We keep everything up to date” cannot.
If a supplier cannot say which of your systems they look after, that is an answer too. That says more about how the work was set up than about the supplier. Nobody ever defined the job, and an undefined job is the one that does not get done when a fix lands at three o’clock on a Wednesday afternoon.
Keep the replies. They are the start of a supplier record, which is what a larger customer’s security questionnaire asks for. The other half of that record is whose name is on each account, which we cover in who actually owns your website.
What to do now
List your suppliers. Include everyone who runs a system you rely on: website, hosting, email, backups, IT support and any developer.
Send the five questions to each one by email.
If your website runs on WordPress or any other PHP software, check it against our PHP2Shell guide.
If you used ConnectWise Cloud Backup, ask whoever set it up to work through ConnectWise’s published advisory with you and to review which apps can still reach your Microsoft 365 account.
Put a date in the diary to ask again in six months. Suppliers change their staff and their tools.
Frequently asked questions
What is a supply chain attack?
A supply chain attack reaches a business through a supplier it relies on, such as a software company, IT provider, hosting firm or piece of open-source code. Attackers break into the supplier, or tamper with its software, and use that position to reach its customers.
What are recent examples of supply chain attacks?
In October 2026, attackers took over the credentials of ConnectWise Cloud Backup and used them to sign in to customers’ Microsoft 365 accounts. In the same month, a tampered version of the LiteLLM AI library was published to the Python package repository and Docker Hub for under three hours.
What happened at ConnectWise?
ConnectWise found unauthorised access to its Cloud Backup service on 14 October 2026 and cut off the service’s access to customer accounts on 17 October. Attackers used credentials belonging to the service to sign in to customers’ Microsoft 365 accounts. Microsoft attributes the attack to Storm-0940, a group it describes as China-state aligned.
How quickly should security updates be applied?
The NCSC recommends applying critical and high-risk security fixes within 14 days of release, and Cyber Essentials sets the same limit. For a flaw that is already being exploited, sooner is better: Mandiant’s M-Trends 2026 found attackers now often exploit flaws before a fix exists.
Flux Dynamics is a fractional CTO who builds. If you are not sure who looks after which of your systems, tell us what you run and we will help you put a name against each one.