Cyber Brief: PHP Flaws, Token Attacks and AI Supply Chain Risk

This week's security landscape is shaped by a consistent and instructive theme: attackers are finding ways to exploit the layers of trust that organisations depend on every day — trusted software, trusted platforms, trusted identities, and trusted people. From critical vulnerabilities in one of the web's most widely used scripting languages, to token-based attacks targeting Microsoft 365 accounts, to a compromised AI development library, and AI-assisted social engineering at the help desk, UK organisations are being reminded that the foundations of digital trust require active, ongoing maintenance rather than passive assumption.

Critical PHP Vulnerabilities Are Being Actively Exploited — Here Is What to Do

Two critical remote code execution vulnerabilities in PHP — tracked as CVE-2026-109618 and CVE-2026-109619 — have been confirmed as actively exploited in the wild, according to threat intelligence published by Palo Alto Networks Unit 42 and reporting from Dark Reading and Wired. The flaws, which affect PHP's core web scripting engine, allow an unauthenticated attacker to execute arbitrary commands on a vulnerable server. PHP underpins a significant proportion of the world's web infrastructure, including widely used content management systems such as WordPress, Drupal and Joomla, meaning the potential attack surface is substantial. Security researchers noted that AI tools were used both to help discover the vulnerabilities and to accelerate the development of working exploits, compressing the window between disclosure and active exploitation.

For UK businesses, the immediate concern is any internet-facing web application or CMS running on PHP. Patching is available, but Dark Reading notes that remediation is not as straightforward as a single update click — organisations running customised or legacy PHP applications may face compatibility challenges that require careful testing before deployment. Hosting providers, managed service providers and development teams all need to be part of the response conversation. The broader lesson here is that AI is beginning to change the economics of vulnerability exploitation: the time between a flaw being discovered and it being weaponised is shortening, which places greater pressure on organisations to maintain current patching cycles and reduce their exposure to unmanaged legacy systems.

Why it matters

For UK businesses running PHP-based websites, web applications or CMS platforms, this is a prompt to confirm your PHP version, check whether patches have been applied, and verify that your hosting provider or development team has assessed your exposure. Where patching cannot be applied immediately, consider whether web application firewall rules or other compensating controls are in place.

Source: Palo Alto Networks Unit 42

Token-Spraying Attacks Are Targeting Microsoft 365 Accounts at Scale

Security researchers have identified a widespread campaign targeting Microsoft 365 accounts using a technique known as token spraying, according to reporting by Infosecurity Magazine. The campaign combines phishing, stolen session tokens and social engineering to gain access to corporate email environments, with the goal of enabling business email compromise. Unlike traditional credential-based attacks, token spraying bypasses multi-factor authentication by reusing stolen session tokens — the short-lived credentials that are issued after a successful login — meaning that MFA alone does not protect against this technique. Researchers linked multiple intrusion attempts to a coordinated campaign targeting organisations across sectors.

This matters for UK organisations because Microsoft 365 is the dominant productivity and email platform across UK business, and business email compromise remains one of the most financially damaging attack types affecting UK companies. The use of stolen session tokens is a well-established technique, but the scale and coordination of this campaign suggests it is being deployed systematically rather than opportunistically. Organisations that have invested in MFA may feel a degree of confidence that is not fully warranted here — token theft can occur through phishing pages that proxy authentication in real time, meaning a user can complete an MFA challenge and still have their session token captured. Conditional access policies, token lifetime controls and anomaly detection in sign-in logs are the relevant defensive layers to review.

Why it matters

For UK organisations using Microsoft 365, this is a prompt to review your conditional access policies, check whether session token lifetimes are appropriately restricted, and ensure that your security team is monitoring sign-in logs for unusual access patterns such as logins from unexpected locations or devices. MFA is necessary but not sufficient on its own against this class of attack.

Source: Infosecurity Magazine

LiteLLM Supply Chain Compromise Highlights Risk in AI Development Tooling

Microsoft Threat Intelligence has published a detailed analysis of a supply chain compromise affecting LiteLLM version 1.107.0, a widely used open-source Python library that provides a unified interface to large language model APIs. According to Microsoft's security blog, the compromised package used Python startup hooks to silently steal credentials from developer environments and load remote code at runtime — a technique designed to be difficult to detect during routine code review. LiteLLM is used extensively by development teams building AI-powered applications, meaning the compromise had the potential to affect a broad range of organisations integrating AI capabilities into their products and internal tooling.

This incident is a clear illustration of how the rapid adoption of AI development libraries is creating new supply chain risk vectors that many organisations have not yet fully accounted for. Development teams working with AI frameworks often move quickly, pulling in open-source dependencies with less scrutiny than might be applied to more established libraries. For UK organisations building or procuring AI-enabled software, this is a reminder that the software supply chain now extends into the AI tooling ecosystem — and that the same principles of dependency verification, software composition analysis and least-privilege credential management apply there as much as anywhere else. The use of Python startup hooks to execute malicious code is a technique that can persist across environments if not actively detected.

Why it matters

For UK development and security teams working with AI libraries and open-source Python packages, this is a prompt to review your dependency management practices, check whether software composition analysis tools are in place, and confirm that developer environments are not storing credentials in ways that could be exfiltrated by a compromised package. Any teams using LiteLLM should verify they are not running the affected version.

Source: Microsoft Security Blog

AI Is Making Help Desk Social Engineering More Convincing — and More Scalable

Dark Reading reports that threat actors are increasingly using AI tools to impersonate employees and bypass help desk identity verification processes, with fraudsters calling support teams and politely requesting access resets, password changes or account modifications. The technique does not rely on malware or technical exploits — instead, it exploits the human tendency to extend trust to callers who sound plausible, prepared and confident. AI voice synthesis and real-time information gathering are making these calls harder to distinguish from legitimate requests, and the approach scales in a way that traditional social engineering does not.

For UK organisations, the help desk represents a significant and often underappreciated point of exposure. Identity verification processes at the service desk are frequently inconsistent, under-documented or reliant on information that an attacker could reasonably obtain — such as an employee's name, job title, manager or last four digits of a phone number. The MGM Resorts breach in 2023 was a high-profile example of this attack path, and the technique has continued to evolve. As AI tools lower the barrier to convincing impersonation, organisations that have not reviewed their help desk verification procedures recently are carrying a risk that is difficult to detect through technical controls alone. This is fundamentally a process and awareness challenge as much as a technology one.

Why it matters

For UK organisations, this is a prompt to review your help desk identity verification procedures and confirm they do not rely solely on information that could be researched or synthesised by an attacker. Consider whether out-of-band verification steps, manager approval workflows or hardware token confirmation are appropriate for high-risk requests such as MFA resets or account recovery.

Source: Dark Reading

Today's Key Actions

• Confirm whether any internet-facing systems, web applications or CMS platforms in your environment are running PHP, check the version in use, and verify that patches for CVE-2026-109618 and CVE-2026-109619 have been applied or that compensating controls such as WAF rules are in place.
• Review your Microsoft 365 conditional access policies and session token lifetime settings, and ask your security team to check sign-in logs for anomalous access patterns that may indicate token reuse from unexpected locations or devices.
• Ask your development and engineering teams to audit AI and open-source Python library dependencies for the affected LiteLLM version, and confirm that software composition analysis tooling is in place to flag future compromised or malicious packages.
• Review your help desk identity verification procedures to confirm they include steps that cannot be easily bypassed by a well-prepared caller using AI-assisted impersonation, particularly for high-risk requests such as MFA resets and account recovery.
• Confirm that clear ownership exists across your organisation for patching, identity security, supply chain risk and help desk security procedures — and that each area has a named individual or team accountable for keeping controls current.

Secarma Insight

What this week's stories collectively illustrate is that attackers are not always looking for novel techniques — they are looking for the gaps between what organisations assume is protected and what is actually being maintained. Patching cycles, session management, dependency hygiene and help desk procedures are not glamorous security topics, but they are the areas where real-world breaches continue to begin. Mature security programmes are built on the discipline of keeping these foundations in good order, reviewing them regularly, and ensuring that ownership is clear enough that nothing falls through the cracks. Organisations that invest in that kind of practical, consistent discipline are significantly better placed than those waiting for a single technology to solve the problem for them.