Weekly Roll-Up — Week ending 2026-10-23
This partial-week edition covers a sharp collision between public-service disruption, trusted cloud access, and software supply-chain risk. Government agencies took vulnerable PHP services offline as attacks spread, showing how quickly an internet-facing runtime problem can become a citizen-service issue. A ConnectWise path then gave a China-aligned group high-speed access attempts against Microsoft 365 customers, with AI helping scale familiar identity abuse. Meanwhile, a poisoned LiteLLM release put cloud, developer, and AI credentials at risk across multiple operating systems. The issue also tracks ransomware pressure on critical organizations and a Railway incident that may expose secrets used far beyond the original platform. Across these stories, the recurring challenge is trust: trusted software, trusted integrations, trusted credentials, and trusted recovery systems can all become attack paths. Direct story links are collected at the bottom of the article. Read the issue for practical actions your team can take now.