We put together a special Wednesday CyberCall after two critical PHP vulnerabilities, known as php2shell, leaked a day before their planned disclosure. John Hammond of Huntress and John Strand of Black Hills Information Security joined me to talk through what happened and what MSPs should be doing about it.

John Hammond explained why a flaw in PHP itself matters so much. It sits underneath WordPress, Drupal, Joomla, Magento, and many other platforms, and it can lead to full remote code execution on the server. He also shared why he took his own WordPress site offline until the patch was released. John Strand walked through the exposure numbers, with more than 230,000 internet-facing servers on PHP 7.x, 8.0, and 8.1 alone. He also explained how AI has shortened the time between a patch and a working exploit.

We also covered:

• Whether coordinated disclosure still works when leaks happen this easily
• Why “the website isn’t our responsibility” won’t hold up when a client gets breached
• How to explain the risk to business owners in terms they care about
• What to do with clients stuck on older PHP versions that won’t get a patch
• Why you shouldn’t run the early proof of concept code that’s circulating online

If your clients have websites, ecommerce stores, or any software that runs on PHP, this is worth a listen before the end of the week.

Even if you've never used ConnectWise Cloud Backup, formerly SkyKick, this week's incident holds a lesson for every MSP. On October 15, a threat actor used a stolen credential belonging to that app to sign in to customer Microsoft 365 tenants. Huntress has confirmed more than 160 so far, and it believes the threat actor also abused several of ConnectWise's Cloud Management apps. ConnectWise has shut off Cloud Backup access while it investigates, so backups are paused for the MSPs and clients who rely on it.

What makes this one interesting is how the threat actor got in. They used a trusted app that already had broad access to client tenants, and all of us have apps like that in our clients' environments. In one tenant, Huntress also found a ConnectWise app that made itself a Global Administrator and then added new keys to two other apps, including Huntress's own. With Global Administrator rights, an app can reach a lot more than backups.

Today we're going to cover what we know, what we don't, and what MSPs should be doing this week, whether you were affected or not, including how to handle regulated clients.

Joining us are Andrew Brandt from Huntress, Kelvin Tegelaar from CyberDrain, John Strand from Black Hills Information Security and Antisyphon Training, and Eric Tilds for the legal perspective.

Huntress just released what they're calling the Tragic Quadrant. Instead of ranking threats by how much press they get, it ranks them by two things: how often Huntress actually sees them, and how close they put a business to real damage. That's based on data from more than 5 million endpoints, 15 million identities, and nearly 300,000 organizations, and a lot of those are our clients.

What caught my attention is the top right corner, where the threats are both common and dangerous. That's RMM abuse, mailbox manipulation, and account takeover. If you're an MSP, at least one of those sits squarely in your lane, because the most common threat on the list is attackers using the same remote tools we use every day.

We'll walk through the quadrant, talk about what Jamie Levy's team is seeing, and get into what MSPs can do about it this quarter. Bring your questions as we go.