On Tuesday, October 21, 2026, the PHP project published emergency fixes for two critical flaws nicknamed PHP2Shell. If your website runs on WordPress, it runs on PHP.

Knowing it exists, deciding whether it affects you, and acting before an attacker does: that is threat intelligence. ISO 27001 has required it since 2022. For an SMB, it has to fit in a chat channel, not in a committee.

Three alerts in six weeks

PHP2Shell

The two flaws (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a web server without an account. Every PHP installation that serves web pages is affected. The Canadian Centre for Cyber Security published its alert the same day.

The October 21 fixes cover the 8.2 to 8.5 branches. The PHP project no longer publishes fixes for older versions.

Amazon observed an exploitation attempt as early as October 17, four days before the public announcement. At the time of its alert, the Canadian Centre had not yet seen active exploitation. Proofs of concept are already circulating.

PHP also hides where you do not look for it. On October 22, Palo Alto Networks said the supported versions of PAN-OS, the operating system of its firewalls, are affected, with no fix available at that time.

On October 23, the Canadian Centre updated its alert. A third flaw, CVE-2026-115560, is not fixed by the October 21 updates. It only affects applications that change the serialization handler while they are running. Until a fix is out, the mitigation already recommended for CVE-2026-109619 is enough: disable session upload progress tracking (session.upload_progress.enabled=0).

Has your web host or your MSP applied the fixes? Do you know, or are you assuming?

The fridges in French supermarkets

On the night of October 11 to 12, 2026, the connected refrigeration systems of hundreds of supermarkets in France were hacked. Intermarché spoke of 150 to 200 stores. U stores were also hit.

According to the Mousquetaires group, the temperature was raised to 50 °C for six hours. The food was thrown out, and the Paris prosecutor’s office opened an investigation. The intrusion method has not yet been confirmed publicly.

In most companies, the fridge is not in the IT inventory. The refrigeration contractor installed it and connected it.

Industrial controllers

On September 8, 2026, the Canadian Centre published an advisory on a global campaign against programmable logic controllers connected to the Internet. These are the small computers that open a valve or set a pressure.

Attackers find them with services that scan the Internet, then try default or missing passwords. Once in, they changed settings, disabled alarms, and locked operators out. The Centre notes that several of these devices are exposed without the company that owns them knowing it. In Canada, in October 2025, the pressure controls of a municipal water system were manipulated.

The common point? Equipment installed by a third party, connected to the Internet, that nobody watches.

What is A.5.7?

Control 5.7 of Annex A is called “Threat intelligence.” It is one of the eleven controls added in the 2022 edition of the standard. It asks you to collect information about threats and analyze it so you can act.

ISO 27002 distinguishes three levels. Strategic intelligence is for management. For example, the Canadian Centre concludes that ransomware is the main cybercrime threat to critical infrastructure, and that the incidents known to the Centre have increased by an average of 26% a year since 2021. Tactical intelligence describes how attackers operate, such as default passwords on controllers. Operational intelligence is the known IP addresses and malicious files, which mostly live in the antivirus, the firewall, and the email filter of your MSP.

This is the start of incident management. An incident you did not see coming, you handle in a rush. A threat that was announced, you have time to close the door first.

The process has to stay light

Nobody in an SMB has an hour each quarter to ask what came out. Threat intelligence has to follow the pace of the alerts, not the pace of meetings.

  1. Alerts all arrive in the same place.
  2. Someone answers whether it concerns you or not. If it does not concern you, the alert stays there. That is your history.
  3. If it concerns you, you assess whether you are affected. Which version, which equipment, which supplier?
  4. If you are affected, you make an action plan. Who fixes it, what, and by when. The follow-up goes where you already track your tasks, such as your MSP’s ticket system.

No extra committee, and no extra meeting.

The channel is the register

A Teams or Slack channel works very well as the register. An auditor wants to see that the control works, not another spreadsheet. Three conditions, though.

  • Each alert gets a visible answer, even a short one, such as “does not concern us” or “affected, ticket opened.”
  • Messages are not deleted automatically. Check the retention policy of your channel.
  • Someone other than you can read it.

Tip: a Teams channel has its own email address, and Slack can receive RSS feeds. Subscribe the channel directly to your sources, and the alerts arrive on their own.

No Teams or Slack? A shared mailbox or a distribution list, such as veille@yourcompany.com, does exactly the same thing. You reply on the thread, and the decision is recorded with the date.

At Certi360, we use Signal to talk to each other. It is handy for a fast warning. It does not do the job of a register. Messages can be ephemeral, the history lives on phones, a new person does not see the old messages, and it is hard to show an auditor. If you are in the same situation, use Signal to warn people and keep the record somewhere else.

What to do, concretely

  • Name one person who answers the alerts, with a backup for vacations. You do not need a CISO.
  • Choose your sources and subscribe your channel to them. For example:
    • the Canadian Centre for Cyber Security (cyber.gc.ca);
    • CERT-FR (cert.ssi.gouv.fr), in French;
    • the Known Exploited Vulnerabilities (KEV) catalog from the U.S. CISA;
    • security advisories from your suppliers, such as Microsoft, your firewall, your web host, or your business software;
    • specialist media such as BleepingComputer or IT-Connect;
    • your MSP and your industry association.
  • Inventory what is connected to the Internet, including what third parties installed, such as fridges, controllers, cameras, or heating. Without an inventory, you cannot answer “are we affected?”
  • Ask your MSP and your web host what threat intelligence they do for you, and how they warn you. In writing.
  • At the management review you already hold, look in the channel at the alerts that led to an action.

In an audit, I ask to see the channel and one example of an alert that led to an action. A channel full of alerts with no answer does not pass. It means nobody is deciding.

In short, threat intelligence does not ask for an hour each quarter. It asks that an alert, once received, gets an answer.

Has your web host applied the PHP2Shell fix? If you do not know, you have your first alert to handle.

Want to know where you stand on this? Let’s talk.

References