Security Signal Weekly: October 17-23, 2026

OverviewTwo PHP flaws were being probed before defenders had patches, a stolen ConnectWise application credential opened Microsoft 365 tenants, and a Railway intrusion put customer secrets at risk. Those three stories would have been enough for an ugly week. The rest of the list adds exploited SD-WAN and media servers, a signed-software abuse campaign, emergency GitLab and Node.js fixes, compromised certificate-authority keys, and a ransomware operation that has already reached hundreds of victims.The common failure is concentrated trust. A runtime, backup application, build platform, orchestrator, signed installer, or certificate authority can reach far more than its own host. Defenders have to close the original path and then inspect everything that path was allowed to touch.Reality check: This week’s fixes do not fit in one patch window. Inventory the trusted systems first, preserve evidence where exploitation is possible, rotate credentials exposed through those systems, and…