PHP2Shell vulnerabilities confirmed exploited in the wild

Security researchers have confirmed that the critical PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are being actively exploited in real-world attacks. The flaws, which affect the widely used PHP programming language, allow attackers to achieve remote code execution (RCE), potentially giving them control over vulnerable web servers.

Researchers operating internet-facing honeypots captured evidence of successful exploitation against an Apache server running PHP 8.4.26, providing the strongest confirmation to date that attackers can reliably leverage the vulnerabilities. Earlier reports had identified widespread scanning and exploitation attempts, but most observed attacks were unsuccessful before security patches became available.

The vulnerabilities have attracted significant attention due to PHP’s extensive use across websites, web applications, and content management systems globally. Security vendors previously warned that threat actors began probing for vulnerable systems even before patches were publicly released, and activity has increased substantially following disclosure.

The PHP development team has already released security updates, and organisations are being urged to apply patches immediately. Experts warn that unpatched systems remain at high risk of compromise, while a newly disclosed PHP vulnerability without an available patch is adding further concern for defenders monitoring internet-facing infrastructure. Read our guidance HERE.

Former defence minister claims Jaguar Land Rover cyberattack was state-backed

Fresh debate has emerged around the cyberattack that severely disrupted Jaguar Land Rover (JLR) in 2025 after former UK Armed Forces Minister Al Carns publicly suggested the incident was backed by a hostile foreign state. The attack, previously linked to a Russian cybercrime group, forced Britain's largest car manufacturer to halt production for five weeks and disrupted thousands of businesses across its supply chain.

The cyberattack is estimated to have caused between £1.6 billion and £2.1 billion in economic damage, making it one of the most costly cyber incidents in UK history. Around 5,000 organisations, including dealerships, suppliers and repair partners, were reportedly affected as JLR was forced to shut down key IT systems and manufacturing operations.

While Mr Carns clarified that his comments were not based on an official government assessment, he argued that an attack of such scale would be unlikely to occur without the awareness of a host nation. UK officials have not formally attributed the incident to a state actor, and the government has declined to comment on ongoing investigations.

The attack prompted a major international response involving the UK's National Cyber Security Centre (NCSC), National Crime Agency (NCA), the FBI and private-sector cybersecurity experts. The incident has renewed discussions around critical infrastructure protection, supply chain resilience and the growing overlap between cybercrime and geopolitical threats.

ENGIE confirms customer data breach following third-party platform compromise

French energy provider ENGIE has confirmed that customer data was stolen after attackers compromised a marketing platform used by one of its business partners. The incident did not affect ENGIE’s internal IT systems, but unauthorised access to the third-party platform exposed customer information linked to the company’s French operations.

According to ENGIE, the compromised data includes customer contact details and limited information related to energy contracts. Exposed information reportedly includes names, postal addresses, email addresses, phone numbers, customer identifiers and contract numbers. The company stressed that no banking or payment data was accessed during the breach.

ENGIE said it quickly revoked the attackers’ access, notified the relevant authorities and contacted affected customers. Those impacted have been advised to remain vigilant against phishing and fraud attempts, as cybercriminals often use stolen personal information to make scam communications appear more legitimate.

While the company has not disclosed how many customers were affected or attributed the attack to a specific threat group, the incident highlights the cybersecurity risks associated with third-party suppliers and marketing platforms. The breach serves as another reminder that organisations must extend security oversight beyond their own systems to include partners and service providers that handle customer data.

Belgian Tax portal taken offline following cyberattack

Belgium’s Federal Public Service Finance (FOD Financiën) has temporarily taken several online services offline, including the MyMinfin tax portal, after detecting a cyberattack targeting its digital infrastructure.

MyMinfin is widely used by individuals and businesses to manage tax returns, view financial documents and access government tax services. As a precautionary measure, authorities suspended access to the platform while technical teams investigate the incident and implement additional security measures.

The disruption has also affected other digital services operated by the tax authority, prompting officials to announce that certain tax filing deadlines will be extended. Updated submission dates are expected to be communicated once services are restored.

At this stage, FOD Financiën says there is no evidence that personal or financial data has been compromised, though investigations remain ongoing. Authorities continue to assess the full scope of the incident and are working to secure affected systems before bringing services back online.

The attack highlights the growing cybersecurity challenges facing government agencies and critical public services, where service availability and data protection remain key priorities in the face of increasingly sophisticated cyber threats.

Sony data breach exposes 2.5 million customer records

Sony Network Communications, a subsidiary of Sony Group, has confirmed a significant data breach that exposed the personal information of approximately 2.5 million current and former customers. The incident affected the company's So-net internet service platform and was discovered several days after unauthorised access to customer databases occurred.

According to the company, the compromised records include customer names, phone numbers, email addresses, user IDs, dates of birth, gender information and internet connection identifiers. While no banking details, payment card information or financial account data were exposed, investigators confirmed that more than 54,000 email accounts and associated passwords were also accessed, prompting security warnings and password reset recommendations.

The breach impacts both So-net customers and users of services provided through a partnership with NTT Docomo, one of Japan's largest telecommunications providers. In response, NTT Docomo has warned customers to remain alert for phishing campaigns and fraudulent websites attempting to exploit the stolen information.

Sony has reported the incident to Japan's privacy regulator and continues to investigate the cause and extent of the compromise. While there is currently no evidence that the stolen data has been actively misused, the breach underscores the growing cybersecurity risks facing telecommunications providers and the value of customer data to cybercriminals.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.