Cyber insurance: the events of the week from 17 to 24 October 2026

Five cyber events from the week of 17 to 24 October 2026, four of them linked to the supply chain: PHP2Shell, ConnectWise, LiteLLM and Railway, n0n and Capcom. With the insurance impact and the questions to bring to renewals.

Week of 17 to 24 October 2026

The week of 17 to 24 October 2026 confirms that cyber risk travels more and more through the supply chain. Four of the five selected events do not start with a direct attack on the victim, but with a supplier, a library or a piece of software used by thousands of companies. For those who underwrite cyber risk, analysing a single insured is no longer enough: what counts are the dependencies shared across the portfolio.

At a glance

PHP2Shell: two critical vulnerabilities in the PHP engine, exploited at scale within hours of the patch.
ConnectWise Cloud Backup: a compromised multi-tenant application opens access to the Microsoft 365 tenants of MSP customers. Microsoft attributes the attack to an actor aligned with the Chinese state.
LiteLLM and Railway: the artificial intelligence supply chain becomes a channel for credential theft.
n0n and the maritime sector: a compromised IT supplier brings ransomware into more than 40 companies in 18 countries.
Capcom: 11.7 million records exposed, a mass data breach with low severity per record.

The attacks of the week

1. PHP2Shell: a vulnerability at the heart of the web

Two flaws in the PHP engine (CVE-2026-109618 and CVE-2026-109619) allow remote code execution without authentication. They affect almost every version from 5.4 onwards and also allow reading the process memory, where credentials and API keys may be stored (SecurityWeek).

Disclosure was planned for 22 October, but the details leaked online on 20 October. The PHP Foundation brought the patches forward by one day and large-scale exploitation began a few hours later. According to AWS, some attacks were already under way before public disclosure (Risky Bulletin).

The perimeter is huge: PHP runs on about 70% of websites and almost half of them use versions that are no longer supported (Island). Several security agencies advised switching off PHP servers until they were updated. The comparison with Log4Shell in 2021 is inevitable (Dark Reading).

2. ConnectWise Cloud Backup: the MSP as a multiplier

An application credential of ConnectWise Cloud Backup (formerly SkyKick), a Microsoft 365 backup service used by MSPs, was compromised. From 15 October the attacker used it to enter customer tenants, exploiting the trust already granted to the application. Estimates point to at least 173 compromised tenants (Rescana).

ConnectWise suspended the service on 17 October and, the following day, also SaaS Security and Cloud Management. As of 19 October customers could neither run backups nor restore data (Help Net Security).

On 21 October Microsoft attributed the attack to Storm-0940, an actor aligned with the Chinese state. The group used an AI agent framework, ARTEX, to attempt access to more than 2,250 tenants; in some cases it reached privileged access in less than three hours (Microsoft).

3. LiteLLM and Railway: the artificial intelligence supply chain

On 21 October the release pipeline of LiteLLM, a Python library that connects applications to different language models, was compromised. Version 1.107.0 published on PyPI and Docker contained credential-stealing malware (LiteLLM). It remained available for about two hours, on a package with about 23 million weekly downloads; it is the second incident of this kind for LiteLLM in 2026 (Datadog).

The next day the cloud platform Railway announced that attackers had accessed the encrypted environment variables of some customers and decrypted part of them. It asked all users to rotate API keys and cloud credentials. According to Railway, the attack is part of a wider campaign against AI service providers (TechCrunch).

4. n0n: ransomware through a supplier in the maritime sector

The n0n ransomware group moved from the network of an IT supplier to the maritime sector into more than 40 port authorities, shipping companies and logistics operators in 18 countries. The evidence points to the South Korean company CyberLogitec, which counts half of the victims among its customers. The ransom demands published on the group's site total 1.2 billion dollars (Risky Bulletin).

The payment deadline was 19 October and most victims did not pay, so their data was published. It is one of the most serious attacks on the maritime sector since NotPetya.

5. Capcom: the mass data breach

On 19 October Capcom detected unauthorised access to CAPCOM ID account data. 11,774,247 records with email address and technical account data are exposed; no payment data appears to be involved (Help Net Security). The main risk for the people affected is targeted phishing.

Other events worth noting

Quest Diagnostics (Healthcare): breach of the test ordering and results application, reported to the SEC
Iwai Cosmo Securities (Finance): access to the online trading system, unauthorised orders on at least 7 accounts
Onamae Desktop Cloud (Cloud / VPS): malware installed on more than 26,700 virtual servers
Richmond Public Schools (Education): ransomware across all 53 schools in the district
ETS / California (Education): data of millions of students stolen from a supplier's SFTP server

Insurance impact

The five events touch different covers, but three share one feature: they can generate correlated claims across many insureds in the same portfolio.

PHP2Shell. Covers potentially triggered: incident response, data breach, business interruption, possible voluntary shutdown of systems. Accumulation potential: high, the same vulnerability across a large part of the web. Contractual issue: definition of a single event and aggregation of claims.
ConnectWise. Covers potentially triggered: dependent business interruption, data restoration, data breach; tech E&O for MSPs and the supplier. Accumulation potential: high, one application, hundreds of tenants. Contractual issue: state attribution and the state-backed exclusion.
LiteLLM / Railway. Covers potentially triggered: data breach, credential theft, claims that emerge late; tech E&O for suppliers. Accumulation potential: medium to high, concentrated on technology and AI companies. Contractual issue: discovery date and policy period.
n0n maritime. Covers potentially triggered: cyber extortion, dependent business interruption, data breach. Accumulation potential: medium to high, more than 40 victims in the same sector. Contractual issue: coordination between the cyber policy and marine covers.
Capcom. Covers potentially triggered: notification, crisis management, privacy liability. Accumulation potential: low, a single event. Contractual issue: cost per record and the applicable regulatory framework.

Attribution is not enough to exclude. The ConnectWise case reopens the question of attacks traced back to a state. Since 31 March 2023 Lloyd's has required standalone cyber policies to carry an exclusion for state-backed attacks, in addition to the war exclusion (Lloyd's, Market Bulletin Y5381). The bulletin, however, links the exclusion to an impact threshold: the attack must significantly impair the functioning or security of a state (Simmons & Simmons). An espionage and data theft operation such as Storm-0940's is unlikely to reach that threshold. The outcome will depend on the LMA clause adopted and on the attribution mechanism set out in the wording.

The supplier as a point of accumulation. ConnectWise, CyberLogitec and LiteLLM show the same pattern: one compromised supplier, many victims downstream. For dependent business interruption cover, what counts is how the policy defines the supplier (IT or non-IT, named or generic) and which sublimits apply.

Preventive shutdown. With PHP2Shell several agencies recommended switching off servers that had not been updated. It is the typical case in which to check whether the policy covers a voluntary interruption decided to contain a risk, even without an actual compromise.

What to bring to renewals

The events of the week suggest some concrete questions for underwriting questionnaires and calls:

Critical patch management. How quickly does the insured apply a critical patch on internet-facing systems? Is there an inventory of the PHP versions in use, including those no longer supported?
Third-party applications with privileges. Which external applications have access to the Microsoft 365 or Google Workspace tenant, and with which permissions? Is there a periodic review of OAuth consents?
Dependence on the MSP. Does the insured rely on an MSP for IT management or backups? Is the backup independent of the supplier and tested for restoration?
Software pipeline security. For technology companies: are dependency versions pinned? Are release credentials protected and rotated?
Secrets management. Are API keys and cloud credentials stored in a dedicated system and can they be rotated quickly after an incident?
Critical sector suppliers. For sectors such as maritime or logistics: which shared IT platforms does the insured use, and how many other insureds in the portfolio depend on the same ones?

On the portfolio side, it is worth mapping exposure to ConnectWise, LiteLLM and the main IT suppliers of the maritime sector. They are the first indicators for estimating a possible accumulation before claims arrive.