Security Advisory: ConnectWise Incident and PHP Vulnerabilities
Kraft Kennedy has recently identified two security developments: a reported ConnectWise incident and newly disclosed critical vulnerabilities affecting PHP. Kraft Kennedy is actively reviewing available information, evaluating the environments and services we manage, and implementing appropriate safeguards. Below is an overview of these developments, the steps we are taking, and the precautions organizations should consider.
Understanding the ConnectWise Incident
ConnectWise has reported a security incident associated with a broader campaign targeting Microsoft 365 environments through compromised third-party application access. Incidents involving trusted applications can create risk because those applications may hold permissions to organizational data or services.
Kraft Kennedy’s Risk Committee is assessing relevant environments and services, reviewing available indicators, and monitoring additional information. Based on what we know at this time, we are not recommending a universal action for all clients related to ConnectWise.
PHP Vulnerabilities
Separately, two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, sometimes referred to as PHP2Shell, have been disclosed. These vulnerabilities may allow unauthenticated remote code execution, meaning an attacker could potentially run arbitrary code on a vulnerable web server without first logging in.
The Cybersecurity and Infrastructure Security Agency (CISA) has advised organizations to identify systems using PHP and apply appropriate security updates immediately, prioritizing internet-facing systems. If an affected system cannot be patched promptly, taking it offline until it can be updated is the safer course. Maintenance mode alone may not prevent exploitation.
Steps Kraft Kennedy is Taking
Out of an abundance of caution, Kraft Kennedy temporarily took our public website, App Bakery, and Client Portal offline while our technical teams assess potential exposure, validate safeguards, and determine the steps required for safe restoration. This precaution does not indicate that these services were compromised.
We will fully restore each service as soon as we have confirmed that it is secure to do so and will share updates when service status changes or material new information becomes available.
Recommended Actions for Organizations
- Ask your website and hosting providers whether your public-facing systems use an affected version of PHP, including any foundational systems such as hosting panels.
- Confirm that applicable security updates or vendor-provided mitigations have been installed.
- Prioritize internet-facing systems and associated hosting systems/panels.
- If an affected system cannot be patched immediately, take it offline until the update can be completed.
- Review third-party application access to Microsoft 365 and remove access that is unnecessary, outdated, or unrecognized.
- Remain alert for unusual activity and follow your established incident-response procedures if suspicious behavior is detected.
Next Steps and Additional Help
If you are unsure whether your systems are affected, contact your Kraft Kennedy representative. If you need time-sensitive assistance, an application package from App Bakery, or information that is temporarily unavailable through the Client Portal, please submit a support ticket or contact the Kraft Kennedy Help Desk.
We recognize the disruption that precautionary measures can cause. Protecting client environments remains our priority, and we will continue to monitor both developments and communicate directly when action is required.
Stay Connected
Looking for more ways to interact with Kraft Kennedy?
Check out our upcoming events!