Cybersecurity Month 2026 has ended up being far more poignantly named than anticipated; over the course of the last few weeks, we’ve seen a number of developments, any one of which alone could have stood as a major incident. What does this mean going forward, what comes next, and what can we do?
Vulnerabilities, attacks and compromises
There has been a number of major failings on an international scale in recent days. The big ones that caused the most buzz have been, in no particular order:
- PHP critical vulnerabilities allowing code execution on unpatched websites. The flaw, coined php2shell, affected most versions of the open-source, back-end programming language used by a majority of the internet. under the right conditions, hackers could exploit the bugs to take control of affected web servers and steal sensitive data.
- Windows DNS Server flaws – namely a integer underflow issue – enabling an unauthorized attacker to trigger code execution over the network. Modern Windows systems were affected, as are practically all Windows Server versions.
- An integer overflow in GitLab CE/EE that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server.
- A missing authentication for critical function weakness affecting Dell Container Storage Modules (CSM), the Kubernetes-native storage integration layer that many enterprises rely on to connect clusters to Dell PowerFlex, PowerStore, PowerScale, Unity, and PowerMax backends. The flaw allows an unauthenticated, network-reachable attacker to invoke privileged administrative functions outright.
- SAP Cloud SDK for Python with an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications allowing for server-side request forgery – An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server.
There are more – fourteen or fifteen major CVE events of a Common Vulnerability Scoring System (CVSS) score of 8 or above, out of a maximum 10. The amount and severity of incidents is extreme, and the timing during Cybersecurity Month 2026 gives us a good framing to bring some of the otherwise not very public nature of security incidents to a broader public.
What happens now?
The majority of the recent flaws have been patched or otherwise addressed. The immediate concern should be for all parties to ensure they have downloaded the relevant patches and ensured the fixes are implemented.
The uncomfortable truth is that several of these vulnerabilities have been discovered thanks to automated tools – tools that make discovering flaws faster, in concert with tools that make exploiting them easier, are going to mean that even incidents of this severity will occur more often than previously.
Death of prevention
The simple truth that many cybersecurity experts have to face is one that has been increasingly obvious as time goes on: prevention and preventative measures still have a part to play, but are also increasingly becoming only the first layer in a more complex defense.
Crucially, with the increasing ease of detecting new flaws it needs to be the inner parts of your security posture that pick up the slack – detection, mitigation and recovery. Detection can also be helped by the same push towards AI systems that is leading to a weakening in prevention; the same system that can identify weaknesses can identify out of pattern behavior in compromised accounts, for example. Mitigation and recovery both require software in place.
Backups, archives and data management systems are going to become ever more crucial to enable a more comprehensive strategy of keeping your data safe, intact and retrievable in an increasingly hostile online world.
Your Data in Your hands – With TECH-ARROW
by Matúš Koronthály
Image generated by Canva
