What is hitting businesses like yours, and what applies to you

1. 01 Critical Ransomware and recovery denial Crews hit backups, identity and hypervisors first so there is nothing to restore. Recovery costs keep rising. $1.7M average recovery cost, before any ransom

   Still the most financially damaging threat to mid-market businesses, and 48% of all breaches now involve it (Verizon DBIR 2026). The economics have shifted: the median demand fell to about $698K and only 48% of victims paid, the second-lowest rate on record, yet the average recovery cost rose 11% to $1.7M before any ransom (Sophos State of Ransomware 2026). Encryption succeeded in 56% of attacks, and 79% began with a compromised identity. The 2025 pattern Mandiant calls recovery denial: groups running Akira and Qilin went after backup infrastructure, identity services and virtualization management planes before encrypting anything, so the victim has nothing to restore from (M-Trends 2026).

   Who it targets

   • Healthcare
   • Manufacturing
   • Retail
   • Professional services
   • Education

   The bar right now

   Backups the attacker cannot reach: immutable or offline, under separate credentials, and actually restored from on a schedule; MFA and separate admin accounts on the backup and hypervisor consoles; an incident plan that assumes the network, the identity provider and the backups are all down.

2. 02 Critical Vulnerability exploitation, now the most common way in Exploits overtook stolen credentials this year. Live example: PHP2Shell, two unauthenticated RCE bugs in PHP. 31% of breaches start with an exploited vulnerability

   For the first time in nineteen years of the DBIR, vulnerability exploitation is the top initial access vector: 31% of breaches, ahead of stolen credentials, while the median time to patch slipped from 32 to 43 days (Verizon DBIR 2026). Mandiant saw the same thing from the incident-response side, with exploits the leading infection vector for the sixth year running at 32% (M-Trends 2026). Zero-days exploited before public disclosure rose 42%, and 40% of the vulnerabilities China-nexus groups exploited were in edge devices that typically go unmonitored (CrowdStrike 2026). The current case is PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, disclosed October 21, 2026. They let an unauthenticated request run code on any server that serves PHP over the web (Apache mod_php, PHP-FPM, php-cgi and the like), on versions going back to PHP 5.4. Fixes shipped the same day in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for the end-of-life 7.4 to 8.1 branches. Proof-of-concept code was public within a day and several vendors reported exploitation attempts, one of them four days before disclosure. Most small-business websites, including anything on WordPress, run PHP.

   Who it targets

   • Any business with a website
   • WordPress and PHP hosting
   • VPN and firewall users
   • On-prem infrastructure

   The bar right now

   Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 this week, and ask your host or agency which version your site runs; an end-of-life branch needs the backport or a migration. More generally: patch anything internet-facing on a days-not-weeks cadence, use the CISA Known Exploited Vulnerabilities catalog as the priority list, and retire appliances the vendor no longer updates.

3. 03 High AI-enabled social engineering and agentic attacks Phishing is indistinguishable from real mail, the phone is an attack vector, and AI agents run intrusions. +89% attacks by AI-enabled adversaries, year over year

   Attacks by AI-enabled adversaries rose 89% year over year, fake-CAPTCHA lures 563% (CrowdStrike 2026). Voice phishing intrusions doubled again in the first half of 2026 (CrowdStrike Threat Hunting Report 2026). Reported cyber-crime losses hit a record $20.9B in 2025, up 26%, with business email compromise at $3.05B across 24,768 complaints and more than $30M of it attributed to AI-assisted tactics (FBI IC3 2025). Verizon, working with Anthropic on threat-actor data, found 44% of AI-assisted initial access was phishing and 32% vulnerability exploitation (DBIR 2026). Attackers using AI agents to automate reconnaissance, intrusion and extortion end to end have been documented in incident disclosures by AI vendors since late 2025.

   Who it targets

   • All industries
   • Finance teams
   • Executive teams

   The bar right now

   Out-of-band verification for any payment or credential change, no exceptions for executives; phishing-resistant MFA; training that covers voice and video, not just email.

4. 04 High Identity attacks and help-desk social engineering Stolen credentials, session hijacking and help-desk resets have replaced malicious attachments as the way in. 22 sec median hand-off from first access to a second crew

   82% of initial-access detections are now malware-free: valid credentials, trusted identity flows and approved SaaS integrations instead of malicious attachments (CrowdStrike 2026). Average eCrime breakout time fell to 29 minutes, the fastest observed 27 seconds. Access brokers hand a foothold to a second group in a median 22 seconds, down from over eight hours in 2022 (M-Trends 2026). Scattered Spider relied almost entirely on talking help-desk staff into self-service password resets, and 79% of ransomware incidents began with a compromised identity (Sophos 2026).

   Who it targets

   • Cloud-first organizations
   • Remote workforces
   • SaaS-heavy teams

   The bar right now

   Phishing-resistant MFA (FIDO2 or passkeys) for everyone with admin or finance access; identity verification before any help-desk reset; conditional access that notices a new device or country.

5. 05 High Supply chain and third-party attacks One vendor compromise, or one stolen integration token, becomes hundreds of downstream data thefts. 48% of breaches involve a third party

   Breaches involving a third party or the supply chain jumped 60% and now account for 48% of the total (Verizon DBIR 2026). Recent campaigns hit the connective tissue: stolen OAuth tokens for SaaS integrations turned single vendor compromises into hundreds of downstream data thefts, and self-propagating malware reached the open-source package ecosystem. If a vendor holds your data, or a token that can reach it, their security posture is part of your attack surface.

   Who it targets

   • SaaS users
   • MSP clients
   • Enterprise

   The bar right now

   An inventory of every integration and the data it can reach; least-privilege scopes on OAuth grants; vendor security questions in procurement, not after the fact.

6. 06 Elevated Cloud and SaaS exposure Misconfiguration, permissive IAM and one admin account without MFA are still the entry points. 23% of cloud compromises began with a phone call

   The most common way into a cloud environment in 2025 was voice phishing, at 23% of cloud compromises Mandiant investigated (M-Trends 2026): someone talked an admin out of a credential or a reset. Misconfigurations, overly permissive IAM policies and exposed storage remain the technical entry points, and large-scale data-theft campaigns against SaaS platforms showed that one weak integration or one admin account without MFA is enough. Most breaches are not sophisticated: they exploit basics that were never locked down.

   Who it targets

   • Cloud-native
   • Multi-cloud
   • Startups

   The bar right now

   MFA on every admin account with no legacy-auth exceptions; a quarterly review of who can see what; alerts on public storage and new API keys.

7. 07 Elevated Nation-state pre-positioning State groups sit inside telecom and infrastructure holding access, often via ordinary businesses’ edge gear. 40% of China-nexus exploited vulnerabilities were in edge devices

   The Cyber Centre assesses China as the most sophisticated and active state cyber threat to Canada, and judges that state actors are very likely pre-positioning in critical infrastructure for future disruptive operations (CCCS National Cyber Threat Assessment 2025-26). 40% of the vulnerabilities China-nexus groups exploited in 2025 were in edge devices that typically lack monitoring (CrowdStrike 2026), and Mandiant attributes much of the rise in dwell time to long-term espionage and North Korean IT-worker operations (M-Trends 2026). This matters beyond critical infrastructure: these campaigns route through the unpatched routers and firewalls of ordinary businesses. Canada answered in June 2026 with the Critical Cyber Systems Protection Act, which will bring mandatory incident reporting to designated operators once it is brought into force.

   Who it targets

   • Telecom
   • Critical infrastructure
   • Government suppliers

   The bar right now

   Replace end-of-life routers and firewalls; log and review outbound traffic from network gear; treat the joint CISA and CCCS advisories as a patch list.

Sources CrowdStrike Global Threat Report 2026 · Mandiant M-Trends 2026 · Verizon DBIR 2026 · FBI IC3 2025 Annual Report · CCCS National Cyber Threat Assessment 2025-26 · Sophos State of Ransomware 2026 · PHP2Shell advisory (CVE-2026-109618, CVE-2026-109619) · CISA Known Exploited Vulnerabilities catalog