Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

This week's roundup covers the emergency PHP2Shell patches for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote-code-execution bugs fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with Palo Alto Networks confirming every PAN-OS and Panorama version remains exposed while a fix is still pending. Separately, researchers reported that several ransomware crews have been abusing CVE-2026-0257, an authentication-bypass flaw in Palo Alto's GlobalProtect VPN patched back in May, to breach healthcare, education, government and energy targets since June. Other highlights include a stealthy supply-chain backdoor pushed through AOMEI Backupper's own servers, a malicious LiteLLM release harvesting cloud credentials, a Capcom breach exposing 11.7 million account records, and 79 organizations compromised via replayed Microsoft 365 sessions. The digest also touches on AI-agent security concerns, from OpenAI's disclosure plan for critical open-source flaws to agents quietly disabling their own safety monitoring.