Security news, decoded.

Palo Alto Networks has confirmed that every version of PAN-OS and Panorama is exposed to PHP2Shell, a duo of critical unauthenticated remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619), and it has not yet released patched PAN-OS builds. Fortinet and Cisco are still auditing their product lines — Fortinet is reviewing 12 solutions and has already cleared FortiOS and 11 others as unaffected, while Cisco is examining 31 products and cloud offerings, including ISE, with no confirmed status either way and no workarounds available. Proof-of-concept exploit code is already circulating publicly on GitHub, though researchers at VulnCheck say most of it is flawed and real-world attacks are currently limited mostly to ARM64 systems or x86 machines lacking ASLR protection, meaning the practical danger is narrower than the flood of exploit attempts in server logs might suggest. None of the three vendors report active exploitation against their own products so far, but customers are urged to restrict management-interface exposure and watch each vendor's advisory for updates.

Cisco has rolled out fixes for 34 vulnerabilities spanning its Expressway Series, IOS XR, Snort 3, and Unified Communications product lines. The most severe flaw, CVE-2026-76466, is a critical remote code execution bug in Expressway caused by persistent cookies and weak client-certificate checks, letting an attacker reach the database service and issue RPC commands to run root-level commands on the device; it's resolved in Expressway version X15.5.20, which also closes eight CVE groupings and a medium-severity data-exposure issue. In Unified Communications products (including Emergency Responder, Prime Collaboration Deployment, Unified CM, CM IM&P, CM SME, and Unity Connection), Cisco closed nine CVEs, among them three critical bundled flaws — CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475 — tied to resource control, authentication, and input-validation weaknesses. Snort 3 received 13 fixes, led by critical issues CVE-2026-20236 and CVE-2026-20043 involving faulty calculations and out-of-bounds writes, delivered in Snort 3 version 3.12.4.0 and in updates for related products like Cyber Vision, Meraki MX, Secure Firewall ASA/FMC/FTD, and UTD for IOS XE. Separately, Cisco patched a high-severity denial-of-service flaw in IOS XR (CVE-2026-76505) and a high-severity privilege-escalation issue in Secure Client's Posture module (CVE-2026-76462). Cisco states none of these 34 vulnerabilities have been observed being exploited in real attacks.

Amazon's threat intelligence team has disclosed that attackers were already scanning for servers vulnerable to the PHP2Shell flaws—tracked as CVE-2026-109618 and CVE-2026-109619—on October 17, a full four days before the PHP Foundation shipped fixes on October 21. The earliest probing reportedly came through anonymization infrastructure, and after the bugs leaked online on October 20, proof-of-concept code spread rapidly, prompting Cloudflare, WatchTowr, Hadrian, Patchstack, and JFrog to independently confirm mass scanning and exploitation attempts both before and immediately following the official disclosure. Cloudflare's CEO reported thousands of exploitation attempts in the ten hours before the announcement, scaling to millions shortly after, though many circulating exploits are reportedly buggy or fake. Researchers estimate over a million internet-facing PHP installations—many running end-of-life versions—remain unpatched, and CISA has pushed organizations to urgently upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with some experts comparing the potential scale of fallout to the Log4Shell incident.

A newly disclosed flaw in RingRTC, the open-source calling library behind Signal's voice and video calls, could let a malicious caller keep receiving a victim's audio and video even after the victim thinks they've hung up. Tracked as CVE-2026-113380 and affecting RingRTC versions prior to 2.72.0, the issue stems from the library's call event queue accepting unlimited events from the remote peer without rate limiting or priority handling for hang-up commands. A researcher known as Imahian published a conceptual proof of concept showing that an attacker can flood this queue during a call, delaying the local hang-up event and allowing the call's media stream to keep flowing to the attacker while the victim believes the session has ended. MITRE assigned a CVSS 4.0 score of 9.3, reflecting high confidentiality and integrity impact with no privileges required, though the bug has not been added to CISA's Known Exploited Vulnerabilities list and there are no confirmed real-world attacks yet. The flaw affects every Signal client (Android, iOS, Desktop) bundling an outdated RingRTC build, and users are urged to update as the library has already been patched in version 2.72.0.

Node.js shipped security updates on October 21 for its 22.x, 24.x, and 26.x release lines, addressing ten vulnerabilities. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decompression library that could lead to remote code execution whenever an app decompresses attacker-supplied Brotli data, whether via node:zlib or an automatic fetch() response. Fixed releases are 22.23.4, 24.22.1, and 26.12.1, while end-of-life Node.js 20.x and earlier will not get the patch. A public proof-of-concept only achieved code execution on a deliberately weakened build, causing just a crash and limited memory read on standard builds, and no real-world exploitation has been confirmed. The same updates also fix three other high-severity bugs—two TLS hostname-validation bypasses (CVE-2026-106069, CVE-2026-105483) and a dns.resolve truncation issue (CVE-2026-105482)—plus several medium and low issues, including a weak randomUUID()/randomInt() reuse flaw (CVE-2026-106074) in snapshot or single-executable builds. Separately, Node.js now blocks eight compromised eMudhra intermediate CA keys and drops three emSign root certificates, mirroring a similar move by Go. Bundled components undici, c-ares, OpenSSL, and SQLite were also updated to resolve known vulnerabilities, and since no workaround exists for the Brotli flaw, administrators are urged to upgrade promptly.

Oracle has issued its October 2026 Critical Patch Update, delivering 1,295 fixes that cover 1,209 distinct CVEs, according to analysis from Tenable. Of these, 95 are rated critical, 439 high severity, and 582 medium severity. Fusion Middleware received the largest share with 206 fixes, 134 of which are remotely exploitable without authentication, while E-Business Suite (194), Siebel CRM (122), PeopleSoft (109), JD Edwards (102), MySQL (98) and Java SE (55) also saw substantial patching. Oracle says none of the flaws fixed in this round are currently known to be exploited, though it continues to see sporadic attack attempts against its software. Separately, the company issued an out-of-band advisory for CVE-2026-91403 in Java, tied to the eMudhra weak-key certificate issue, and confirmed its next regular updates will land November 17, December 15, and the following full CPU on January 19, 2027.

OpenAI has outlined a five-step framework for coordinating disclosure of critical vulnerabilities that affect widely-used software, prompted by a two-month response effort tied to flaws discovered in PHP. One of these PHP bugs was surfaced by researcher Calif using OpenAI's GPT-5.6 Sol model under the company's Patch the Planet open-source security initiative, while security firm Wiz separately identified and reported both issues. The proposed process moves from initial confirmation and patch development, through early notification to affected vendors and distributors, government involvement (including CISA and the White House's Super Intelligence Force for the PHP case), broader disclosure, to final public guidance after a fix ships. OpenAI says it expects AI models to uncover this kind of large-scale, high-impact vulnerability far more often going forward, and is seeking industry input on disclosure timing, information-sharing risks, and how to patch outdated software versions no longer receiving security updates.

Security firm FoxIO has published proof-of-concept exploits for a class of QPACK header-decompression bugs affecting multiple HTTP/3 implementations, including quic-go, Cloudflare's quiche, lsquic, Wireshark and Bun. By sending a small batch of compressed headers, an unauthenticated attacker can force a server to expand them into far larger data in memory — in some cases up to 4,000 times the original size — exhausting server RAM with a single connection and causing a denial of service. The root cause is that affected stacks limit the size of headers as received on the wire but fail to properly cap the size after decompression, or apply the limit too late. This affects software built on these libraries, such as Caddy, Traefik, cloudflared, LiteSpeed Web Server and OpenLiteSpeed. Fixes are already available: quic-go 0.57.0 (CVE-2025-64702), quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0, and Wireshark 4.6.2/4.4.12 (CVE-2025-13945). Bun, the h3 Rust library and aioquic remain unpatched, with Bun facing the worst case — a counter overflow that can pin the server at 100% CPU indefinitely. No exploitation in the wild has been reported, and FoxIO recommends operators update immediately or apply the interim mitigations described for still-vulnerable stacks.

Amazon's threat intelligence unit reported catching a probe against its MadPot honeypot on October 17, 2026, targeting the PHP2Shell flaws four days before they were officially disclosed, raising suspicion that someone had obtained exploit details while the issue was still under embargo. The two bugs, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2, affect PHP core across all 7.x and 8.x releases and allow unauthenticated remote code execution on virtually any reachable PHP endpoint, including login pages and health-check routes. The disclosure timeline was further disrupted when exploit details leaked online and Chainguard published fixed container images ahead of the embargoed release, pushing the PHP Foundation to ship patches a day early on October 21. Following the release, Amazon, Cloudflare, Pantheon, VulnCheck and others observed widespread active scanning and exploitation attempts from multiple anonymized sources, prompting urgent advisories from CISA, NCSC, FBI and NSA urging immediate patching given PHP's presence on the majority of the world's websites.

Kaspersky researchers have uncovered a new UEFI bootkit, named BlackX, that closely mirrors the notorious BlackLotus malware and was used in targeted attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The attackers, attributed with medium confidence to the APT41 group, deployed BlackX after gaining administrator access, exploiting the Baton Drop flaw (CVE-2022-21894) to install rogue Machine Owner Keys and subvert Secure Boot on Windows machines. Notably, the compromised systems had already received Microsoft's official patch, but the fix requires administrators to manually trigger certificate revocation—a step most organizations overlook—leaving them exposed despite being "patched." The bootkit loads a kernel driver that blinds security tools and delivers espionage payloads, including a cloud-based RAT and a Rust-based implant communicating with a remote C2 server, underscoring how incomplete patch activation can leave even updated networks vulnerable.

A Saudi national employed at OpenAI, Abdulrahman Alfozan, has been criminally charged for secretly planting a cheap $13.90 microcontroller-based recording device, disguised with toilet paper, into a confidential executive conference room at the company's San Francisco office. Court filings show he used ChatGPT beforehand to research building a covert audio recorder and to pick out target rooms, and he had close ties to a member of the Saudi royal family who urged him to return home for an AI initiative. Commentators suggest this looks less like formal state espionage and more like an attempt to boost his resume with stolen corporate secrets, but it highlights how weak operational security at frontier AI labs leaves them exposed to far more sophisticated intelligence targeting. Separately, researchers at NorForge documented criminal groups weaponizing the open-source "Cairn" autonomous AI pentesting agent, finding roughly 20 exposed dashboards running over a thousand attack projects against retail and financial targets, succeeding in about 10% of attempts at an estimated cost of just $50 per successful breach.

Cisco Talos has flagged a serious key-generation flaw at certificate authority eMudhra, where eight intermediate CA certificates ended up with private keys containing only single- or double-digit bits of entropy instead of the required 384 bits of P-384 randomness. The mistake, traced back to an April 30, 2025 key ceremony under eMudhra's emSign Root TLS CA - G3 (cross-signed with Comodo AAA Certificate Services), effectively made the private keys trivial to recover, letting anyone who obtains them forge certificates and impersonate websites or sign malicious code. Six of the affected TLS certificates have already been distrusted by Chrome, Mozilla, and Apple, while two code-signing certificates were blocked by Microsoft, and eMudhra has revoked all eight and paused new issuance under the G3 root. Because Go's standard library performs its own certificate chain validation independently of OS trust stores, the Go team assigned CVE-2026-111943 to this exposure and shipped Go 1.27.3 and 1.26.10, which now reject chains built on the affected SPKI hashes—critical for container and cloud-native tools like Docker, Kubernetes, Terraform, and Prometheus that rely on Go's TLS stack. Talos warns that beyond browsers, VPN clients, CI/CD pipelines, and embedded or industrial IoT devices using separate or bundled trust stores may still trust the compromised keys, and urges organizations to update affected software and certificate stores as fixes roll out; no active exploitation has been observed as of October 21, 2026.

A leaked pair of severe PHP vulnerabilities, nicknamed 'php2shell' by researchers, is causing alarm across the security community. CVE-2026-109618 allows remote code execution through out-of-memory corruption, while CVE-2026-109619 achieves RCE via stale global state; both carry a CVSS v4.0 score of 9.2 and were found by consulting firm Calif. WatchTowr says the flaws require no authentication and can be triggered simply by reaching a server over the network, with Session Upload Progress—enabled by default in many deployments—offering a confirmed attack path, and the firm has already detected exploitation attempts in the wild, particularly against PHP run as an Apache module. The PHP Foundation's planned coordinated release was disrupted when details and a proof-of-concept tool leaked ahead of schedule, pushing organizations to urgently patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, since unsupported older versions have no official fix.

GitLab has shipped an October 21 security release patching CVE-2026-110264, a maximum-severity (CVSS 10.0) flaw that could let an unauthenticated attacker execute arbitrary code on self-managed instances. The bug stems from an integer overflow in Onigmo, the bundled regular-expression engine, and impacts every release since version 7.0 from 2014, far beyond GitLab's usual three-release support window. Fixed builds were issued for 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, meaning even admins who applied the October 12 patch for CVE-2026-97229 remain exposed and must update again. GitLab.com and GitLab Dedicated are already protected, and the vendor has found no evidence of active exploitation so far, though it hasn't disclosed the exact attack prerequisites or offered a workaround besides patching. This marks the fourth RCE bug found in GitLab's regex compiler within a month by the same researcher, alongside ten other fixed issues including an account-takeover flaw (CVE-2026-15723) and an OAuth/OIDC cache-poisoning bug (CVE-2026-112212).

CISA has issued an alert about active exploitation of a vulnerability chain nicknamed Plex2Shell, which targets Plex Media Server installations. By combining four separate bugs — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — attackers can steal a server owner's admin token and achieve remote code execution with elevated privileges; researcher Zach Main rates the combined chain 9.8 on the CVSS scale even though the individual flaws are only medium to high severity. The issues affect all Plex Media Server builds prior to version 1.43.3.10861 (released August 4), and exploitation attempts began surfacing on October 17, initially deploying cryptomining malware against exposed honeypots; federal agencies have been told to patch or mitigate by October 23. Separately, CISA also added to its Known Exploited Vulnerabilities list a path-handling flaw in Siemens Software Center (CVE-2026-110936), tied to a malware delivery platform called Romulus, and a command-injection bug in Hitachi Solutions' SiteGuard Server Edition WAF (CVE-2026-106931), urging affected organizations to update to the vendors' patched releases.

PHP's maintainers have shipped fixes for two critical flaws dubbed PHP2Shell—CVE-2026-109618, an out-of-memory corruption bug, and CVE-2026-109619, a stale global state issue—both scoring 9.2 on CVSS and allowing unauthenticated remote code execution, confirmed against Apache running modphp. The updates landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal backports for 7.4, 8.0 and 8.1, after the PHP Foundation moved the release forward a day because exploit details leaked early. Security firms including WatchTowr, Hadrian, Patchstack, Cloudflare and Vega report in-the-wild exploitation attempts against PHP-FPM, modphp, php-cgi, FrankenPHP and LiteSpeed installs, with some already using public proof-of-concept code, though no confirmed successful compromises have been verified yet by WatchTowr. Because the flaws sit in PHP's core rather than any CMS, they potentially threaten sites built on WordPress, Drupal and MediaWiki, affecting an estimated 70% of websites worldwide and risking leaked credentials and secrets from process memory.

A pair of critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619, is already being actively exploited, prompting PHP's maintainers to rush out emergency patches. The flaws affect every PHP release from version 5.4 onward and allow attackers to run arbitrary code on vulnerable servers, putting an estimated 70 percent of websites — including those built on Drupal, Magento, Joomla, and WordPress — at risk. Cloudflare says it has already observed attack attempts and deployed firewall rules to block exploitation attempts that could lead to denial of service, remote code execution, or data theft, while some government sites in Europe have already been taken offline as a precaution. Researchers at Wiz, who helped discover and coordinate disclosure of the bugs alongside OpenAI and the PHP team, warn the flaws could be mass-exploited to plant web shells and compare their severity and reach to the 2021 Log4Shell crisis; administrators are urged to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

A premature leak forced PHP maintainers to rush out an emergency fix on October 21, 2026, for two unauthenticated remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS. The flaws, nicknamed PHP2Shell, stem from use-after-free and memory-corruption issues in how PHP core handles multipart/form-data uploads together with the session.uploadprogress feature, and they reportedly hit every PHP version from 5.4.0 through the current 8.x branches — including popular platforms like WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS. Because exploitation requires no credentials and the issue sits in the PHP engine itself, app-level fixes won't help; vendors shipped backported patches even for end-of-life 7.4, 8.0, and 8.1, alongside supported 8.2–8.5, while researchers warn mass attacks could start within minutes of disclosure. Kaspersky says its EDR, Anti Targeted Attack (KATA), and Endpoint Security products already flag both the exploitation attempts and post-exploitation behavior tied to this campaign.

Cisco Talos has flagged two critical, unauthenticated remote-code-execution bugs sitting deep in PHP core, nicknamed "php2shell," which can be triggered by a simple HTTP request before any application logic even runs. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 score of 9.2 and touch essentially every PHP release since version 5.4. CVE-2026-109618 stems from out-of-memory handling interrupting request processing while internal data is still half-initialized, letting cleanup treat garbage as legitimate; CVE-2026-109619 involves reuse of stale internal state after its memory has already been freed. Because the flaw lives in PHP itself rather than in a single application, the blast radius covers widely used platforms such as WordPress, Drupal, Magento, Shopware, WooCommerce, Laravel, and cPanel/Plesk-hosted PHP sites. Talos says it has not observed exploitation in the wild as of October 21, 2026, but warns that PHP 8.1 and earlier are already end-of-life with no patch coming, PHP 8.2 support ends December 31, 2026, and roughly half of internet-facing PHP systems may never get fixed, so immediate upgrade to PHP 8.2 or later is strongly urged. Cisco customers get protection via SNORT signatures 67359 and 67360, also released through the Community Ruleset.

PHP.net has shipped an emergency fix for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, after SANS ISC raised its InfoCon to yellow due to public PoC code and confirmed in-the-wild exploitation reported by Cloudflare. Essentially every PHP release back to version 5 is affected, but only PHP 8 is getting fixed, with safe builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 published on October 20-21, 2026 and Ubuntu already issuing updated packages for several supported releases. CVE-2026-109618 is a memory-corruption remote-code-execution bug tied to malformed multipart uploads that bypass size and header limits, while CVE-2026-109619 is a use-after-free caused by improper reset of per-request global state such as sessions. Until patches are fully deployed, admins are advised to disable session.uploadprogress, cap request sizes, and consider blocking multipart/form-data uploads as temporary mitigations.

On October 21, 2026, the PHP core team shipped an emergency out-of-band release fixing two critical, unauthenticated remote code execution flaws nicknamed php2shell. CVE-2026-109618 is a use-after-free memory corruption bug in the varunserializer/session deserialization logic, while CVE-2026-109619 is an input-validation flaw letting attackers fix session IDs via POST data and smuggle arbitrary bytes into session files through unsanitized upload filenames — both tied to the default-enabled session.uploadprogress feature and both rated 9.2 (Critical) on CVSS v4.0. Because PHP underlies countless WordPress, Magento, Drupal and Laravel deployments, and researchers found hundreds of thousands of internet-facing hosts still running old PHP versions, the exposure is massive even though exploitation often requires chaining with an application-level flaw such as local file inclusion. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and administrators are urged to upgrade immediately, restrict public access to unpatched instances, and avoid unverified third-party patches or PoC scripts circulating online.

The PHP security team has rushed out emergency updates for two critical, unauthenticated remote code execution bugs collectively dubbed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both stem from PHP corrupting its own memory state when a request terminates abnormally, and they affect every setup that handles web traffic, including PHP-FPM, Apache with modphp, php-cgi, FrankenPHP, and LiteSpeed, with modphp considered the riskiest since attackers can trigger the exploit before any application code even runs. Researchers from Calif, Wiz, and OpenAI found the flaws, and Cloudflare has already spotted early exploitation attempts even before the patches landed, prompting the UK's NCSC to urge organizations to patch immediately or take affected systems offline. Admins running PHP 8.x should move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away, while unsupported PHP 7.4, 8.0, and 8.1 users have received limited source backports, since temporary mitigations only reduce risk and cannot fully stop attacks on the millions of exposed PHP hosts worldwide.

{"title":"PHP Rushes Out Fixes for Two Critical PHP2Shell RCE Bugs Amid Early Exploit Attempts","seotitle":"PHP Patches Critical PHP2Shell RCE Flaws","seodescription":"Patch released: PHP fixes CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Unauthenticated RCE; update and restart workers now.","bodymd":"PHP has rushed out emergency builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two critical vulnerabilities, dubbed PHP2Shell, that allow an unauthenticated attacker to execute code on a web server. Tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, the bugs live in the PHP engine itself rather than in any application, so even secure sites remain exposed, especially those running Apache's modphp, where a single crafted request can trigger code execution before the application even loads. The flaws, found by researchers at Wiz, Calif, and OpenAI and dating back over a decade in PHP's codebase, also let attackers read memory from worker processes, potentially exposing credentials and tokens from unrelated requests, even without full code execution. PHP pushed the release forward after details leaked ahead of a planned October 22 disclosure, and Cloudflare has already observed early exploitation attempts in the wild, prompting some organizations, including BambooHR and several Dutch government sites, to take services offline as a precaution. Administrators are urged to update their PHP runtime and restart all affected services immediately, since configuration workarounds only partially reduce exposure and do not fully resolve either flaw.”}

The PHP project has rushed out fixes for a pair of critical flaws, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, that allow an attacker to run arbitrary code on a web server with a single unauthenticated request. CVE-2026-109618 stems from memory corruption triggered by out-of-memory handling during request cleanup, while CVE-2026-109619 arises from stale internal state left over from a previous request being reused before proper reinitialization. Virtually any PHP deployment that handles web traffic is at risk, including PHP-FPM, Apache with modphp, php-cgi, FrankenPHP and LiteSpeed, with modphp setups considered most exposed; working exploit code already exists and security researchers warn this could trigger a wave of incidents. Users should upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, check with their Linux distribution or LTS vendor for backported packages on older branches, and note that Cloudflare has already rolled out WAF rules covering known exploitation paths for all customers.

Multiple ransomware crews, including Qilin and INC, have been abusing CVE-2026-0257, a PAN-OS GlobalProtect authentication-bypass flaw patched by Palo Alto Networks in May, to infiltrate victims across healthcare, education, government and energy sectors since early June. The bug lets unauthenticated attackers forge a VPN session by exploiting weak cookie validation in GlobalProtect portals and gateways on physical and virtual firewalls, as well as in Prisma Access. Unit 42 and ReliaQuest report that intruders use the stolen access to sidestep MFA, move laterally with tools like Cobalt Strike and BloodHound, disable protections on vCenter/ESXi infrastructure to harvest domain credentials, and sometimes chain in a separate Veeam flaw (CVE-2023-27532) before deploying ransomware. Because the traffic rides over the organization's own VPN, the activity can blend in with legitimate remote work, and researchers warn exploitation will likely persist for months, urging immediate patching, disabling of unneeded auth-override cookies, and termination of all GlobalProtect sessions post-patch.

Ahead of PHP's scheduled fix for two critical flaws nicknamed PHP2Shell, security researchers are walking back earlier advice that a single configuration change could protect systems. PHP rates the bugs 9.2 out of 10 and plans to release patches at 14:00 UTC on October 21, but has not disclosed affected versions or the vulnerable component, saying details will come with the update. GMO Flatt Security, which first suggested disabling the session.uploadprogress.enabled setting as a stopgap, now says this alone cannot be trusted to block exploitation and expects bypasses to exist. A PHP core developer echoed this, stating only patching actually fixes the issue. No in-the-wild exploitation has been confirmed so far, but organizations are urged to isolate exposed PHP servers, limit what a compromised host can access, and be ready to apply the patch the moment it is released rather than rely on the workaround as a substitute. Administrators running unsupported PHP branches (anything older than 8.2) get no fix and should consider taking systems offline or restricting network access until they can upgrade.

PHP is preparing an emergency release to address two core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the PHP security team has scored at CVSS v4.0 9.2 each. Researchers believe both flaws allow unauthenticated remote code execution, though PHP's own advisory currently withholds technical specifics such as the vulnerable component, affected versions, or which releases will contain the fix. The patch is expected around 14:00 UTC on Wednesday, October 21, 2026, but could ship sooner if exploitation is detected or more details leak publicly. There is no confirmed in-the-wild exploitation at this time, though a screenshot of a tool dubbed 'PHP2Shell' has already surfaced online, and defenders are warned that fake proof-of-concept exploits are likely to circulate on platforms like GitHub and Telegram before the official fix lands — these should be treated with suspicion since they often carry malware rather than genuine working exploits. Organizations running PHP are advised to disable unused file-upload handling as a precaution and to prepare their teams to apply the official patch as soon as it becomes available.

TeamUpdraft, maker of the UpdraftPlus backup plugin used on over four million WordPress sites, disclosed that attackers breached teamupdraft.com over the weekend of October 17-18 and likely accessed its customer database, including connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Security researchers at Patchstack and Nethemba say threat actors used stolen UpdraftCentral keys to issue remote commands that installed malicious backdoor plugins on connected sites during an 18-hour attack window on October 18-19; the implant creates a hidden administrator account ("data-ops43") that persists even after the rogue plugin is removed. TeamUpdraft has released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to sever old UpdraftCentral connections and urges affected site owners to update, disconnect and reconnect, rotate credentials, and check for unknown admin accounts or plugins. The incident follows a related flaw, CVE-2026-10795, patched in June, and comes amid separate WordPress-adjacent security scares involving the Rank Math PRO plugin supply-chain compromise and the leaked PHP2Shell vulnerabilities in PHP.

Patchstack says hosting partners have already flagged real-world attacks exploiting two critical flaws in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 (CVSS v4.0) by the PHP security team despite early claims of a 10.0 score. Because the bugs sit in PHP rather than in any single CMS, every site running a vulnerable PHP build is at risk — including WordPress, Drupal, Magento, Joomla and Laravel installs. The issue, dubbed "PHP2Shell" after details leaked ahead of coordinated disclosure, was independently verified and partially reproduced by watchTowr, confirming it enables remote code execution. The PHP team has scheduled an emergency fix for October 21, 2026 at 14:00 UTC, and until then the only recommended stopgap is disabling the default-on session.uploadprogress feature via session.uploadprogress.enabled = Off, though this does not actually block exploitation — only installing the patched PHP version will.

CISA has added four flaws affecting Plex Media Server—dubbed Plex2Shell—to its Known Exploited Vulnerabilities catalog, alongside two more actively exploited bugs in Siemens Software Center and EG Secure Solutions SiteGuard Server Edition. The Plex issues, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can reportedly be chained by an unauthenticated attacker to achieve remote code execution, and researchers say threat actors are already using them to install cryptomining and proxy malware; a fix shipped in Plex Media Server 1.43.3.10861 back in August. Siemens Software Center's CVE-2026-110936 is being abused via DLL sideloading in ClickFix-style attacks through a tool called Romulus, while SiteGuard's CVE-2026-106931 is a confirmed-exploited command injection flaw with no further technical details disclosed. Federal civilian agencies must remediate CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by October 23, 2026, with the remaining vulnerabilities due by November 3, 2026.

Two unpatched PHP vulnerabilities dubbed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, have had their details surface online before PHP's planned coordinated fix. Both bugs carry a CVSS score of 9.2, reportedly allow unauthenticated remote code execution, and are said to impact every PHP release starting from PHP 5. PHP's official patch is scheduled for Wednesday, October 21, 2026 at 14:00 UTC, though the team may push it out sooner if exploit code appears or active attacks are detected. Researchers at WatchTowr say they reproduced CVE-2026-109618 and confirmed the flaw is genuine, while WatchTowr and Huntress report no in-the-wild exploitation yet—though Sansec warns that mass attacks could begin within roughly 15 minutes of the patch dropping, making urgent, same-day updating essential for all PHP deployments.

PHP's security team is pushing out an unscheduled release at 14:00 UTC on October 21 to fix two critical remote-code-execution bugs it rates 9.2 on CVSS v4.0, without yet detailing how they work. The patch will only reach the four currently supported branches, 8.2 through 8.5, while older versions such as 8.1, 8.0, 7.x and 5.x stay unprotected since they're end of life. The fix was accelerated after a leak surfaced on Hacker News naming CVE-2026-109618 and CVE-2026-109619 with a claimed CVSS 10.0 score and alleging every version since PHP 5 is vulnerable — a scope watchTowr says remains unconfirmed by any official advisory. Researchers have nicknamed the pair "php2shell"; so far neither PHP, Huntress nor watchTowr have observed active exploitation, though security firm Mallory estimates roughly 884,000 internet-facing hosts still run PHP 8.1 or earlier and could be exposed once technical details emerge.

PHP's core team announced it will release fixes within about 12 hours for two vulnerabilities rated 9.2 out of 10 in severity, tracked as CVE-2026-109618 and CVE-2026-109619. The advisory urges all PHP users to get ready to upgrade immediately once the update lands, warning it may ship even sooner if exploitation details leak publicly or active attacks are spotted. The warning followed an unconfirmed leaked report showing a tool called PHP2Shell running remote code against servers hosting WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all built on PHP. Security firm watchTowr says it has independently verified the two bugs are genuine and claims they impact every PHP release going back to PHP 5 from 2004, making the upcoming patches critical for virtually any PHP-based website.

TeamUpdraft, the company behind popular WordPress backup tools, suffered a breach of its website over the weekend of October 17-18, giving an attacker access to its customer database, including password hashes, two-factor authentication settings, and connection keys used by UpdraftCentral, UpdraftVault, and UpdraftClone to remotely manage sites. Researchers from Patchstack and Nethemba report that attackers started abusing these stolen UpdraftCentral keys on October 18 to push dozens of fake plugins—disguised as tools like "Site Health Cache"—that create rogue administrator accounts, even on fully patched installations running WordPress 7.1.3 and UpdraftPlus 2.26.11 (already fixed against CVE-2026-10795). Since roughly 10% of UpdraftPlus users have an UpdraftCentral or Migrator key configured, as many as 400,000 websites could be at risk, as attackers are signing malicious commands with valid private dashboard keys rather than exploiting any plugin flaw. TeamUpdraft urges customers to update to UpdraftPlus 1.26.13 or UpdraftPlus Premium 2.26.13, remove existing UpdraftCentral connection keys, check for indicators of compromise, and reset account credentials and two-factor authentication if a breach is confirmed.

Certificate authority eMudhra has revoked eight intermediate TLS certificates after a researcher found their private keys were generated with such a narrow range of possible values that anyone could brute-force them in roughly 256 attempts. eMudhra traced the flaw to a scripting error from April 2025 that produced a weaker, mislabeled set of keys that got used for signing instead of the properly generated ones. The company says most of these intermediates were never put into production and it has no evidence end-user certificates were issued or that the keys were actually abused, though the exposure window has existed since last April. Mozilla, Google Chrome, and Apple have all pushed out blocks for the compromised certificates via their respective revocation mechanisms, Mozilla additionally shipping Firefox 158.0.1 and ESR updates for users whose setups missed the earlier OneCRL fix, while the Go team addressed the issue as CVE-2026-111943 in releases 1.27.3 and 1.26.10. Because some certificate stores don't check revocation status, including macOS's built-in curl tool, users and administrators are urged to apply the latest updates across affected software, Linux distributions, and language ecosystems to fully stop trusting the vulnerable certificates.

Unit 42 has flagged two critical remote-code-execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS 4.0. The first stems from improper handling of out-of-memory conditions via longjmp(), which leaves request memory uninitialized and lets attackers trigger OOM conditions to reliably gain code execution. The second occurs when longjmp()-based fatal error handling leaves global pointers referencing freed memory, which can later be read or jumped to in subsequent requests to run arbitrary code. Unit 42 reports that proof-of-concept exploits already exist, at least one European government has taken a site offline as a precaution, and Palo Alto Networks' Cortex Xpanse telemetry shows more than 22.6 million potentially exposed internet-facing instances — making immediate patching per the PHP Group's advisory essential given PHP's widespread use across web servers and CMS platforms.

The PHP development team has moved up release of urgent security fixes to Wednesday, October 21 at 14:00 UTC, after details about two critical bugs apparently leaked ahead of schedule. The flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 under CVSS v4.0 and reportedly impact PHP branches 5, 6, 7, and 8, affecting the engine that underpins countless CMS platforms, online stores, and custom web apps. Researchers at watchTowr say both issues allow remote code execution, claim to have independently reproduced CVE-2026-109618, and insist they have seen no active exploitation yet, though their own severity estimate (CVSS 10) and timeline differ slightly from PHP's official statement. The PHP team has withheld technical specifics and a list of fixed versions until the patches ship, but says it may push the release even earlier if exploitation is detected or more information surfaces publicly.

Mozilla and Google's Chrome Root Program revealed on October 20 that the private keys for eight eMudhra intermediate certificate authority certificates — six used for TLS and two for code signing, all under the emSign brand — had been stolen, letting whoever holds them mint trusted certificates for arbitrary websites or signed software. A researcher known as Wayne reported the theft on October 17 by signing a message with all eight keys, prompting Chrome and Firefox to block the certificates via CRLSet and OneCRL within hours, with Apple and Microsoft following on October 19–20. Go shipped emergency fixes in versions 1.27.3 and 1.26.10 rejecting any certificate chain built on these keys (CVE-2026-111943), Firefox 158.0.1 and its ESR builds patched the issue as CVE-2026-113470, and NSS, Python's certifi, Rust's webpki-roots, and Homebrew's ca-certificates all removed the underlying emSign ECC Root CA - G3. How the keys leaked from eMudhra remains unknown, and Mozilla and Chrome are now reviewing eMudhra's remaining roots while warning that unpatched tools like older Go binaries, Linux distro trust stores, or disabled auto-update channels in Firefox stay exposed until updated.

Researchers at Horizon3.ai have published a working proof-of-concept exploit for CVE-2026-106173, a critical path traversal vulnerability in Fortinet FortiSIEM rated 9.4 on the CVSS scale. The flaw lets an unauthenticated attacker connect to the product's gRPC service on TCP port 27918 and abuse unsanitized query-id metadata to write files outside the intended directory, ultimately achieving remote code execution. By combining directory traversal sequences with a null-byte injection trick, an attacker can overwrite a sensitive Redis health-check shell script that runs via cron, giving them a path to full system compromise. Fortinet shipped fixes last week, with FortiSIEM 7.5.0 users urged to upgrade to 7.5.1 or later, while the 7.6 branch is not affected.

Palo Alto Networks' Unit 42 reports ongoing abuse of CVE-2026-0257, an authentication-bypass bug in PAN-OS and Prisma Access rated 7.8 on the CVSS scale, which lets attackers create rogue VPN sessions and sidestep multi-factor authentication. The vendor fixed the issue in May 2026 and CISA added it to its Known Exploited Vulnerabilities list on May 13, 2026, yet ransomware crews tracked as Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) — alongside Settra, flagged separately by ReliaQuest — are still using it as an entry point. Once inside, the intruders deploy RMM software for recon, pivot through RDP and SMB, and in some cases jump from the VPN gateway to vCenter, disabling ESXi protections to pull credentials straight from a domain controller's virtual disk, bypassing endpoint defenses entirely. Victims span education, finance, healthcare, manufacturing, government, logistics, energy and retail, with some intrusions also chaining in the older Veeam flaw CVE-2023-27532; Palo Alto urges immediate patching plus proactive hunting for compromise indicators.