This brief covers the trailing ~48 hours (October 25–27, 2026). Every item below was traced to its primary source — the CISA alert, the vendor advisory, or the original research — and the disclosure date was confirmed on that page before inclusion.

CISA adds both PHP2Shell flaws to KEV as honeypots record the first confirmed shells

CISA · October 26, 2026

CISA added CVE-2026-109618 (PHP Memory Corruption) and CVE-2026-109619 (PHP Stale Internal Request-State) to the Known Exploited Vulnerabilities catalog on October 26 and updated its October 21 PHP alert to match; under BOD 26-04, federal civilian agencies now have to remediate on the accelerated KEV timeline. Both bugs are rated CVSS 9.2 (v4.0, Critical) by the PHP project and allow unauthenticated remote code execution against any PHP installation serving web requests (Apache mod_php is considered highest risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all in scope). Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier get no fix and should be taken offline until upgraded. The KEV addition follows honeypot evidence published October 24 by researcher Adel Karimi showing 35 Apache-parent shell spawns across three sensors — the first confirmed in-the-wild code execution, as opposed to the millions of failed probes vendors had been logging since the October 21 patches.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.” — CISA, KEV catalog alert, October 26, 2026

Source: CISA KEV alert · CISA PHP alert (revised Oct 26) · PHP advisory (CVE-2026-109619) · Karimi honeypot report · SecurityWeek · BleepingComputer

Apple backports the exploited CoreGraphics zero-day fix to iOS 18 alongside iOS/macOS 27.2

Apple · October 26, 2026

Apple shipped iOS 18.7.11 and iPadOS 18.7.11 on October 26 to carry the fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta Product Security, to older hardware: iPhone XS, XS Max and XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple says the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27; it was first patched in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple does not publish CVSS scores, and the CVE is not currently in CISA’s KEV catalog. The same day Apple released iOS/iPadOS 27.2, macOS 27.2, iOS/iPadOS 26.7.2, macOS 26.7.2 and 15.8.2, tvOS, watchOS, visionOS and Safari 27.2 — SecurityWeek counts 286 fixes across the two flagship 27.2 releases — with no additional flaws flagged as exploited.

“Processing a maliciously crafted file may lead to arbitrary code execution.” — Apple, security content of iOS 18.7.11 and iPadOS 18.7.11

Source: Apple security content — iOS 18.7.11 · Apple security content — iOS 27.2 · SecurityWeek · BleepingComputer

Microsoft ships out-of-band .NET fixes and Palo Alto confirms PAN-OS exposure to the Brotli “HTTP2Shell” bug

Microsoft · October 25, 2026 — Palo Alto Networks · October 26, 2026

The Brotli decoder out-of-bounds write CVE-2026-111497 (variously branded Broccoli2Shell, Node2Shell and HTTP2Shell; Google Brotli 1.0.3 through 1.2.0) kept rippling through downstream vendors. Microsoft published out-of-band .NET updates — .NET 8.0.33, 9.0.22, 10.0.14 and 11 RC3 — for applications that process Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic decompression or the System.IO.Compression Brotli APIs; .NET Framework is not affected and Brotli decompression is off by default in a stock install. Palo Alto Networks then published its own advisory rating the issue CVSS 9.2 (v4.0, Critical) for PAN-OS 12.2, 12.1 and 11.2 firewalls that have Brotli inspection enabled together with SSL decryption, plus the Prisma Cloud Application Security Transporter Client before 0.2.9; hotfixes are staged through the end of the week and disabling Brotli inspection is the interim workaround. Proof-of-concept exploits are public, but neither Microsoft nor Palo Alto reports malicious exploitation, and the CVE is not in KEV. Upstream fixes are Brotli 1.0.10/1.1.1/1.2.1 and Node.js 22.23.4/24.22.1/26.12.1; applications that bundle their own Brotli copy need their own update and a restart.

“A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm.” — Microsoft .NET Blog, October 2026 out-of-band security updates

Source: Microsoft .NET OOB advisory · MSRC CVE-2026-111497 · Palo Alto Networks advisory · Node.js advisory · BleepingComputer

Still developing

ENGIE confirms customer data theft via a partner marketing platform

ENGIE (via BleepingComputer) · October 27, 2026

French energy group ENGIE confirmed that attackers accessed customer data through a prospecting and marketing tool used by its business partners; the company says its internal IT systems were not breached, that access has been cut, and that authorities and affected customers in France have been notified. Breach letters reviewed by BleepingComputer list names, postal and email addresses, phone numbers, PDL/PCE meter-point identifiers, customer IDs and contract numbers; ENGIE says no banking data was involved. No group has claimed the intrusion and ENGIE has not said how many customers are affected.

“ENGIE’s internal IT systems were not compromised.” — ENGIE spokesperson, to BleepingComputer

Source: BleepingComputer

University of Copenhagen breach grows to roughly 525,000 people

University of Copenhagen (via BleepingComputer) · October 26, 2026

The University of Copenhagen says intruders reached one of its test environments, exposing names, Danish CPR national identity numbers, phone numbers and email addresses for about 525,000 people, with an update adding some 20,000 staff and students whose physical-access PIN codes were also taken. The university detected the intrusion on October 20, disclosed it October 23, reports no impact on operational systems, and has temporarily restricted physical access to some campus locations while it issues new codes.

Source: BleepingComputer

Collabora Online and Arista VeloCloud Orchestrator flaws under active exploitation

CISA · October 23, 2026

CISA added CVE-2026-110447 (CVSS 9.2, OS command injection in the Collabora Online built-in CODE server used with Nextcloud, fixed in 26.4.303) and CVE-2026-114625 (CVSS 9.9, SQL injection in on-premise Arista VeloCloud Orchestrator, fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12) to KEV on October 23 with a federal due date of October 26. Attackers have been backdooring Nextcloud servers with web shells and hunting for credential stores and crypto wallets, and Arista acknowledges the VCO bug is known to be actively exploited — the third VCO flaw exploited in the wild since July.

Source: CISA KEV alert (Collabora) · CISA KEV alert (Arista) · The Hacker News

This brief covers the trailing ~48 hours (October 25–27, 2026).

Primary sources:

• CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26, 2026)
• CISA — Critical Vulnerabilities in PHP Require Immediate Patching (revised Oct 26, 2026)
• PHP — Security advisory for CVE-2026-109619
• Adel Karimi — PHP2Shell confirmed RCE honeypot report (Oct 24, 2026)
• Apple — About the security content of iOS 18.7.11 and iPadOS 18.7.11
• Apple — About the security content of iOS 27.2 and iPadOS 27.2
• Microsoft — .NET October 2026 out-of-band security updates
• Microsoft MSRC — CVE-2026-111497
• Palo Alto Networks — CVE-2026-111497 advisory
• Node.js — October 2026 security releases
• CISA — Adds One Known Exploited Vulnerability to Catalog (Collabora, Oct 23, 2026)
• CISA — Adds One Known Exploited Vulnerability to Catalog (Arista, Oct 23, 2026)

This brief covers the trailing ~48 hours (October 23–25, 2026). Every item below was checked against its primary source — the CISA KEV catalog (via NVD’s KEV fields), CVE.org/NVD records, and vendor or project advisories — and only developments dated inside the window are included in the main section.

CISA KEV: Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625) actively exploited, federal deadline October 26

CISA / Arista · October 23, 2026

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog on October 23 with a three-day remediation deadline of October 26. The flaw is a SQL injection (CWE-89) in on-premises Arista VeloCloud Orchestrator (VCO) rated CVSS 3.1 9.9 / CVSS 4.0 9.4; an attacker with network access to the VCO web interface and any authenticated session (Enterprise Read Only is sufficient) can reach internal-only functionality and masquerade as a local “superuser operator.” Affected trains are VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12; fixed releases are available and Arista’s hosted and dedicated VCO instances were patched earlier. Arista’s advisory (SA-0199, published October 22) says the issue was detected internally and is under active exploitation, and publishes two attacker IPs, 74.82.197[.]86 and 38.54.50[.]151. This is the third VCO flaw to reach KEV since July 2026.

“This issue was detected by Arista and is known to be actively exploited.” — Arista Networks Security Advisory 0199

Source: Arista Security Advisory 0199 · NVD CVE-2026-114625 · CISA alert · The Hacker News

CISA KEV: Collabora Online Built-in CODE Server command injection (CVE-2026-110447) used to backdoor Nextcloud servers

CISA / CVE.org · October 23, 2026

Also added to KEV on October 23 (due October 26) is CVE-2026-110447, a CVSS 4.0 9.2 OS command injection (CWE-78) in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303. The bug lives in proxy.php and is reachable by unauthenticated attackers when the bundled CODE server is not running, for example right after a restart; standalone Collabora Online deployments are not affected. The CVE record states the flaw was exploited in the wild in September and October 2026 and is distinct from the earlier CVE-2025-66208. Reported intrusions have planted web shells on Nextcloud hosts and gone after credential stores, password-manager artifacts and cryptocurrency wallets. The fix (26.4.303) shipped in September; administrators who cannot update should remove the app.

“Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026.” — CVE-2026-110447 record (MITRE)

Source: CVE.org CVE-2026-110447 · NVD · CISA alert · Security Affairs

PHP flags a third RCE vector (CVE-2026-115560) with no patch as PHP2Shell exploitation attempts reach the millions

PHP Project · October 23, 2026

Two days after shipping emergency fixes for the “PHP2Shell” pair (CVE-2026-109618 and CVE-2026-109619, both CVSS 4.0 9.2 per PHP, with NVD scoring CVE-2026-109618 at 9.8 under CVSS 3.1; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35), the PHP project published an informational advisory for CVE-2026-115560, an additional, unpatched remote code execution vector it rates unlikely. It is reachable only when an application configures session.serialize_handler as php_binary or php_serialize, switches it to php at runtime via ini_set() before session_start(), and leaves session upload progress enabled. The fix will arrive in the next regular bugfix release; the mitigation is session.upload_progress.enabled=0, which was already recommended on October 21. Meanwhile exploitation of the original pair is widespread: Cloudflare reported millions of attempts within a day of disclosure, Cisco Talos and others see mostly scanning plus uncoordinated payload delivery including a Mirai-derived botnet, and Amazon Threat Intelligence says its honeypots first observed exploitation on October 17, four days before the patches. Neither PHP2Shell CVE carried CISA KEV fields in NVD as of October 24.

“We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.” — PHP project, informational advisory

Source: PHP announcement (Oct 23) · PHP security advisory (Oct 21) · NVD CVE-2026-109618 · The Hacker News · BleepingComputer

LiteLLM traces its poisoned 1.107.0 release to a master key leaked in May and never revoked

LiteLLM · October 23, 2026

LiteLLM published the root-cause analysis of the October 21 supply-chain compromise that pushed a malicious litellm==1.107.0 to PyPI and poisoned Docker Hub and GHCR images (tags v1.107.0, latest, main-latest, main-stable) for roughly two hours before PyPI quarantined the release. The chain started on May 27, 2026, when a configuration file holding an internal Agent Platform master key was committed to a public repository and force-pushed over without the key being revoked. On October 10 the attacker used it to extract a GitHub CLI OAuth token tied to an organization owner, ran malicious workflows to harvest maintainer secrets, then on October 21 overrode branch protection and pointed the release pipeline at a lookalike “Berri-AI/litellm” repository. The payload executes on Python startup even if LiteLLM is never imported, exfiltrates credentials to litellm[.]dev, and installs an hourly backdoor on Unix hosts. LiteLLM is rotating every token tied to its internal and vendor systems; users who ran the affected artifacts should rebuild hosts rather than only remove the package, and rotate any credentials present.

“However, key revocation did not occur for the master key.” — Oliver Jensen and Mateo Wang, LiteLLM

Source: LiteLLM: The attack chain behind the v1.107.0 release · LiteLLM incident post · The Hacker News · BleepingComputer

Ruby 4.0.9, 3.4.12 and 3.3.13 fix the Onigmo regex bugs behind four critical GitLab RCEs, including CVSS 10.0 CVE-2026-110264

Ruby Project · October 23, 2026

The Ruby core team released 4.0.9, 3.4.12 and 3.3.13 to fix three regular-expression compilation bugs in the Onigmo engine that underlie GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. The newest, CVE-2026-110264 (CVSS 3.1 10.0, CWE-190 integer overflow), lets an unauthenticated attacker execute arbitrary code on a GitLab server via a crafted regular expression and affects every GitLab CE/EE release from 7.0 up to the October 21 patch releases (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1). Ruby has not requested its own CVE IDs and notes that the exposure is not GitLab-specific: any application that compiles a regex from attacker-controlled text is affected, and Regexp.timeout offers no protection. Ruby 3.2 and earlier are end-of-life and will not be fixed. None of the four GitLab CVEs is in CISA KEV; GitLab has published detection rules for self-managed administrators.

“Regexp.timeout does not protect against these bugs.” — Ruby project announcement

Source: Ruby: Regexp compilation fixes · CVE.org CVE-2026-110264 · GitLab 19.5.1 patch release · The Hacker News

Brotli decoder overflow (CVE-2026-111497) behind the Node.js “Node2Shell” RCE spreads to Bun, Python, Envoy and Istio

Google / Node.js / NVD · October 24, 2026

The CVSS 4.0 9.2 out-of-bounds write in Google’s Brotli decoder (versions 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1) that Node.js patched on October 21 (22.23.4, 24.22.1, 26.12.1) is now confirmed to reach far beyond Node. Downstream advisories published inside the window cover Bun (fixed in 1.4.4), the Python Brotli and brotlicffi packages (PYSEC-2026-4322/4323, fixed in 1.2.1 and 1.2.1.0), Envoy and Istio when Brotli decompression is enabled, Debian 13 (brotli 1.1.0-2+deb13u1) and the oss-security list. Imperva’s Red Team has demonstrated code execution against an unmodified Node.js 24.22.0 Linux arm64 build via both the request-body path (Express 5 / body-parser 2) and fetch() of a br response, though it has not released exploit code and the result is build-specific. NVD’s CISA SSVC assessment still records exploitation as “none” and the CVE is not in KEV. Where updating is not yet possible, reject Content-Encoding: br at the edge and disable automatic Brotli decoding in HTTP clients; in Python, uninstalling the packages removes the exposure.

“Imperva Red Team demonstrated remote code execution against the official vulnerable Node.js build.” — Ron Masas, Imperva

Source: Node.js October 2026 security releases · NVD CVE-2026-111497 · Google Brotli releases · Imperva: Node2Shell · The Hacker News

Still developing

HPE patches eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws in Aruba AOS-8 and AOS-10

HPE · October 22, 2026

HPE’s advisory HPESBNW05162 fixes 72 ArubaOS vulnerabilities across mobility conductors, controllers, gateways and access points, eight of them rated CVSS 3.1 10.0: CVE-2026-79844, -79845, -79847 and -79851 (authentication bypass and unauthenticated buffer overflows leading to RCE in AOS-10, including the PAPI protocol) and CVE-2026-79846, -79848, -79849 and -79850 (unauthenticated command injection, SQL injection and auth bypass in AOS-8). CVE-2026-79844 affects AOS-10 10.8.0.0–10.8.1.1, 10.7.0.0–10.7.2.6 and 10.4.0.0–10.4.1.13. HPE says it is not aware of public exploit code or in-the-wild exploitation; none of the CVEs is in KEV. Interim guidance is to confine CLI and web management interfaces to a dedicated management VLAN behind layer-3 firewall policy.

“HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities.” — HPE, as quoted by BleepingComputer

Source: HPE Security Bulletin HPESBNW05162 · CVE.org CVE-2026-79844 · BleepingComputer

Quest Diagnostics reports unauthorized access to Quanum LSM with patient records believed accessed

Quest Diagnostics (SEC Form 8-K) · October 22, 2026

Quest Diagnostics filed an 8-K (Item 8.01) disclosing that on October 21 it learned of unauthorized access to Quanum LSM, the platform clients use to order tests and view results, and that it believes an unauthorized party accessed certain patient records. Quest took the system offline and temporarily paused Essential Insights and LabHQ, directing customers to paper requisitions or Quanum eLabs. The scope and data types remain under investigation, no count of affected individuals has been given, and no threat group has claimed the intrusion. Quest says business operations and its ability to serve patients were not materially disrupted.

“…the Company believes that an unauthorized party accessed certain patient records.” — Quest Diagnostics, Form 8-K

Source: Quest Diagnostics Form 8-K · BleepingComputer

Kaspersky: APT41 “BlackX” UEFI bootkit revives BlackLotus to bypass Secure Boot on Windows hosts missing DBX revocations

Kaspersky GReAT · October 22, 2026

Kaspersky researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov describe BlackX, a UEFI bootkit used against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026 and attributed with medium confidence to China-linked APT41. BlackX exploits the long-patched CVE-2022-21894 (“Baton Drop”, CVSS 4.4) to run before the OS on systems where administrators have not applied Microsoft’s manual Secure Boot revocations, installs Machine Owner Keys, loads a kernel driver signed with a since-revoked certificate to tamper with endpoint security, and deploys a RAT that uses Google Drive, OneDrive and Yandex.Disk for command and control. Kaspersky notes that the “Windows Production PCA 2011” certificate expired on October 19, 2026, yet still loads vulnerable binaries unless it is added to the DBX blocklist.

“Having examined it, we found it to be similar to BlackLotus.” — Kaspersky GReAT

Source: Kaspersky Securelist: BlackX · The Hacker News · BleepingComputer

This brief covers the trailing ~48 hours (October 23–25, 2026).

Primary sources: CISA KEV catalog · Arista SA-0199 · NVD CVE-2026-114625 · CVE-2026-110447 · PHP announcements · NVD CVE-2026-109618 · LiteLLM root-cause post · Ruby regexp fixes · CVE-2026-110264 · Node.js security releases · NVD CVE-2026-111497 · Imperva Node2Shell · HPE HPESBNW05162 · Quest Diagnostics 8-K · Kaspersky Securelist

This is a special follow-up to this morning’s brief, which went out while PHP’s emergency release was still pending. The patches shipped at 14:00 UTC on October 21, the GitHub advisories are now public, and the picture has moved quickly: exploitation attempts were being reported before the fix was even available. Everything below is drawn from the PHP project’s own advisory, the two GHSA entries, and the researchers who were first to confirm the bugs.

The short version

Two critical bugs in the PHP interpreter itself, not in any framework or application, allow unauthenticated remote code execution against essentially any PHP installation serving web requests. Both are rated CVSS v4.0 9.2 by PHP. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no complete mitigations short of updating. Cloudflare reported early attack traffic at 07:43 UTC on October 21, roughly six hours before the patch, and watchTowr says it has observed in-the-wild exploitation attempts against both CVEs. If you run PHP anywhere that accepts HTTP requests, treat this as a patch-today event.

“Put simply: if you have not applied the patch, your deployment of PHP is vulnerable.” — watchTowr

How we got here: the timeline

October 20. A post on Hacker News claimed two critical PHP RCE flaws would be disclosed on October 22, ahead of any patch. The post was removed, but screenshots spread, along with screenshots of an exploit tool styled “PHP2Shell” that claimed to work against PHP 5.4.0 and later. watchTowr publicly confirmed the leaked details were real and under embargo. That evening the PHP security team published an advance notice of an out-of-cycle release for October 21 at 14:00 UTC, pulling disclosure forward by a day.

October 21, 07:43 UTC. Cloudflare CTO Dane Knecht said the company was seeing early attacks and updating mitigations as new vectors appeared.

October 21, ~14:00 UTC. PHP published its advisory and the four fixed releases, plus minimal source backports for the end-of-life 7.4, 8.0 and 8.1 branches. The UK NCSC issued an alert, and CISA published an alert titled “Critical Vulnerabilities in PHP Require Immediate Patching.”

October 21, 14:19 UTC. watchTowr published its technical write-up and reported exploitation attempts in the wild.

The two bugs

CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w). PHP handled out-of-memory conditions by calling longjmp() to abort the request. In some code paths, request memory is reachable before initialization has finished; an allocation failure at that moment leaves partially initialized data behind, and request shutdown then reads or branches on it. The failed allocation does not have to be related to the memory that ends up corrupted. The advisory’s primary trigger is multipart parsing: a request without a usable Content-Length can pass the initial post_max_size check, and a single part can carry an unbounded number of headers whose in-memory representation is far larger than the wire form. Empty file controls do not count toward max_file_uploads but still allocate metadata, and nested field names multiply the work. Full RCE over HTTP was demonstrated against Apache mod_php with default limits. PHP-FPM is assessed as susceptible from source analysis, though no complete exploit was demonstrated; FrankenPHP and LSAPI are considered likely susceptible but not validated. The fix removes the longjmp() OOM path entirely: a soft OOM is now raised at the next VM safe point, and a hard OOM calls _exit() past a higher threshold.

CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). In persistent worker models, PHP’s global state (error, session, object and extension state) can retain pointers into memory owned by a previous request. That state is supposed to be cleared before the request heap is freed, but a fatal error such as OOM or “Maximum execution time exceeded” can abort an operation before its reset runs, and nonfatal diagnostics emitted late in shutdown can repopulate error state after it was cleared. The next request on the same worker can then read, free or branch on a dangling pointer before normal initialization replaces it. Three confirmed consumers are described: INI diagnostics raised while applying per-request settings (reachable via .htaccess and php_value directives on mod_php, and conditionally on FPM if the frontend passes PHP_VALUE/PHP_ADMIN_VALUE); session upload progress handling, which runs before ordinary session initialization, is enabled by default and does not require session_start(); and, on PHP 8.5 only, the new fatal_error_backtraces feature, which is the confirmed RCE path on mod_php. Exploitation requires a producer request and a consumer request to land on the same worker plus a cooperative heap layout, which is why both CVEs carry AC:H and AT:P in their vectors.

Both advisories share the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H and credit the same reporters: lcfr-hax, sagitzadik-wiz (Wiz), tomash-areion and amyb-oai. The remediation was developed by arnaud-lb, iluuu1994, bukka and ndossche.

“Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.” — php/php-src advisory GHSA-w8hw-w9fx-j79w

Who is affected

PHP’s advisory is blunt: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration because there is a demonstrated exploit where an unauthenticated request triggers the bug before any application code runs. Every version from PHP 5 onward is believed to be affected; only 8.2 through 8.5 receive official fixed releases. PHP 8.2 itself reaches end of life on December 31, 2026. For scale, Silas Cutler estimates over 1.3 million internet-exposed hosts are potentially vulnerable, a Shodan query by Henk Poley counts over 1.9 million hosts advertising PHP, and Mallory counted roughly 884,000 hosts whose banners show PHP 8.1 or older. These are banner counts, not confirmed vulnerable systems, but they illustrate the exposure.

“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years.” — Kevin Beaumont, via Help Net Security

Exploitation status

Before the patch, watchTowr and Huntress both said they had not seen exploitation. That changed on the morning of October 21: Cloudflare reported early attacks at 07:43 UTC, and SecurityWeek’s updated story notes firms observed exploitation attempts, some before the fixes landed. watchTowr’s post-patch write-up lists CVE-2026-109619 as exploited in the wild. Sansec, which tracks e-commerce attacks, said it expects mass exploitation now that both the patch and the write-ups are public, and noted that the circulating PHP2Shell tool combines both CVEs into a single unauthenticated attack. As of the reports I could verify, neither CVE had yet appeared in CISA’s KEV catalog, though CISA did publish a standalone alert; I was unable to load the alert page itself to confirm its contents.

“We expect mass exploitation now that the patch and the writeups are public.” — Sansec

Patches and where to get them

Upstream: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source and Windows binaries on php.net. Linux distributions and LTS vendors received the patches in advance. Ubuntu has fixes for every supported release (php8.5 for 26.10 and 26.04, php8.3 8.3.6-0ubuntu0.24.04.13 for 24.04, php8.1 8.1.2-1ubuntu2.28 for 22.04) and ESM builds for 20.04 back to 14.04. AlmaLinux had patched packages in testing on October 21. The PHP team specifically warned that the volunteer-maintained rpms.remirepo.net would not have updates on release day and urged those users to switch to distribution packages or build from source. For anyone stuck on 7.4, 8.0 or 8.1 without a vendor, PHP published minimal source-only backport branches on GitHub (PHP-7.4-CVE-2026-109618-109619 and siblings). After updating, restart every worker; a patched binary on disk does nothing for a worker that is still running the old code.

If you cannot patch in the next hour

PHP’s advisory is explicit that the measures below reduce exposure to specific paths but do not make an installation safe. PHP 8.6 release manager Joe Ferguson put it more bluntly: “ini settings won’t save you.”

For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override (for example php_admin_value in the FPM pool or Apache config) and confirm nothing re-imposes a finite limit. This removes the controllable memory-limit failure but not an underlying allocation failure. Set a low post_max_size (8M where uploads are not needed, 32M otherwise) and keep upload_max_filesize below it. Enforce limits at the web server or proxy for decoded request size, field count, multipart part count, header count and nesting depth, and make sure those limits apply to requests with no usable Content-Length. Use a container or cgroup limit as the availability boundary, and do not substitute RLIMIT_AS or RLIMIT_DATA, which themselves trigger the vulnerable path.

For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or pool configuration (not via ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request INI settings that emit diagnostics before initialization; suppressing them with error_reporting, display_errors or @ does not help. Consider pm.max_requests=1 on FPM. Fix attacker-reachable fatal errors and execution timeouts.

Sansec adds two blunter options for sites that cannot patch at all right now: block multipart/form-data at the web server (breaks uploads and some checkout flows), or reject every method except GET and HEAD until the update lands. Cloudflare has WAF rules for the known vectors available on all plans including free, but both Cloudflare and Sansec stress that this only covers traffic that actually routes through the proxy, and that the attack executes inside PHP before any application-layer rule can see it.

What to do now

Inventory every host running PHP, including the ones nobody remembers: internal dashboards, admin panels, bundled appliances, Docker images built months ago. Update to a fixed release and restart workers; do not stop at the package upgrade. If you are on mod_php, move to the front of the queue. If you are on 8.1 or older, get a vendor backport, apply the PHP source backport, or take the system offline, which is what the NCSC has recommended for anything that cannot be fixed immediately. Then look backward: with attack traffic observed before 08:00 UTC on the 21st, any exposed PHP host that was unpatched through the day should be reviewed for signs of compromise, starting with unexpected processes spawned by the web server user, new files in writable directories, and outbound connections from the web tier.

This follow-up reflects primary sources available as of the evening of October 21, 2026 (UTC).

Primary sources:

• PHP.net security advisory: Critical remote code execution vulnerabilities, update now
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state)
• PHP.net advance notice, October 20
• watchTowr: PHP Remote Code Execution (“PHP2Shell”)
• Sansec: PHP2Shell
• Ubuntu: php2shell fixes available
• AlmaLinux: patched packages in testing
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• SecurityWeek · Tenable FAQ · Check Point · Help Net Security

This brief covers October 19–21, 2026. Items were checked against vendor advisories and primary sources; it is a quiet window, so the list is short.

PHP security team pre-announces an emergency release for two critical RCE flaws

PHP.net · October 20, 2026

PHP announced an upcoming security release, scheduled for Wednesday, October 21 at 14:00 UTC, addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP. Affected and fixed versions have not yet been published. Per BleepingComputer, details leaked ahead of the embargo, and watchTowr says it has not observed exploitation and is withholding technical details until patches ship. Neither flaw was reported as being in CISA’s KEV catalog at the time of reporting.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team

Source: PHP.net advisory · BleepingComputer

Siemens Software Center DLL flaw exploited in ClickFix malware attacks

Siemens ProductCERT · October 19, 2026

Siemens confirmed in-the-wild exploitation of CVE-2026-110936 (CVSS v4 8.4), a flaw in Siemens Software Center 3.5.8.7 where helper files were not validated before loading. Attackers paired a genuine, signed copy of the program with malicious DLLs to gain code execution, and Siemens ties the activity to the Romulus ClickFix delivery platform. The fix is version 4.0.9.8, and existing installs update automatically on next launch. The CVE is reported to be in CISA’s KEV catalog.

“Existing installations update automatically the next time they start.” — Siemens ProductCERT

Source: Siemens ProductCERT · SSA-580366 · SecurityWeek

Plex2Shell chain turns unpatched Plex Media Server into crypto miners

The Hacker News · October 19, 2026

Attackers are chaining four Plex Media Server flaws, CVE-2026-96652 (CVSS 5.3), CVE-2026-96654 (6.9), CVE-2026-96655 (5.3) and CVE-2026-96656 (8.6), for unauthenticated remote code execution, delivering an XMRig miner and a Linux proxy backdoor. The flaws were reported by Zach Main on July 27 and fixed in Plex Media Server 1.43.3.10861 (August 3); technical details were published October 16 and exploitation attempts followed a day later. The CVEs are reported to be in CISA’s KEV catalog.

“Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server” — The Hacker News

Source: The Hacker News · Plex release thread

Still developing

AOMEI Backupper update servers tampered with to deliver backdoor

ManageEngine Threat Analysis Lab · October 16, 2026 (BleepingComputer coverage October 19)

Attackers briefly altered AOMEI Backupper update and notification configuration on several dates between April and July 2026 (May 28, July 16 and July 20), delivering the CROSSROAD downloader and SHINYROAD backdoor. Google Threat Intelligence tracks the actor as UNC7017. AOMEI says it has classified the matter as high priority and upgraded its servers.

“A supply chain compromise via AOMEI Backupper abused a trusted delivery mechanism to deploy Radmin.” — ManageEngine Threat Analysis Lab

Source: ManageEngine · BleepingComputer

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources:

• PHP.net security announcement
• Siemens ProductCERT SSA-580366
• Plex Media Server release thread
• ManageEngine Threat Analysis Lab
• CISA KEV catalog

This brief covers the trailing ~48 hours (October 19–21, 2026). Items are drawn from primary sources (vendor advisories and CISA) and cross-checked against reputable outlets.

PHP Security Team gives advance notice of an emergency release for two critical flaws

PHP.net · October 20, 2026

The PHP security team announced a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The identifiers are reported as CVE-2026-109618 and CVE-2026-109619 (remote code execution). PHP has not published affected or fixed versions ahead of the release; researchers at Sansec say the issues affect web servers running PHP 5.4 or later, and Tenable reports the team’s expected fixes land in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (unconfirmed until release). watchTowr told BleepingComputer the flaws are real and says it believes it reproduced CVE-2026-109618; Cloudflare’s CTO reported early attacks. Neither CVE was in CISA KEV at the time of research.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” — PHP security team, php.net

Source: PHP.net announcement · BleepingComputer · Sansec · Tenable

Siemens confirms active exploitation of Software Center DLL search-path flaw (CVE-2026-110936)

Siemens ProductCERT · Updated October 19, 2026

Siemens updated advisory SSA-580366 on October 19 for CVE-2026-110936, an uncontrolled search path (DLL loading) weakness in Siemens Software Center. All versions below V4.0.9.8 are affected; the advisory rates it CVSS v4.0 8.4 (v3.1 6.7) and the fix is V4.0.9.8 or later. SecurityWeek reports attackers paired a legitimate signed copy of Software Center with malicious DLLs delivered via ClickFix lures. The flaw was listed among six additions to CISA’s Known Exploited Vulnerabilities catalog on October 20.

“No Siemens system, product or update channel was breached to our knowledge.” — Siemens, as quoted by SecurityWeek

Source: Siemens SSA-580366 · SecurityWeek

CISA adds six vulnerabilities to the KEV catalog, including Plex Media Server and SiteGuard

CISA · October 20, 2026

CISA published an alert on October 20 adding six vulnerabilities to the Known Exploited Vulnerabilities catalog. Per WindowsForum’s summary of the alert, the entries are four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; SSRF, URI handling and path-control weaknesses), an OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, vendor-scored CVSS 4.0 8.5), and the Siemens Software Center bug above. CISA’s alert does not give affected version ranges or per-CVE exploitation details, so check the catalog and vendor advisories for remediation guidance and due dates.

Source: CISA alert · WindowsForum summary

This brief covers the trailing ~48 hours (October 19–21, 2026).

Primary sources: PHP.net · Siemens ProductCERT SSA-580366 · CISA KEV alert