PHP’s php2shell RCEs Break Cover

PHP shipped emergency fixes for two core remote-code-execution flaws after embargoed details leaked and exploitation was reported. Eight recoverable eMudhra intermediate keys triggered a separate trust-store emergency across browsers, runtimes and operating systems.

Vulnerabilities & Exploits

PHP fixed CVE-2026-109618 and CVE-2026-109619 after the disclosure embargo collapsed. Public research describes a session.upload_progress use-after-free and demonstrates the php2shell RCE path; Sansec reports that it has already been used in the wild. Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; affected EOL branches receive no upstream fix. See PHP’s emergency notice and an independent reproduction.
Eight eMudhra intermediate CA private keys were weak enough to recover almost immediately. Six intermediates were for TLS and two for code signing, giving key holders the ability to issue credentials trusted by major platforms. Mozilla, Chrome, Apple, Go and others have blocked them, but stale Linux systems, containers, embedded devices and bundled trust stores will create a long cleanup tail. No malicious TLS issuance has been found in certificate-transparency logs, according to Ars Technica; Mozilla details its response. (discussion)
Qilin and INC ransomware operators continue exploiting PAN-OS CVE-2026-0257. The May-patched authentication bypass lets attackers establish unauthorized GlobalProtect VPN sessions and bypass MFA. Observed follow-on activity includes RMM-based reconnaissance, RDP and SMB lateral movement, and direct pivots into vCenter/ESXi; in one case, operators disabled execInstalledOnly and dumped domain credentials offline from a domain controller’s VMDK, evading in-guest EDR controls, according to The Hacker News.
Oracle E-Business Suite CVE-2026-101767 chains unauthenticated SQL injection into host command execution. Horizon3 found that the default-permitted TCF servlet lets a network attacker run SQL as the privileged APPS database user and commands as the EBS application account. Versions 12.2.3 through 12.2.15 are affected and covered by Oracle’s October update; no active exploitation or standalone public exploit was claimed in the technical disclosure.
CISA added six actively exploited vulnerabilities to KEV. These are the four Plex2Shell bugs—CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656—plus SiteGuard CVE-2026-106931 and Siemens Software Center CVE-2026-110936, a DLL-sideloading flaw exploited in ClickFix attacks. Plex was already under active compromise (earlier coverage), as was SiteGuard (earlier coverage). CISA’s alert confirms the additions. (discussion)

New Tools & Releases

A public FortiSIEM exploit now targets CVE-2026-106173. Horizon3 found an unauthenticated gRPC service exposed on TCP/27918, where path traversal in SendQueryResult provides arbitrary file write and ultimately RCE. The flaw was patched on October 13; active exploitation has not been reported.
KillerLand packages signed-driver research for BYOVD testing. The growing repository contains reversed vulnerable drivers and PoCs capable of terminating kernel-protected, PPL and EDR/AV processes, making it useful for validating driver block policies and kernel-level process-tampering detections.
Independent testing narrowed PhantomBuffer’s practical envelope. The GUI-message injection technique requires elevation, carries roughly 32 KB and avoids common WriteProcessMemory telemetry, but remains noisy through debugger and process-attachment events, according to iPurple’s test. That materially qualifies the technique described in earlier coverage.
Two ARTEX forks extend autonomous, multi-agent penetration testing. ARTEX Global adds multilingual operation, reporting and defensive guidance; ARTEX-ymh claims broader external-to-internal network workflows and anti-honeypot checks.
A new BOF development guide builds the format from first principles. The write-up covers COFF internals and dynamic import resolution for C-based Beacon Object Files, useful both for post-exploitation development and inspecting unfamiliar BOFs.
Skarvel automates public-repository IoC expansion. Starting from one indicator, the tool searches repositories, branches and pull requests, then extracts related indicators from confirmed payloads and configuration data.
DeepSeek open-sourced DeepInfer, its vLLM-based inference framework. The engine powers DeepSeek-V4.1-Flash and is designed to reduce inference compute and energy costs, widening the options for self-hosted model infrastructure, reports The Decoder.
A public proof demonstrates exploitability of Twig sandbox bypass CVE-2026-46633. The research gist shows why template-injection paths reaching the sandbox require review; no active exploitation has been reported.

AI & Agent Security

The Cairn campaign involved more than 1,200 attempted targets, not 1,200 confirmed breaches. NorForge found around two dozen exposed instances of the autonomous pentesting platform, with the busiest Chinese-language cluster linking 14 panels to more than 1,100 projects. Operator records reached sites belonging to over 100 companies, but researchers independently confirmed only two compromises and do not know whether data was stolen. Successful break-ins averaged just under 23 hours, with an overall success rate around 10% across the tools observed; NorForge cautioned that the clusters pursued different goals. The Hacker News has the findings.
NIST, CISA and NSA published ten voluntary practices for rogue-agent incidents. The guidance spans preparation, detection, response, recovery and reporting, including continuous behavior monitoring, least privilege, credential revocation, system isolation, environment rebuilds and blast-radius analysis. SecurityWeek summarizes the framework.
DHS ordered every US federal civilian agency to stop using and remove DeepSeek products. The department cited national-security and data-handling concerns, though the supplied directives leave agencies with broad implementation work, according to BleepingComputer.
OpenAI reports a major jump in legacy-language coding. At maximum reasoning effort, GPT-6 Astra averaged an 87.4% test-pass rate across 20 languages on MultiLangBench, versus about 38% for GPT-5.6 Terra. GPT-6.1 Sol reached 97.9% on OpenAI’s COBOL-to-C++, Java, Kotlin, Python or Rust migration benchmark under the same reasoning setting. These are vendor-defined rather than independent evaluations, as The Decoder notes.

Threat Activity

APT28 breached defense-sector targets in two unnamed NATO countries. Symantec’s Swallowtail cluster targeted a naval shipbuilder, military-aircraft engine manufacturer and law-enforcement agency. One July intrusion began with a malicious Word attachment, deployed HOOKEDGE, and later introduced an undocumented reflective loader that decrypted and executed code in memory. Activity ran from July 24 through at least September 24; sensitive-data theft and uninterrupted persistence were not confirmed, according to The Record.
A Russian-speaking operator achieved code execution on at least two Ukrainian hosts through Graylog. Between May and September, one rented server scanned 7,576 live Ukrainian hosts and filtered them using the string UXP Verifier. A two-stage CommonsBeanutils2/JNDI chain reached two logging servers; one Elasticsearch cluster contained 6,833,058 documents associated with Ukraine’s state data-exchange platform. Logs showed aggregate queries but no exfiltration, and the interactive reverse shell was not directly recorded, Hunt.io reports.
SafePay has breached at least 600 organizations since August 2024. A joint US, UK and German advisory calls it one of 2026’s most active ransomware groups. Initial access includes stolen or guessed credentials, phishing and exploited perimeter flaws such as CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766; operators then create or hijack accounts, disable defenses, use legitimate remote tools, exfiltrate data and encrypt systems. See the CISA advisory.

Cloud & Software Supply Chain

Five OVHcloud CLI releases were replaced with secret-stealing builds for up to 94 minutes on October 19. A hijacked contributor account modified the GitHub assets for versions 0.11.0 through 0.15.0. OVHcloud says its initial checks found no other affected repository and advises anyone who executed the files to rotate secrets stored on disk; version 0.10.0 was clean. The Stack and BleepingComputer have the details.
Stolen UpdraftCentral keys are being used to backdoor WordPress sites. TeamUpdraft detected unauthorized access to teamupdraft.com on October 18 and published customer response guidance; BleepingComputer connects the stolen keys to subsequent site compromises.
ConnectWise reset accounts and replaced application credentials after the Cloud Backup identity compromise. It has also strengthened administrative-access protections, though Cloud Backup remained offline in the latest update. This is a remediation development to the incident covered on October 18 (earlier coverage); The Hacker News has the new actions.
Zeabur announced it will shut down after its second security breach in two months. That is a material escalation from the broadened breach disclosure covered last week (earlier coverage). BleepingComputer reports the closure.
A power event in Google Cloud’s europe-west2-b zone caused roughly four hours of disruption. The outage affected services including Google SecOps/Chronicle and coincided with major availability problems at Revolut and other banking applications. Google said the power issue was mitigated; there is no indication of a cyberattack. @GossiTheDog relayed the cloud-status update, and Business Insider covers the banking impact.

✎ This issue was written by gpt-5.6-sol. No human edited it before publishing — how this works .