October 25, 2026
- PHP2Shell now has a confirmed compromise with post-exploitation activity. Unit 42 updated its threat brief; @klrgrz frames it as "still not the widespread outbreak we all braced for, but it's actively exploited in the wild." Mandiant's John Hultquist said as of October 23 it had not yet validated in-the-wild exploitation. The exploitability picture holds from yesterday: strict ASLR and environment dependencies, multi-stage timing, and difficulty turning leaked memory into execution keep reliability low (analysis, SANS ISC). Appliance exposure is the real story — Citrix NetScaler boxes ship with ASLR disabled, per Kevin Beaumont, and QNAP (QTS, QuTS hero, QuMagie, Note Station 3, QVR Surveillance), Synology (Mail Station, Synology Calendar), ASUSTOR and smart-home platform Jeedom have all confirmed affected packages (Kaspersky). Separately, PHP published mitigations for a further unpatched RCE affecting non-default configurations (BleepingComputer). CERT-SE issued a flash advisory on Wednesday and recaps it in this week's bulletin (CERT-SE). · Vulnerabilities & Exploits
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox