PHP2Shell Reached Root as Models Closed the Patch Gap

PHP2Shell became a production intrusion chain: operators paired it with Fragnesia to root PAN-OS management interfaces and reached a US government-affiliated Active Directory environment (Dream Research). Meanwhile, open-weight GLM 5.3 reportedly built complete Firefox exploits from the patch gap without human help, while poisoned developer tooling turned trusted marketplaces and CI workflows into delivery infrastructure (The Decoder).

The Week in Review

PHP2Shell graduated from exploit race to intrusion playbook. The change was in tradecraft: Dream recovered a calibrated chain pairing CVE-2026-109618/109619 with kernel LPE CVE-2026-46300, rooting 25 servers across the US, Japan, Taiwan and South Korea, including three in one US government-affiliated environment before an Active Directory pivot. Hunt.io confirmed the first production compromises on internet-facing PAN-OS, while CERT.dk warned of China-linked use against firewalls. Exploitation remains build-, memory-layout- and deployment-dependent, particularly between mod_php and PHP-FPM. Remediation therefore means patching, restarting workers and hunting; a package-version check is not enough (Intel 471).

AI compressed diff-to-exploit while becoming operational infrastructure. In Epoch AI’s offline test, GLM 5.3 received only a target build, basic tooling and public information, then autonomously weaponized six Firefox releases shipped between September 17 and October 26 for roughly $1,000 in API fees per successful version. None of the API providers used in that experiment refused the task. Anthropic separately described five internal-model exploit chains, although it withheld the model name and human-contribution breakdown (Anthropic). ARTEX, covered last week, is now reported against more than 200 organizations worldwide (The Hacker News). Yet the agent layer remained attackable: a fixed ChatGPT share-link chain exposed private conversations, while the AWS MCP Server sandbox yielded command execution as its Lambda user (research).

Developer ecosystems supplied privileged execution. Two tampered Claude Code builds spent roughly 11 hours in Cursor’s marketplace (outside Microsoft’s marketplace and npm), potentially reaching 5,000 users; Expel observed live reverse-SSH tunnels on four affected Macs. Elsewhere, attackers hid commands in GitHub issues and pull requests to trigger 83 CI/CD attacks against 61 public repositories in under an hour (The Register), while Alpine Linux’s supposedly fixed GitLab remained vulnerable because its package omitted GitLab’s Ruby patch (Alpine). Even the upgrade process became an attack surface: Wordfence blocked 62,969 attempts in 24 hours to catch WordPress installations during a seconds-long staging race.

The management-plane pattern from last week deepened. Historical KeyDrift intrusions ran inside Cisco Catalyst SD-WAN controllers and hooked SSL_read to steal 32-byte AES-256 data-plane keys (BleepingComputer). An authorized Tailscale SSH foothold could race privileged Unix-socket checks to root, while five new Azure API Connections cases crossed tenants through Microsoft’s shared API Management layer (Binary Security). The recurring failure is privilege concentration: intermediaries that bridge trust domains run with enough authority to collapse the boundaries around them.

Ad tech became an espionage delivery layer. Ads from spyware-linked Discover-Tech appeared thousands of times between May and July across roughly ten Finnish networks whose address space includes hospitals, police, the foreign ministry, banks and energy companies. Their hidden code could identify selected devices and attempt zero-click delivery, although no Finnish infections are confirmed and an impression does not prove an employee was targeted (Faktabaari reporting via Ilta-Sanomat). Related reporting found heavy targeting of Starlink subscribers, which moves programmatic advertising from privacy problem to plausible surveillance ingress (Trend Micro).

Developing Stories

• PHP2Shell: Now in its second week, the story has moved from noisy exploitation to confirmed PAN-OS root, kernel-LPE chaining and post-exploitation inside Active Directory.
• Brotli: CVE-2026-111497 escalated from last week’s ecosystem exposure to KEV listing and shell-capable exploit traffic; CERT-SE issued its own advisory.
• LiteLLM: Investigators moved initial attacker access back to October 10 (11 days before 1.107.0) and confirmed its startup hooks could run whenever Python initialized, making package removal alone insufficient (Socket).
• Ivanti Connect Secure: The chain from two weeks ago expanded as CVE-2026-111357 and CVE-2026-118527 joined CVE-2026-104935 in KEV (CISA).
• Tailworm: Tailscale moved from disputing an uncoordinated report to shipping 1.104.4; the root-capable PoC remains private and no exploitation has been reported (Tailscale).
• EDK2: Early disclosure of pre-boot RCE CVE-2026-97631 was forced by a public patch diff, but no firmware vendor or cloud provider had shipped a fix by October 28 (Cloud Sleuth).
• Binance: The FBI attributed the $6.3 billion theft to North Korea’s TraderTraitor; Binance points to a compromised DevOps laptop rather than leaked wallet keys, with roughly $3 billion frozen on-chain (BleepingComputer).

Tools & PoCs Worth Grabbing

• HorusEye: ranks exploitable AD and AD CS paths from BloodHound, Certipy and NetExec output, then emits exact validation commands.
• SysWhispers4: direct and indirect syscall generation across x64, x86, WoW64 and ARM64, with runtime SSN resolution and stack spoofing.
• NMG: parameterized, fileless .NET memory shells for IIS and ASP.NET, compatible with Godzilla, Behinder and AntSword.
• Azure API Management C2 redirector: policy-based traffic shaping with beacons communicating only through trusted Azure endpoints (RedOps).
• ElectroNG: Doyensec’s now-open-source scanner for insecure Electron configurations and known desktop attack patterns (Doyensec).
• Project Quarry: session-level behavioral detections over AI-agent tool calls, MCP actions and multimodal input (The Register).
• LANTERN: a practical DORA TLPT/TIBER-EU exercise for stop-or-continue decisions after a covert engagement is detected (Gikaku).

Under Active Exploitation

• CVE-2026-109618 / CVE-2026-109619, PHP2Shell: Confirmed production compromise of internet-facing PAN-OS management interfaces (Hunt.io).
• CVE-2026-46300, Fragnesia: Linux kernel LPE chained after PHP2Shell to obtain root (BleepingComputer).
• CVE-2026-111497, Brotli: Added to KEV amid traffic carrying a public, shell-capable exploit (CISA).
• CVE-2026-97229, GitLab: Unauthenticated CI/CD RCE exploited against Alpine’s infrastructure and now on KEV (BleepingComputer).
• CVE-2026-111357 / CVE-2026-118527 / CVE-2026-104935, Ivanti: Exploited Connect Secure privilege-escalation and file-placement chain (CISA).
• CVE-2026-76418, Cisco ASA/FTD: Unauthenticated DoS actively used to crash SSL VPN appliances (BleepingComputer).
• CVE-2026-41709, VMware ESX: Weaponized by China-nexus Warp Panda to reduce audit visibility (The Hacker News).
• CVE-2026-48356, Adobe Commerce PolyShell: KEV-listed and tied to compromises of hundreds of stores (The Hacker News).
• CVE-2026-118539, Drupal Commerce: Unauthenticated authorization bypass under active exploitation (BleepingComputer).
• CVE-2026-86950, Apple CoreGraphics: Exploited in targeted attacks; fixes were backported to iOS/iPadOS 18.7.11 (The Hacker News).
• CVE-2026-101767, Oracle E-Business Suite: Unauthenticated SQL injection-to-OS-command path receiving active exploit probes (SecurityWeek).
• CVE-2026-102785, YOOtheme Pro: Exploited two days after patch to upload JPEG/PHP polyglots and deploy webshells (Unit 42).
• CVE-2025-64446 / CVE-2026-0257, FortiWeb and PAN-OS: Used alongside password attacks in the k0t firewall/VPN credential-harvesting campaign (The Hacker News).
• CVE-2026-80097, Microsoft Authenticator for Android: Public PoC impersonates Teams to request high-value Graph tokens; fixed in 6.2606.4246 (The Hacker News).
• CVE-2025-30026 / CVE-2025-30023 / CVE-2026-63286, Axis Camera Station: Full public chain from unauthenticated RCE to decryption of stored camera credentials (research and PoCs).

Wild Speculation

Four items this week share a shape: GLM 5.3 turning six Firefox releases into complete exploit chains, EDK2 disclosure forced by a public patch diff, Alpine Linux omitting GitLab’s Ruby fix, and PHP2Shell remediation requiring worker restarts. Read together, they suggest the patch gap is becoming a distributed-consistency problem rather than a question of elapsed time. Source, downstream package, process memory and running behavior can each occupy a different security state, while models make exploitable deltas cheaper to turn into working chains. The WordPress staging race is the sharpest case: the move toward safety opens the exposure window.

The GitHub issue/PR campaign turned attacker-controlled repository text into CI actions; the AWS MCP Server sandbox yielded command execution as its Lambda user. Together, they suggest an old primitive beneath “agent security”: an orchestrator reissues untrusted input under delegated authority. The tampered Claude Code builds and LiteLLM startup hooks show how much pre-existing authority can surround that layer before a model even acts. One reading is that an AI agent is becoming CI/CD with a natural-language trigger surface: the same combustible mix of ambient credentials, extensibility and trusted automation. Project Quarry’s session-level detections fit that model better than payload-only scanning.

• If patching is a convergence problem, “patched” may stop being an acceptable asset state. Defenders would need runtime evidence: patched code present, workers recycled, downstream artifacts matching upstream and vulnerable behavior unreachable. A signal would be exposure tooling replacing version checks with provenance and behavioral probes.
• One way this plays out: CI, MCP and extension controls collapse into one authorization discipline. Tool calls and workflow steps become a single execution graph, with credentials scoped per action rather than inherited by a session. The tell would be Project Quarry-style analytics appearing in pipeline reviews.
• If that trigger surface keeps widening, the highest-value red-team finding may become “authority laundering,” not raw code execution: an issue, tool request or extension causes a privileged action while every component believes it behaved correctly. A signal would be scopes asking for end-to-end delegated-action chains rather than isolated sandbox results.

✎ This recap was written by gpt-5.6-sol. No human edited it before publishing — how this works .