The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect PHP, which runs on over 70% of websites. These vulnerabilities pose a critical risk, especially for unsupported legacy PHP versions that no longer receive upstream support. Organizations are urged to quickly identify affected PHP deployments and update to fixed versions. Tenable provides solutions to discover vulnerable PHP assets across external attack surfaces, cloud workloads, and web applications, and assists in prioritizing and accelerating remediation efforts.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
Bulletin ID: 2026-045-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions: < 0.11.133 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
A local privilege escalation vulnerability named 'Fragnesia' has been reported in the Linux Kernel involving ESP-in-TCP. No detailed technical information or affected versions are provided.
Bulletin ID: 2026-030-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/13/2026 10:00 PM PDT This is an ongoing issue. This bulletin will be updated as more information becomes available. Description: AWS is aware of the copy.fail or DirtyFrag class of issues - a set of privilege escalation issues affecting the Linux Kernel. We will update this bulletin as more information becomes available. Please see below for current patching timelines for affected services related to the Copy.fail kernel issue and all its variants. AWS recommends that customers apply all updates addressing these issues as soon as they are available. See more details at Security Bulletin (ID: 2026-030-AWS).
An AI-powered espionage campaign, tracked as CL-UNK-1211, targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, custom malware, web shells, and credential harvesting techniques to maintain persistent access and conduct reconnaissance. They deployed multiple web shells, modified PHP configurations for persistence, and used advanced anti-forensics methods including disabling endpoint protections and tampering with system logs. Credential theft was achieved through hijacked .bashrc files and PHP login page modifications. The campaign aimed to dump sensitive databases and exfiltrate government mailboxes to access social media accounts. The attackers combined open-source tools with custom cross-platform backdoors and employed AI to streamline payload creation. No specific patch or fix is mentioned.
An issue in the Linux kernel's virtio-net/TAP networking path affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This vulnerability allows an attacker with privileged access inside a guest virtual machine to send specially crafted network packets that can corrupt host kernel memory, potentially leading to host memory disclosure or denial of service. AWS-managed compute and container services are not affected, and no action is required for customers using these services.
Malicious packages impersonating popular Arch Linux AUR helpers 'yay' and 'paru' were uploaded to the Arch User Repository (AUR). These trojanized packages contained legitimate code combined with malicious installation scripts that executed remote shell scripts with root privileges. The malicious packages were quickly removed and the uploader banned. Users who installed these packages should assume compromise and take remediation steps.
In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.
Microsoft's FORGE Lab is advancing AI-native vulnerability research, discovering and helping remediate numerous vulnerabilities across Windows and open-source projects including the Linux kernel. Their work from May to September 2026 led to 140 CVEs assigned for Windows and 155 validated reports for open-source projects. The research highlights challenges beyond discovery, emphasizing the need for scalable validation and remediation processes to keep pace with AI-generated findings. Key lessons include shifting focus from capability to scale, optimizing reasoning economics, and coordinating validation and remediation efforts. This approach aims to sustain vulnerability research at scale by integrating automated validation tools and human coordination.
The Universal Library for Linux (uldaq) by Measurement Computing Corporation contains a stack-based buffer overflow vulnerability. No specific affected versions or patch information are provided. There is no evidence of known exploits in the wild.
ClingSTUN is a Linux backdoor malware that operates as a back-connect proxy using the STUN protocol. It sets up persistence on infected systems and exploits multiple vulnerabilities across various device vendors for initial access and self-propagation. The malware abuses legitimate public STUN servers to maintain NAT connectivity and avoid direct attacker infrastructure. It targets a wide range of vulnerabilities in devices from vendors such as Avtech, EnGenius, D-Link, and others, and supports multiple CPU architectures. ClingSTUN also kills competing malware processes and listens for specific packets to execute remote commands and propagate further.
A sophisticated multi-component malware campaign targets telecommunications and network-edge appliances using BPFDoor variants and a newly identified implant called AVERAT. The attackers exploit SMTP traffic on port 25 to hide command-and-control communications within legitimate mail relay activity. The malware uses memory-only execution to avoid leaving forensic artifacts on disk. BPFDoor variants impersonate legitimate processes on South Korean systems, while AVERAT targets Taiwanese appliances with regional disguises. The operation employs compromised consumer devices as relays, consistent with a China-linked covert network. The campaign demonstrates advanced evasion techniques including process spoofing and encrypted configurations.
Microsoft has released general availability of Linux container support in Windows Subsystem for Linux (WSL), enabling users to build, run, and deploy Linux containers directly on Windows. This new feature includes a command-line tool (wslc.exe) and an API for programmatic container management. It integrates with Microsoft Defender for Endpoint for enhanced security monitoring and with Microsoft Intune for administrative control over container usage. Additional features such as container restart, file copying, health checks, and network commands are now supported. Docker Compose-style support is in development. This release is a feature enhancement rather than a security vulnerability.
Signal has released version 8.30, completing the rollout of its secure backups feature across all supported platforms including iOS and desktop apps. This feature allows users to create end-to-end encrypted backups of their chats, either hosted by Signal or stored locally on the device. The backups require a recovery key for decryption, and hosted backups include an additional rotating key for enhanced security. The update introduces local encrypted backups to iOS and desktop, aligns Android backups to a cross-platform format, and improves media storage efficiency. The backup system excludes disappearing messages set to vanish within 24 hours. The new iOS client also supports direct encrypted iPhone-to-iPhone transfers via Wi-Fi Aware. This release marks the completion of Signal's first phase of its backups project.
A new variant of the Spectre v2 speculative execution side-channel attack, called Branch Target Reuse (BTR), has been demonstrated to leak Linux root password hashes on Intel-based systems within minutes. This attack exploits stale branch predictor information when just-in-time (JIT) compiled code is replaced but the CPU still speculatively executes instructions based on old predictions. Researchers confirmed this vulnerability affects modern CPUs from Intel, AMD, and ARM. Fixes have been merged into the Linux kernel to address this issue.
Multiple vulnerabilities have been identified in the Image Scanner Driver for Linux provided by PFU Limited. Specific technical details and affected versions are not disclosed in the available information. No known exploits are reported in the wild at this time.
Researchers demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to leak user activity such as keystroke timing, browsing habits, and media events without elevated privileges. The attacks rely on monitoring file system events accessible to unprivileged users or apps, revealing metadata like file names and event timing rather than file contents. On Windows, monitoring the system drive root can expose file paths in other users' profiles, enabling website fingerprinting. Linux kernel mitigations partially address the most severe issues, but no patches exist for Android or macOS. Microsoft considers the behavior by design and not a vulnerability. No in-the-wild exploitation is known, and proof-of-concept code is publicly available.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of three Linux kernel vulnerabilities, including one rated critical. Specific technical details and affected versions have not been provided. No confirmed exploits in the wild are documented beyond this advisory.