Two critical unauthenticated remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, were publicly disclosed in October 2026. These vulnerabilities have a high severity score (CVSS 9.2) and affect PHP's memory management, enabling reliable exploitation when chained. The disclosure triggered immediate emergency responses from criminal forum operators, who took their platforms offline, migrated infrastructure, and restricted new registrations to mitigate risk. These forums store sensitive data such as member identities, private communications, and stolen credentials, making the vulnerabilities a significant threat to their operations. The adversary economy's reaction mirrors legitimate enterprise incident response, highlighting the severity of the vulnerabilities. No specific affected PHP versions are detailed in the provided data.
In the Linux kernel, the following vulnerability has been resolved:
gve: fix napi_disable deadlock when attempting to disable XSK pools
When disabling XSK pools, GVE calls the unlocked versions of
napi_disable and napi_enable. However, the netdev lock has already been
acquired before ndo_bpf is called because GVE supports queue management
ops. Calling the unlocked versions of napi_disable/enable results in a
deadlock when attempting to disable XSK pools, as the thread attempts to
re-acquire a lock it already holds.
Update the NAPI calls to use the locked versions.
This issue was found in production.
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Unmask interrupts only when ACTIVE is true
There is a small race window between intel_rps_boost() reading
a stale ACTIVE state and queuing rps->work, where ACTIVE may be
changed via asynchronous calls triggered by wakeref drop.
This means that rps_work() could be triggered after the GT has
been parked, so unmasking RPS PM interrupts would happen without
holding PM wakelock. This sequence of events may be observed
during live_rc6_ctx_wa() selftest:
1) live_rc6_ctx_wa()
-> intel_engine_pm_put()
-> wakeref_put()
ASYNC1) wakeref_put() callback
-> __engine_park()
-> intel_gt_pm_put_async()
-> intel_gt_pm_put_async_untracked()
-> intel_wakeref_put_async()
ASYNC2) wakeref_put_async() callback
-> __gt_park()
-> intel_rps_park()
-> intel_rps_clear_active() [clear ACTIVE]
WITH INTERRUPTS:
-> rps_disable_interrupts()
-> cancel_work_sync(rps->work)
-> rps_reset_interrupts() [rps->pm_iir = 0]
WITHOUT INTERRUPTS (TIMER mode):
-> rps_stop_timer()
-> cancel_work_sync(rps->work)
2) live_rc6_ctx_wa()
-> intel_gt_wait_for_idle()
-> intel_gt_retire_requests_timeout()
-> dma_fence_wait_timeout()
-> ops->wait() [i915_fence_wait()]
-> i915_request_wait_timeout()
-> intel_rps_boost()
-> intel_rps_is_active() [check ACTIVE]
[OPEN RACE WINDOW]
-> queue_work(rps->work)
-> retire_requests()
-> i915_request_retire()
-> intel_rps_dec_waiters() [from 1 to 0]
If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],
then:
3) rps_work() executes from the workqueue and may satisfy
"(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir
is zeroed by an earlier rps_work() call or never gets a new
value after previous intel_rps_unpark() event), so it jumps
to "out" label, bypassing intel_rps_is_active() guard and
executes gen6_gt_pm_unmask_irq();
4) GT is parked and runtime PM wakelock is dropped, so only
a raw reference in __gt_park() ->
intel_display_power_put_async() remains for 100ms, then the
MMIO write in gen6_gt_pm_unmask_irq() detects missing
wakelock via assert_rpm_wakelock_held() and emits
"RPM wakelock ref not held during HW access" tainting kernel.
Commit 3e7abf814193 ("drm/i915: Extract GT render power state management")
dropped the "if (rps->interrupts_enabled)" guard that
gen6_pm_rps_work() had around this unmask in i915_irq.c.
INTEL_RPS_ACTIVE brackets the same window, since it is set in
intel_rps_unpark() before rps_enable_interrupts() and
rps_start_timer() and cleared in intel_rps_park() before
rps_stop_timer() and rps_disable_interrupts().
Skip unmasking when RPS is no longer active (reaching unmask
operation is independent of INTERRUPT mode). This does not
prevent RPS operation from resuming on the next unpark.
In interrupt mode, intel_rps_unpark() calls
rps_enable_interrupts(), which enables and unmasks the PM
interrupts. In timer mode, it calls rps_start_timer(),
restarting periodic engine-busyness evaluation. The timer
generates software RPS events and queues rps_work() directly,
independently of PM interrupt delivery. Neither mode requires
the late worker to unmask interrupts while the GT is parked
(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)
A vulnerability in the Linux kernel's Btrfs filesystem code related to io_uring read extent failure handling has been resolved. The issue involved improper unlocking of inode and extent locks on failure paths, potentially leading to resource management inconsistencies. The fix ensures that unlocking occurs in the caller on all failure returns, aligning with the expected error handling behavior.
A vulnerability in the Linux kernel's mt76 WiFi driver was resolved that involved incorrect accounting of non-AQL frames per peer rather than per link. The driver increments and decrements counters for frames on different links, causing the count to drift upwards and potentially block the station. The fix ensures the count is maintained on the primary link's wcid, aligning with other peer-wide state management.
A vulnerability in the Linux kernel's KVM arm64 nested virtualization implementation was resolved by fixing the lifecycle management of the nested_mmus array. This array holds shadow page tables used during nested guest execution. Previously, if a VCPU_INIT event occurred while a virtual CPU was running a nested context and the nested_mmus array needed relocation, the vCPU could continue using a pointer to a freed structure, leading to use-after-free conditions. The fix changes the nested_mmus array to an array of pointers allocated at VM creation to avoid reallocations and clarifies object lifecycles.
A vulnerability in the Linux kernel related to x86 memory management was resolved by removing an unnecessary PMD page copy during page freeing. The issue caused a possible deadlock on systems with discrete GPUs due to a circular locking dependency involving mmap locks and memory reclaim operations. The fix detaches the original PMD page earlier and frees page tables without additional allocations, eliminating the locking cycle.
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.
CVE-2026-99082 is a vulnerability in the Linux kernel's KVM x86 virtualization component related to the handling of per-vCPU MMIO cache and memslot generations. The flaw involves improper use of memslots when the vCPU runs in System Management Mode (SMM), which can lead to stale cache entries and incorrect memory accesses. This can cause KVM to bypass write-tracking for certain memory pages, potentially allowing continued use of outdated shadow translations. The issue has been fixed by ensuring the active memslots are used for caching and validation, distinguishing between normal and SMM address spaces.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves a flaw where stale XSK buffers may be released multiple times during MPWQE refill retries, potentially causing memory corruption. The issue occurs when buffer allocation fails with -ENOMEM, leading to improper handling of buffer release bitmaps. This flaw has been resolved by ensuring idempotent retries through proper bitmap management.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) leak on the request error path. The function pm_runtime_get_sync() increments the usage counter even when it fails, and the error path does not properly decrement this counter, preventing the controller from runtime-suspending and leaving its clock enabled.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource management issues.
CVE-2026-99040 is a race condition vulnerability in the Linux kernel's key management subsystem. It involves a timing issue in the add_key() function where a writer can bypass keyring restrictions by exploiting a race between reading the restriction and linking a key. The flaw allows a writer with write permission on a destination keyring to link a key despite a reject-all restriction being installed. The issue was confirmed through concurrency testing and reproducer tools.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but fails to properly clean up runtime PM on removal, potentially leading to clocks being disabled incorrectly if the device is runtime suspended. This issue was identified through manual code inspection and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's regulator subsystem was fixed where the function of_regulator_bulk_get_all() did not properly initialize supply names in the returned array. This could lead to uninitialized memory dereferences when the array is used, such as during error logging in regulator_bulk_enable(). The fix involves copying supply names into the array's own allocation to ensure proper lifetime management and prevent memory issues.
CVE-2026-98999 is a high-severity vulnerability in the Linux kernel's drm/xe graphics subsystem. It involves a stale pinned_link list entry caused by improper handling of buffer object (bo) pin and unpin operations, leading to a use-after-free condition when the bo is freed but the list still references it. This flaw arises because framebuffer pin/unpin operations bypass the pinned_link management used by external pin/unpin calls, leaving stale references that corrupt kernel memory. The issue has been fixed by consolidating pinned_link removal into a common unpin function that is called on all unpin paths, preventing stale list entries and memory corruption.
CVE-2026-98946 is a vulnerability in the Linux kernel's drm/vc4 driver where the V3D interrupt is not properly disabled during runtime suspend on certain ARM platforms. This can cause spurious interrupts after the power domain is off, leading to unexpected behavior such as scheduling of overflow memory work despite cancellation. The issue arises because the ARMCTRL interrupt controller on Raspberry Pi 0-3 does not report active interrupt states, making synchronize_irq() insufficient to quiesce the interrupt handler. The fix involves disabling the interrupt line across the power management transition and adjusting the interrupt request handling to maintain enable/disable balance.