Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, allow unauthenticated remote code execution on affected servers. Emergency patches were released on October 21, 2026, for PHP versions 7.4, 8.0, 8.1, and supported 8.2–8.5 branches. Despite patches, millions of servers remain vulnerable. Exploitation attempts began shortly before patches were public, with confirmed real-world attacks including compromises of Palo Alto Networks devices. A third related vulnerability in Brotli (CVE-2026-111497) was patched later. Another unpatched PHP vulnerability (CVE-2026-115560) requires unusual configurations and is scheduled for a regular fix. Mitigation requires patching and auditing systems for compromise signs. Detection tools and updated security solutions can help identify exploitation attempts.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.
Cisco Talos has identified a new Windows-based command-and-control (C2) framework named NIK C2 that integrates AI directly into its attack chain. This Go-based implant enables adversaries to dump credentials, capture keystrokes, and deploy screen-locking ransomware. It uses an embedded OpenAI model to analyze harvested data in real time, funding API requests by hijacking the victim's own OpenAI API keys. This integration allows continuous data collection and exploitation without offline delays, turning compromised hosts into active operational assets. The use of victim API keys also masks attacker infrastructure, complicating detection and incident response. Defenders are advised to implement continuous behavioral monitoring and update endpoint defenses accordingly.
CVE-2026-111497, known as Brotli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli C decoder library. It affects many widely used software projects that decompress Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and PHP for Windows. The flaw can be triggered by decompressing crafted Brotli data, potentially leading to process crashes, memory leaks, or remote code execution. The vulnerability has a high CVSSv4.0 score of 9.2 assigned by Google. Patches have been released for the Brotli library and major runtimes, but some projects had not shipped fixed releases as of late October 2026. Applications bundling their own Brotli decoder require individual updates.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect PHP, which runs on over 70% of websites. These vulnerabilities pose a critical risk, especially for unsupported legacy PHP versions that no longer receive upstream support. Organizations are urged to quickly identify affected PHP deployments and update to fixed versions. Tenable provides solutions to discover vulnerable PHP assets across external attack surfaces, cloud workloads, and web applications, and assists in prioritizing and accelerating remediation efforts.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.
A PHP vulnerability was recently disclosed with coordinated patches released by PHP.net and many vendors. No reliable public exploit code is currently available, though some firms claim to have working exploits. Cloudflare and Amazon report many exploit attempts, but it is unclear if these are effective. Applying the official patches is the recommended defense. Workarounds and web application firewall rules may provide limited temporary protection. Embedded devices and appliances running vulnerable PHP versions are a concern due to patching difficulties and should be isolated. The situation highlights the importance of timely patching and preparedness for future similar vulnerabilities.
Two unauthenticated remote code execution vulnerabilities, collectively dubbed 'php2shell', affect PHP versions since 5.4. These flaws can be triggered by a simple HTTP request and pose a critical risk to all industries running PHP applications, including popular platforms like WordPress and Drupal. Older PHP branches are end-of-life and will not receive patches, representing about half of use cases. Cisco Talos has released Snort signatures to detect exploitation attempts. Immediate upgrading to PHP 8.2 or later is strongly advised, as no patches exist for PHP 8.1 or earlier.
Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affect PHP versions back to 5.4 and impact widely used web applications such as WordPress, Drupal, and Joomla. These vulnerabilities involve memory management and error handling components of PHP and allow unauthenticated attackers to execute arbitrary code. Exploitation attempts have been detected in the wild shortly after patches were released. The flaws also enable reading sensitive process memory, potentially exposing credentials and secrets. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and backports for 7.4, 8.0, and 8.1. The PHP Foundation and security firms urge immediate patching due to the severity and active exploitation attempts.
The PHP security team has announced two critical remote code execution vulnerabilities with CVSS v4.0 scores of 9.2 each, affecting multiple PHP versions including 5, 6, 7, and 8. Emergency patches are scheduled for release on October 21, 2026. Details about the vulnerabilities, affected versions, and fixes have not yet been disclosed. Information about the flaws leaked prematurely, but no active exploitation has been observed. Administrators are urged to prepare for immediate patching once updates become available.
Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that allows attackers with upload access to execute arbitrary JavaScript in an administrator's browser. This can lead to theft of administrator authentication tokens and unauthorized access to the Shopware Administration API. If the compromised administrator has extension management privileges, attackers can upload and activate malicious plugins to achieve remote code execution on the server. No vendor patch or statement is currently available. Mitigation involves restricting media upload access to trusted users or disabling HTML file uploads.
Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.
Sensors detected a small number of scans targeting the 'wordfence-waf.php' script, which is part of the Wordfence security solution for WordPress sites. These scans use minimal HTTP headers and target sites by IP address rather than hostname. The purpose appears to be enumeration of Wordfence-protected sites or attempts to bypass Wordfence protections. The scanned file does not expose secrets but is part of Wordfence's Extended Protection feature designed to prevent bypass. No active exploitation or vulnerabilities have been reported in these scans.