CRITICAL: CVE-2026-55981 in Creative Sound Blaster Katana V2, V2X, SE (v1.30.260813.1100) allows firmware modification & upload. No fix yet — monitor for updates and restrict device access. https://radar.offseq.com/threat/cve-2026-55981-vulnerability-in-creative-labs-creative-sound-blaster-katana-v2-v2x-se-b5b2482bb26c4567 #OffSeq #infosec #firmware #vulnerability

CRITICAL: CVE-2026-55981 in Creative Sound Blaster Katana V2, V2X, SE (v1.30.260813.1100) allows firmware modification & upload. No fix yet — monitor for updates and restrict device access. https://radar.offseq.com/threat/cve-2026-55981-vulnerability-in-creative-labs-creative-sound-blaster-katana-v2-v2x-se-b5b2482bb26c4567 #OffSeq #infosec #firmware #vulnerability

A critical Oracle Java SE vulnerability, CVE-2026-91403, threatens systems worldwide. Discover affected GraalVM versions and immediately update your software.

#Oracle #JavaSE #CyberSecurity #CVE202691403 #GraalVM

https://dailytechnow.com/oracle-java-se-vulnerability-cve-2026-91403/

Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.

#Oracle #Java #eMudhra #CVE202691403 #GraalVM #TLS #PKI #CyberSecurity

https://securityonline.info/oracle-java-security-alert-emudhra-cve-2026-91403/?utm_source=mastodon&utm_medium=jetpack_social

A critical Oracle Java SE vulnerability, CVE-2026-91403, threatens systems worldwide. Discover affected GraalVM versions and immediately update your software.

#Oracle #JavaSE #CyberSecurity #CVE202691403 #GraalVM

https://dailytechnow.com/oracle-java-se-vulnerability-cve-2026-91403/

Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.

#Oracle #Java #eMudhra #CVE202691403 #GraalVM #TLS #PKI #CyberSecurity

https://securityonline.info/oracle-java-security-alert-emudhra-cve-2026-91403/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Oracle patches critical unauthenticated Java vulnerability; CVE-2026-91403

A critical vulnerability in the Java Secure Socket Extension component affects Oracle Java SE and multiple GraalVM releases.

The flaw carries a CVSS score of 9.1 and can be exploited remotely without credentials or user interaction.
⠀
Successful exploitation could allow attackers to access, create, delete or modify critical data available to the affected Java or GraalVM deployment.

Affected products include:

• Oracle Java SE 8, 11, 17, 21, 25 and 27 releases listed by Oracle
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20
⠀
Oracle released a security patch on October 21 and recommends applying the available updates.

Source:
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@leah You forgot Java

> This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@foone yo dawg I heard you like CVEs https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

@CursedSilicon @foone QUIC and node.js are news to me, details?

Anyway yes, you missed Java: https://www.cve.org/CVERecord?id=CVE-2026-91403

@wezm

- Java CVE-2026-91403

Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

#security

sev:CRIT in Java really is the best way this week could continue on course.

https://www.cve.org/CVERecord?id=CVE-2026-91403

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Man, PHP has been getting its shit kicked in today. Well, at least the other language I grew up on is doing fine, right Java?

...Java?

oh. oh no.
https://www.cve.org/CVERecord?id=CVE-2026-91403

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-54630 (CRITICAL): Part-DB-server <2.12.1 lets authenticated users upload .phar files, enabling remote code execution as www-data. Patch to 2.12.1+ and restrict user permissions. https://radar.offseq.com/threat/cve-2026-54630-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-part-db-part-db-server-3e3f77096f8d900f #OffSeq #CVE #RCE #infosec

CVE-2026-54630 (CRITICAL): Part-DB-server <2.12.1 lets authenticated users upload .phar files, enabling remote code execution as www-data. Patch to 2.12.1+ and restrict user permissions. https://radar.offseq.com/threat/cve-2026-54630-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-part-db-part-db-server-3e3f77096f8d900f #OffSeq #CVE #RCE #infosec

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-115547 | Okta Access Gateway CRITICAL vuln (CVSS 9.1): Authenticated admin can execute arbitrary commands as OAG service account in versions <2026.10.2. Patch to 2026.10.2+ ASAP. https://radar.offseq.com/threat/cve-2026-115547-improper-control-of-generation-of-code-in-okta-okta-access-gateway-918199f1f327eefb #OffSeq #Okta #Vuln #InfoSec

Okta fixes four Okta Access Gateway vulnerabilities, including PHP2Shell and CVE-2026-115547 command execution. Upgrade OAG to 2026.44.0.

#Okta #OktaAccessGateway #PHP2Shell #CVE2026115547 #CVE2026115546 #IAM #SAML #CyberSecurity

https://securityonline.info/okta-access-gateway-vulnerabilities-php2shell/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-115547 | Okta Access Gateway CRITICAL vuln (CVSS 9.1): Authenticated admin can execute arbitrary commands as OAG service account in versions <2026.10.2. Patch to 2026.10.2+ ASAP. https://radar.offseq.com/threat/cve-2026-115547-improper-control-of-generation-of-code-in-okta-okta-access-gateway-918199f1f327eefb #OffSeq #Okta #Vuln #InfoSec

Okta fixes four Okta Access Gateway vulnerabilities, including PHP2Shell and CVE-2026-115547 command execution. Upgrade OAG to 2026.44.0.

#Okta #OktaAccessGateway #PHP2Shell #CVE2026115547 #CVE2026115546 #IAM #SAML #CyberSecurity

https://securityonline.info/okta-access-gateway-vulnerabilities-php2shell/?utm_source=mastodon&utm_medium=jetpack_social

Arista VeloCloud Orchestrator: SQL injection zero-day sfruttata, CVE-2026-114625, CVSS 9.9. Basta un login valido (anche Enterprise Read Only) per ottenere privilegi da operatore. Fix: 5.2.3.18, 6.1.3.10, 6.4.2.12. IOC: 74.82.197[.]86, 38.54.50[.]151. Limitare la UI di VCO alle reti admin, cercare nei web access log path anomali e rate alto, rivedere le modifiche admin recenti. Attribuzione non nota. https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html #infosec #cybersecurity

Arista issued an advisory on October 22, 2026, regarding a vulnerability in VeloCloud Orchestrator tracked as CVE-2026-114625 with a CVSS score of 9.9.

The flaw allows anyone logging in with an Enterprise Read Only account to gain operator privileges, and is being used in real-world attacks.

Fixes are available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.

https://en.hacks.gr/krisimo-provlima-asfaleias-sto-velocloud-orchestrator-tis-arista-axiopoieitai-se-epitheseis/

#Arista #VeloCloud #Vulnerability #Patch

Arista patched CVE-2026-114625 in on-prem VeloCloud Orchestrator, confirmed under active exploitation. Compromise of VCO risks full SD-WAN management plane control. Patch immediately and review orchestrator logs for anomalous access. #Arista #VeloCloud #ZeroDay #ThreatIntel

https://cyberworldops.eu/en/arista-fixes-velocloud-orchestrator-flaw-under-active-exploitation-cve

Cybersecurity Awareness Month isn't over yet: Arista VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSSv3.1: 9.9 critical , CVSS4: 9.4)

This issue was detected by Arista and is known to be actively exploited.

https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

#arista #zeroday #CVE #eitw

🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited

Arista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.
⠀
The SQL injection flaw allows any authenticated user, including someone with the lowest built-in Enterprise Read Only role, to gain operator privileges and impersonate a local “superuser operator.”

Arista says the vulnerability is being actively exploited.
⠀
CVSS: 9.9

Affected:

• VCO 5.2.x before 5.2.3.18
• VCO 6.1.x before 6.1.3.10
• VCO 6.4.x before 6.4.2.12

Fixed:

• VCO 5.2.3.18
• VCO 6.1.3.10
• VCO 6.4.2.12
⠀
Hosted and Dedicated instances have already been patched. VeloCloud Edge and Gateway products are not directly affected.

Administrators should update immediately and investigate affected systems for signs of compromise.

Source: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Arista says VeloCloud Orchestrator vulnerability CVE-2026-114625, a CVSS 9.9 SQL injection, is exploited in the wild. Upgrade on-prem VCO now.

#Arista #VeloCloud #CVE2026114625 #SQLInjection #SDWAN #ExploitedInTheWild #ZeroDay #CyberSecurity

https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19677: CRITICAL vuln (CVSS 9.3) in onPhase Forms 11.0.14 — missing auth lets remote attackers impersonate users, escalate to TenantAdmin, and execute OS commands. Restrict registration form access & watch logs. https://radar.offseq.com/threat/cve-2026-19677-cwe-306-missing-authentication-for-critical-function-in-onphase-onphase-forms-aa9ba384e28e3853 #OffSeq #CVE #onPhase #Vuln

CVE-2026-19677: CRITICAL vuln (CVSS 9.3) in onPhase Forms 11.0.14 — missing auth lets remote attackers impersonate users, escalate to TenantAdmin, and execute OS commands. Restrict registration form access & watch logs. https://radar.offseq.com/threat/cve-2026-19677-cwe-306-missing-authentication-for-critical-function-in-onphase-onphase-forms-aa9ba384e28e3853 #OffSeq #CVE #onPhase #Vuln

Bind CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory

ISC가 BIND 9의 GSS-TSIG 처리 결함(CVE-2026-94300)을 공개했다. 공격자는 아직 유효한 협상 TSIG 키로 서명된 UDP 메시지를 캡처한 뒤 재전송하고, 자신이 제어하는 존에 대한 조작된 질의를 결합해 named 프로세스의 메모리 손상을 유발할 수 있다. 결과적으로 서비스 중단뿐 아니라 원격 코드 실행 가능성도 있으며, CVSS 8.1의 원격 취약점으로 분류됐다. 영향 버전을 운영 중이면 BIND 9.20.30 또는 9.21.27(지원 프리뷰는 9.20.30-S1)로 즉시 업그레이드해야 하며 알려진 우회책은 없다.

https://kb.isc.org/docs/cve-2026-94300

#security #cve #bind9 #dns #memorycorruption

I guess DNS was feeling left out this week

kb.isc.org/docs/cve-202...

CVE-2026-94300: Concurrent GSS...

I guess DNS was feeling left out this week

kb.isc.org/docs/cve-202...

CVE-2026-94300: Concurrent GSS...

good luck, i guess, idk, i'm gonna go make a sandwich https://kb.isc.org/docs/cve-2026-94300

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://kb.isc.org/docs/cve-2026-94300

DNS. DNS. DNS.

https://www.cve.org/CVERecord?id=CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Oh, an RCE in Bind too? Oh COME ON. CVE-2026-94300

What's next, Sendmail?

@foone bind. https://kb.isc.org/docs/cve-2026-94300

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Review the latest Cisco security advisory to patch 10 Cisco Expressway vulnerabilities, including critical 9.8 CVSS root RCE flaw CVE-2026-76466.

#Cisco #CiscoExpressway #RCE #CVE202676466 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/cisco-expressway-vulnerabilities-root-rce-patched/?utm_source=mastodon&utm_medium=jetpack_social

Cisco fixes 13 Snort 3 vulnerabilities, including CVE-2026-20043 and denial of service flaws affecting FTD, Meraki MX and IOS XE.

#Snort3 #Cisco #CVE202620043 #CVE202620291 #CVE202676524 #DenialOfService #FirewallSecurity #CyberSecurity

https://securityonline.info/cisco-snort-3-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

15 Apache Traffic Server vulnerabilities, including CVSS 10.0 CVE-2026-111813, allow cache poisoning and smuggling. Upgrade to 10.2.1.

#ApacheTrafficServer #ATS #CVE2026111813 #CVE2026111811 #CVE2026111816 #CachePoisoning #RequestSmuggling #CyberSecurity

https://securityonline.info/apache-traffic-server-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Step Right Up to the Twelve-Year-Old Time Bomb!

LADIES AND GENTLEMEN, gather around and feast your eyes on CVE-2026-110264 — a CVSS 10.0 spectacular that has been hiding inside GitLab since version 7.0, circa 2014! That's right, while One Direction was breaking up and Flappy Bird was breaking spirits, this integer overflow was quietly waiting in GitLab's regex compiler, asking absolutely nobody for credentials before running arbitrary code on your self-managed server! (1/2)

🏆 New Achievement! Step Right Up to the Twelve-Year-Old Time Bomb!

LADIES AND GENTLEMEN, gather around and feast your eyes on CVE-2026-110264 — a CVSS 10.0 spectacular that has been hiding inside GitLab since version 7.0, circa 2014! That's right, while One Direction was breaking up and Flappy Bird was breaking spirits, this integer overflow was quietly waiting in GitLab's regex compiler, asking absolutely nobody for credentials before running arbitrary code on your self-managed server! (1/2)

GitLab corrige la CVE-2026-110264, une faille critique qui touche toutes les versions depuis 2014 https://www.it-connect.fr/gitlab-cve-2026-110264-faille-critique-regex-onigmo/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #GitLab

GitLab security fixes are really next level.

19.4.2: CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler
Thanks joaxcar for reporting [...].

... **nine days** pass by ...

19.4.3: CVE-2026-110264 - Integer Overflow issue in Regular Expression Compiler
Thanks joaxcar for reporting [...].

Did they even bother to look further in fixing CVE-2026-97229? 🤔

And this is also wild for an RCE fix: "This patch includes database migrations that may impact your upgrade process."

CVE-2026-110264: a 12-year-old regex integer overflow in GitLab scores CVSS 10.0

https://thecybersecguru.com/news/gitlab-regex-rce-cve-2026-110264/

GitLab says CVE-2026-110264 (CVSS 10.0) could let an unauthenticated attacker run code on self-managed servers, in all versions since 7.0. It is GitLab's second CVSS 10.0 regex integer overflow in nine days: instances patched on Oct 12 (19.4.2, 19.3.5, 19.2.8) remain exposed until 19.5.1, 19.4.3, 19.3.6 or a 19.2.9 backport. GitLab lists no workaround and says GitLab.com and Dedicated were already patched.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

#GitLab #InfoSec #Cybersecurity #SelfHosted

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today.

https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920

#ThreatIntel #ThreatIntelligence #IFIN

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Apply the GitLab critical patch release to fix 12 GitLab vulnerabilities, including 10.0 CVSS RCE flaw CVE-2026-110264 and CVE-2026-15723.

#GitLab #CVE2026110264 #DevSecOps #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/?utm_source=mastodon&utm_medium=jetpack_social

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 Firmware (<1.30) hit by CVE-2026-110243, a CRITICAL command injection (CVSS 9.9). Authenticated users with network config can execute root OS commands. No patch — restrict interface access. Details: https://radar.offseq.com/threat/cve-2026-110243-cwe-78-in-kiloview-e3-firmware-b693a1be0d634280 #OffSeq #Infosec #Kiloview #CVE2026110243

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 Firmware (<1.30) hit by CVE-2026-110243, a CRITICAL command injection (CVSS 9.9). Authenticated users with network config can execute root OS commands. No patch — restrict interface access. Details: https://radar.offseq.com/threat/cve-2026-110243-cwe-78-in-kiloview-e3-firmware-b693a1be0d634280 #OffSeq #Infosec #Kiloview #CVE2026110243

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected

https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

RT: @MalwareTechBlog I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

Php2shell Needs a Shell

글은 PHP 엔진의 인증 불필요 RCE 취약점(CVE-2026-109618, CVE-2026-109619·CVSS 9.2)이 PHP-FPM 등 모든 SAPI에서 웹서버 권한의 코드 실행으로 이어질 수 있으며, 패치가 최우선이라고 강조한다. 동시에 FreeBSD jail에 PHP-FPM을 최소 구성으로 격리하고 IP 주소·DNS·외부 네트워크·셸·범용 인터프리터·쓰기 가능한 파일시스템을 제거하면, 초기 RCE 뒤의 리버스 셸·페이로드 다운로드·웹셸 지속성 확보를 크게 제한할 수 있다고 주장한다. Caddy, nginx, PHP-FPM, PostgreSQL을 별도 jail로 분리하고 필요한 Unix 소켓만 마운트하는 토폴로지는 AI 서비스의 PHP...

https://vivianvoss.net/blog/php2shell-needs-a-shell

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.

Which is good of them. But I thought I'd "purged my account data"?

Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.

We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.

Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/

#PHP #InfoSec #CVE #Security #Email #php2shell

CW: technikai sérülékenység

PHP-hez kritikus javítások érkeztek: CVE-2026-109618 és CVE-2026-109619 (CVSS 9.2). PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 kiadva. Jelentették a kihasználási kísérleteket és átmeneti szolgáltatás-leállásokat; régi, nem karbantartott PHP-telepítések különösen veszélyben. Frissítés és disztribúciós/backport csatornák ellenőrzése szükséges. https://linuxmint.hu/hir/2026/10/a-php2shell-javitasok-megerkeztek-de-a-leallasok-es-a-kihasznalasi-kiserletek-miatt-meg #PHP #CVE-2026-109618 #CVE-2026-109619 #infosec #OpenSource

My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker

CW: sérülékenység (CVE-2026-109618, CVE-2026-109619)

A PHP Foundation közleménye: a CVE-2026-109618-re már 2024-ben voltak jelek, de érdemi javítás csak MI-alapú kódelemzések után indult meg. Javítások csak PHP 8.2+ verziókhoz érhetők; sok telepítés EOL marad. Részletek: https://linuxmint.hu/hir/2026/10/php-mar-2024-ben-felfedeztek-a-kritikus-serulekenyseg-jeleit-de-csak-az-mi-alapu

#PHP #CVE #Infosec #OpenSource

CW: kritikus sérülékenységek

NBSZ NKI riaszt: két PHP-hiba (CVE-2026-109618, CVE-2026-109619) CVSS v4.0: 9.2. Javítások közzététele: 2026-10-21 14:00 UTC. Hiba: hitelesítés nélkül, távolról tetszőleges kód futtatható lehet. Frissítés azonnal, vagy érintett rendszerek izolálása/kiiktatása javasolt.

#PHP #CVE #kiberbiztonság #OpenSource

https://linuxmint.hu/hir/2026/10/riasztas-a-php-futtatokornyezet-kritikus-serulekenysegeirol

PHP2Shell: strumenti per verificare l’esposizione alle vulnerabilità critiche

A seguito della segnalazione delle vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il CERT-AGID segnala la disponibilità di due strumenti...

🔗️ [Cert-agid] https://link.is.it/0SzNoZ

@SecureOwl One of my vendors (Report-uri.com) sent a proactive note to say they'd handled it.

https://blog.report-uri.com/responding-to-php2shell-cve-2026-109618-and-cve-2026-109619/

Red Alert in the Web World: Understanding the “PHP2Shell” Vulnerabilities

https://cltcccybersecurity.wordpress.com/2026/10/22/red-alert-in-the-web-world-understanding-the-php2shell-vulnerabilities/

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.

#PHP #CyberSecurity #ZeroDay #Vulnerability #TechNews

https://dailytechnow.com/php-zero-day-rce-vulnerabilities/

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.

The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.

The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.

#cybersecurity #infosec #php

⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today

Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.

#php2shell #php #freexian

@JigmeDatse @benroyce @ehashman

CVE-2026-109618 and CVE-2026-109619.

https://en.wikipedia.org/wiki/PHP2Shell

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity

https://securityonline.info/cpanel-php-update-php2shell-wp-toolkit/?utm_source=mastodon&utm_medium=jetpack_social

Can we just stand still a second a acknowledge how well the #PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619) has been dealt with...

Good job #PHP Security Team !

QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.

#QNAP #PHP2Shell #QTS #CVE2026109618 #CVE2026109619 #NAS #RCE #CyberSecurity

https://securityonline.info/qnap-php2shell-vulnerabilities-qts/?utm_source=mastodon&utm_medium=jetpack_social

@yamuis : de eindeloos kwetsbare producten van Fortinet hebben ook weer patches nodig: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A813&page=0 (bron: https://www.security.nl/posting/958539/Fortinet+komt+vandaag+met+kritieke+updates%3A+%27Meteen+installeren%27).

Vreemd genoeg zag ik in die https://cisa.gov pagina (en pagina 2) de PHP kwetsbaarheden (CVE-2026-109618 en CVE-2026-109619) NIET genoemd worden.

Zouden de webinterfaces van Fortinet spullenboel niet op PHP bouwen, of wacht Fortinet met de PHP-patches tot een later moment?

@bert_hubert @bo

#PHP #Fortinet #CVE #Vulnerabilities

PHP2Shell : les correctifs de sécurité sont là, les attaques aussi ! https://www.it-connect.fr/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.

All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk.

Affected: 8.5.x < 8.5.12; 8.4.x < 8.4.27; 8.3.x < 8.3.36; 8.2.x < 8.2.35; 8.1 and older.

⚠️ PoCs circulate. Patch now; if unable, isolate internet-facing apps until fixed!

See: https://cert.europa.eu/publications/security-advisories/2026-018/

#security #hacking #foss #opensource #web #programming #coding

PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline

PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution in PHP.

🔗️ [Thecyberexpress] https://link.is.it/IScNPR

Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026

https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/

#synoforum #synology #NAS

Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.

You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619

@indonesia

#cybersecurity #infosec #indonesia #indonesiaNews #php2shell

There are protections out there to help you buy time to patch all your systems for #php2shell

#Checkpoint #WAF and IPS both catch and prevent this attack

https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

PHP2Shell clears a major real-world barrier Researchers at VulnCheck say they developed the first known exploit for CVE-2026-109618 that achieves remote code execution on ASLR-enabled x86-64 systems running PHP 8.4.26 with the recommended production setting display_errors=off. The chain uses a confirmed memory leak to bypass ASLR, a key mitigation that had limited practical exploitation.

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Ihr seid doch sicher alle brennend daran interessiert, im Detail zu verstehen, worin die beiden PHP-Sicherheitslücken bestanden, die es bis ganz oben in die Medien geschafft haben, und weswegen nun alle Menschen schon mal was von PHP gehört haben, auch wenn es nichts Gutes war (aber sie haben davon gehört). Gar nicht so schlecht erklärt das dieser Artikel (englisch):
https://m.academy/articles/php2shell-php-vulnerability-cve-2026-109618-explained/

Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected

https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

RT: @MalwareTechBlog I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

@GossiTheDog

For anyone else looking for PaloAlto's notice, it's here:
https://security.paloaltonetworks.com/CVE-2026-109618

I'm waiting for it to say something other than ETA: TBD

Had a hard time finding it initially because google wants to send you to their unit42 writeup that covers their take on them protecting you from everyone else instead.

#PaloAlto #php2shell

Php2shell Needs a Shell

글은 PHP 엔진의 인증 불필요 RCE 취약점(CVE-2026-109618, CVE-2026-109619·CVSS 9.2)이 PHP-FPM 등 모든 SAPI에서 웹서버 권한의 코드 실행으로 이어질 수 있으며, 패치가 최우선이라고 강조한다. 동시에 FreeBSD jail에 PHP-FPM을 최소 구성으로 격리하고 IP 주소·DNS·외부 네트워크·셸·범용 인터프리터·쓰기 가능한 파일시스템을 제거하면, 초기 RCE 뒤의 리버스 셸·페이로드 다운로드·웹셸 지속성 확보를 크게 제한할 수 있다고 주장한다. Caddy, nginx, PHP-FPM, PostgreSQL을 별도 jail로 분리하고 필요한 Unix 소켓만 마운트하는 토폴로지는 AI 서비스의 PHP...

https://vivianvoss.net/blog/php2shell-needs-a-shell

New Exploit Bypasses ASLR to Target PHP2Shell Vulnerability

Security experts at VulnCheck have crafted a potent exploit that targets a critical PHP bug, CVE-2026-109618, which can lead to remote code execution and is part of the PHP2Shell vulnerability pair. This innovative technique can bypass tough production defenses, including Address Space Layout Randomization (ASLR), to wreak havoc on x86-64 servers.

https://osintsights.com/new-exploit-bypasses-aslr-to-target-php2shell-vulnerability?utm_source=mastodon&utm_medium=social

#Php2shell #Cve2026109618 #Rce #AslrBypass #ExploitDevelopment

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

PHP2Shell clears a major real-world barrier Researchers at VulnCheck say they developed the first known exploit for CVE-2026-109618 that achieves remote code execution on ASLR-enabled x86-64 systems running PHP 8.4.26 with the recommended production setting display_errors=off. The chain uses a confirmed memory leak to bypass ASLR, a key mitigation that had limited practical exploitation.

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Ihr seid doch sicher alle brennend daran interessiert, im Detail zu verstehen, worin die beiden PHP-Sicherheitslücken bestanden, die es bis ganz oben in die Medien geschafft haben, und weswegen nun alle Menschen schon mal was von PHP gehört haben, auch wenn es nichts Gutes war (aber sie haben davon gehört). Gar nicht so schlecht erklärt das dieser Artikel (englisch):
https://m.academy/articles/php2shell-php-vulnerability-cve-2026-109618-explained/

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

@GossiTheDog

For anyone else looking for PaloAlto's notice, it's here:
https://security.paloaltonetworks.com/CVE-2026-109618

I'm waiting for it to say something other than ETA: TBD

Had a hard time finding it initially because google wants to send you to their unit42 writeup that covers their take on them protecting you from everyone else instead.

#PaloAlto #php2shell

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

@NetworkManager
I'm changing my wifi password to CVE-2026-109618

I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.

Which is good of them. But I thought I'd "purged my account data"?

Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.

We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.

Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/

#PHP #InfoSec #CVE #Security #Email #php2shell

Why it’s important to have well-funded programs for open source infrastructure: “In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the @sovtechfund to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618.”

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

CW: technikai sérülékenység

PHP-hez kritikus javítások érkeztek: CVE-2026-109618 és CVE-2026-109619 (CVSS 9.2). PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 kiadva. Jelentették a kihasználási kísérleteket és átmeneti szolgáltatás-leállásokat; régi, nem karbantartott PHP-telepítések különösen veszélyben. Frissítés és disztribúciós/backport csatornák ellenőrzése szükséges. https://linuxmint.hu/hir/2026/10/a-php2shell-javitasok-megerkeztek-de-a-leallasok-es-a-kihasznalasi-kiserletek-miatt-meg #PHP #CVE-2026-109618 #CVE-2026-109619 #infosec #OpenSource

My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker

CW: sérülékenység (CVE-2026-109618, CVE-2026-109619)

A PHP Foundation közleménye: a CVE-2026-109618-re már 2024-ben voltak jelek, de érdemi javítás csak MI-alapú kódelemzések után indult meg. Javítások csak PHP 8.2+ verziókhoz érhetők; sok telepítés EOL marad. Részletek: https://linuxmint.hu/hir/2026/10/php-mar-2024-ben-felfedeztek-a-kritikus-serulekenyseg-jeleit-de-csak-az-mi-alapu

#PHP #CVE #Infosec #OpenSource

CW: kritikus sérülékenységek

NBSZ NKI riaszt: két PHP-hiba (CVE-2026-109618, CVE-2026-109619) CVSS v4.0: 9.2. Javítások közzététele: 2026-10-21 14:00 UTC. Hiba: hitelesítés nélkül, távolról tetszőleges kód futtatható lehet. Frissítés azonnal, vagy érintett rendszerek izolálása/kiiktatása javasolt.

#PHP #CVE #kiberbiztonság #OpenSource

https://linuxmint.hu/hir/2026/10/riasztas-a-php-futtatokornyezet-kritikus-serulekenysegeirol

PHP2Shell: strumenti per verificare l’esposizione alle vulnerabilità critiche

A seguito della segnalazione delle vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il CERT-AGID segnala la disponibilità di due strumenti...

🔗️ [Cert-agid] https://link.is.it/0SzNoZ

Yunohost // ☢ [CVE-2026-109618/109619] Critical vulnerability in PHP, upgrade system package ASAP!

https://pie.dasneuland.de/c/selfhosted@lemmy.world/p/98319/yunohost-cve-2026-109618-109619-critical-vulnerability-in-php-upgrade-system-packag

@SecureOwl One of my vendors (Report-uri.com) sent a proactive note to say they'd handled it.

https://blog.report-uri.com/responding-to-php2shell-cve-2026-109618-and-cve-2026-109619/

Red Alert in the Web World: Understanding the “PHP2Shell” Vulnerabilities

https://cltcccybersecurity.wordpress.com/2026/10/22/red-alert-in-the-web-world-understanding-the-php2shell-vulnerabilities/

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.

#PHP #CyberSecurity #ZeroDay #Vulnerability #TechNews

https://dailytechnow.com/php-zero-day-rce-vulnerabilities/

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.

The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.

The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.

#cybersecurity #infosec #php

⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today

Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.

#php2shell #php #freexian

@JigmeDatse @benroyce @ehashman

CVE-2026-109618 and CVE-2026-109619.

https://en.wikipedia.org/wiki/PHP2Shell

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity

https://securityonline.info/cpanel-php-update-php2shell-wp-toolkit/?utm_source=mastodon&utm_medium=jetpack_social

Can we just stand still a second a acknowledge how well the #PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619) has been dealt with...

Good job #PHP Security Team !

@linuxundich Für ältere Versionen kann man sich Patches von Ondřej holen: https://ma.ttias.be/php-cve-2026-109618-patch/#notes

QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.

#QNAP #PHP2Shell #QTS #CVE2026109618 #CVE2026109619 #NAS #RCE #CyberSecurity

https://securityonline.info/qnap-php2shell-vulnerabilities-qts/?utm_source=mastodon&utm_medium=jetpack_social

@yamuis : de eindeloos kwetsbare producten van Fortinet hebben ook weer patches nodig: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A813&page=0 (bron: https://www.security.nl/posting/958539/Fortinet+komt+vandaag+met+kritieke+updates%3A+%27Meteen+installeren%27).

Vreemd genoeg zag ik in die https://cisa.gov pagina (en pagina 2) de PHP kwetsbaarheden (CVE-2026-109618 en CVE-2026-109619) NIET genoemd worden.

Zouden de webinterfaces van Fortinet spullenboel niet op PHP bouwen, of wacht Fortinet met de PHP-patches tot een later moment?

@bert_hubert @bo

#PHP #Fortinet #CVE #Vulnerabilities

PHP2Shell : les correctifs de sécurité sont là, les attaques aussi ! https://www.it-connect.fr/php2shell-correctifs-urgence-cve-2026-109618-cve-2026-109619/ #ActuCybersécurité #Vulnérabilités #Cybersécurité #PHP

PHP reported two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.

All PHP-powered websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) are at risk.

Affected: 8.5.x < 8.5.12; 8.4.x < 8.4.27; 8.3.x < 8.3.36; 8.2.x < 8.2.35; 8.1 and older.

⚠️ PoCs circulate. Patch now; if unable, isolate internet-facing apps until fixed!

See: https://cert.europa.eu/publications/security-advisories/2026-018/

#security #hacking #foss #opensource #web #programming #coding

PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline

PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution in PHP.

🔗️ [Thecyberexpress] https://link.is.it/IScNPR

Workaround for 2 critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), disclosed on October 21, 2026

https://www.synoforum.com/threads/workaround-for-2-critical-vulnerabilities-in-the-php-engine-cve-2026-109618-and-cve-2026-109619-php2shell-disclosed-on-october-21-2026.16429/

#synoforum #synology #NAS

Id-SIRTII/CC just released (an hour ago) a security advisory regarding php2shell.

You can access the details here:
https://idsirtii.bssn.go.id/publications/advisories/security-advisory-kerentanan-pada-php2shell-cve-2026-109618-cve-2026-109619

@indonesia

#cybersecurity #infosec #indonesia #indonesiaNews #php2shell

PHP2Shell in OT-Anlagen: warum die Lücke Jahre bleibt

PHP2Shell (CVE-2026-109618/-109619) wird breit angegriffen. Max Gilg erklärt, welche OT-Geräte PHP nutzen und was Betreiber jetzt tun sollten.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/php2shell-in-ot-anlagen-warum-die-luecke-jahre-bleibt.html

There are protections out there to help you buy time to patch all your systems for #php2shell

#Checkpoint #WAF and IPS both catch and prevent this attack

https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #ExploitedInTheWild #PoC #CyberSecurity

https://securityonline.info/php2shell-exploited-poc-public/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More
https://isc.sans.edu/podcastdetail/10146

@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?

Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com

Critical CVE vulnerabilities were announced yesterday for PHP (CVE-2026-109618 and CVE-2026-109619). We have promptly responded to that and all servers in the #TDE infrastructure have already been updated.

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
https://news.ycombinator.com/item?id=50187708

#hackernews #tech

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Link: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Discussion: https://news.ycombinator.com/item?id=50187708

Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Stay informed about PHP security vulnerabilities that could impact your server's integrity. Update your PHP version immediately.

🔗️ [Sucuri] https://link.is.it/RnlGmU

Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.

Local-only exploit tester.

So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.

https://github.com/slabbdev/php2shell-cve-2026-109618-109619

…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting #CVE

【PHP脆弱性php2shell】WordPressも対象、パッチは21:59に公開済み。「23:15から乗っ取り」「15分でAIが攻撃コード？」は本当か、自分のVPSのログで検証（CVE-2026-109618／109619）：秋山大志のそれとりあえず作ってみようか。：オルタナティブ・ブログ: https://blogs.itmedia.co.jp/agile/2026/10/php2shell_cve_2026_109618_panic.html

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

#aws #security

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 firmware (<1.30) hit by CVE-2026-107861: CRITICAL command injection (CWE-78). Authenticated users can execute OS commands as root — full device compromise possible. Patch unavailable. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-107861-cwe-78-in-kiloview-e3-firmware-23f97073d04a678f #OffSeq #Infosec #Vuln

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 firmware (<1.30) hit by CVE-2026-107861: CRITICAL command injection (CWE-78). Authenticated users can execute OS commands as root — full device compromise possible. Patch unavailable. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-107861-cwe-78-in-kiloview-e3-firmware-23f97073d04a678f #OffSeq #Infosec #Vuln

Security Advisory: CVE-2025-71438 - Out-of-Bounds Read in GPAC/MP4Box

Processing a crafted AC-4 stream with an invalid `frame_rate_index` triggers an out-of-bounds read in `gf_odf_ac4_cfg_dsi_v1`, causing MP4Box to crash.

Summary:
The `gf_odf_ac4_cfg_dsi_v1` function in `odf/descriptors.c` uses a stream-supplied `frame_rate_index` to index into fixed-size lookup tables (`AC4_SAMPLE_DELTA_TABLE_48`, `AC4_MEDIA_TIMESCALE_48`). The function does not validate that the index is within bounds before performing the table lookup. A crafted AC-4 file carrying an out-of-range index (e.g., 15) causes an out-of-bounds read, ultimately resulting in a NULL dereference and process crash.

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
odf/descriptors.c:2179
Function: gf_odf_ac4_cfg_dsi_v1()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1617-g856674b22-master; commit `856674b226d6cbe28a941ad223be38194cbf7d37`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a specially crafted AC-4 stream file containing an invalid `frame_rate_index` value. Local access is required; the victim must invoke `MP4Box -dash 100 <crafted_file>` or any equivalent DASH segmentation command that triggers the AC-4 configuration descriptor parsing path.

Impact:
The out-of-bounds read leads to an immediate process crash (SEGV READ at address 0x000000000000), resulting in Denial of Service. No evidence of arbitrary code execution was observed.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
13eb5b76560aaf7813b865a2ad433258478e2695
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3303
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2179
- Fix: https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

I am tired boss

https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

#Security

Node2Shell: Node.js Brotli vulnerability allows remote code execution

Node.js의 Brotli 디코더에 범위를 벗어난 쓰기(out-of-bounds write)가 가능한 고위험 취약점 CVE-2026-111497(Node2Shell)이 공개됐다. 공격자가 제어하는 Brotli 입력을 처리하면 프로세스 크래시, 메모리 유출, 잠재적 원격 코드 실행으로 이어질 수 있으며, Express 5/body-parser 2.x의 Brotli 요청 본문 처리, 외부 서버 응답을 자동 해제하는 fetch(), node:zlib 직접 사용 경로가 주요 노출면이다. Node.js 22.23.4, 24.22.1,...

https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

@lonaasan https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

RT: @julianor Reproduced the Brotli memory corruption bug (CVE-2026-111497) using a simple Node.js + Express app.

Patched and unpatched versions produce different decompressed output, making it possible to remotely identify vulnerable servers.

Well, now that's PHP is patched (right?) it's time to notice the other issue from yesterday: RCE in NodeJS https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

NOT NOW, GITLAB AND NODEJS.

CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler => RCE
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits RCE
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

YOOtheme Pro for Joomla (5.0.0-5.0.52) hit by CRITICAL RCE (CVE-2026-102785, CVSS 10). Unauthenticated attackers can upload malicious files via flawed image handler. Restrict access & monitor uploads. https://radar.offseq.com/threat/cve-2026-102785-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-yoothemecom-yootheme-pro-80652f2207427131 #OffSeq #Joomla #CVE2026_102785 #infosec

A public PoC is out for CVE-2026-114509, a Laravel authentication bypass in TokenGuard enabling account takeover. Upgrade to 12.68.0 or 13.29.0.

#Laravel #TokenGuard #CVE2026114509 #AuthBypass #PoC #PHP #WebSecurity #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-cve-2026-114509-poc/?utm_source=mastodon&utm_medium=jetpack_social

A public PoC is out for CVE-2026-114509, a Laravel authentication bypass in TokenGuard enabling account takeover. Upgrade to 12.68.0 or 13.29.0.

#Laravel #TokenGuard #CVE2026114509 #AuthBypass #PoC #PHP #WebSecurity #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-cve-2026-114509-poc/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-114509: Laravel TokenGuard auth bypass (CRITICAL, CVSS 9.2) impacts <12.68.0 & 13.0.0 – 13.29.0. Exploit allows account takeover via crafted credentials. Upgrade to 12.68.0/13.29.0+ now! https://radar.offseq.com/threat/cve-2026-114509-cwe-287-improper-authentication-in-laravel-framework-e0bd04cb5db6dac1 #OffSeq #Laravel #Infosec #CVE2026114509

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-114727-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-roundcube-webmail-0e067a7fe4b46d68 #OffSeq #Vulnerability #Infosec #Roundcube

CVE-2026-114730: SSRF in Roundcube Webmail (HIGH, CVSS 7.2) affects 1.6.14-1.6.19 & 1.7.0-1.7.4. NAT64 filter bypass allows internal requests. Update to 1.6.20/1.7.5 now. https://radar.offseq.com/threat/cve-2026-114730-cwe-918-server-side-request-forgery-ssrf-in-roundcube-webmail-151b1341ca143178 #OffSeq #Security #Roundcube #SSRF

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Splunk fixes 31 Splunk vulnerabilities in Enterprise and Splunk SOAR, including CVSS 9.9 flaws CVE-2026-76531, CVE-2026-76299 and CVE-2026-76302.

#Splunk #SplunkSOAR #CVE202676531 #CVE202676299 #CVE202676302 #SIEM #PatchNow #CyberSecurity

https://securityonline.info/splunk-vulnerabilities-enterprise-soar-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-112832 (CRITICAL, CVSS 9.8) in CozyThemes Rootblox <1.0.7 allows unauthenticated remote LFI via improper filename control in PHP. Full system compromise possible. Restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-112832-improper-control-of-filename-for-includerequire-statement-in-php-program-php-remote-3c455496d4cdf128 #OffSeq #infosec #PHP #LFI

CVE-2026-112241: Brainstorm Force SureCart (v0 – 4.9.5) has a CRITICAL authentication bypass by spoofing vulnerability 🛡️. No mitigation yet — review deployments and monitor for patches. https://radar.offseq.com/threat/cve-2026-112241-authentication-bypass-by-spoofing-in-brainstorm-force-surecart-8a4aa24fc63753f3 #OffSeq #CVE2026_112241 #infosec #WordPress

TOTOLINK A950RG 4.1.2cu.5268_B20221104 faces CRITICAL CVE-2026-114575 (CVSS 10) — remote command injection via UploadCustomModule. Exploit is public. Patch or isolate devices. https://radar.offseq.com/threat/cve-2026-114575-command-injection-in-totolink-a950rg-4953ac46344cdab5 #OffSeq #CVE #IoTSecurity #RouterSecurity

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

NT OneAPP (≤1.5.22) by NewType Infortech has a CRITICAL hard-coded credentials flaw (CVE-2026-114219, CVSS 9.1). Attackers can decrypt login data & access user creds. No patch yet — restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-114219-cwe-798-use-of-hard-coded-credentials-in-newtype-infortech-nt-oneapp-d8766d50ef7b2f82 #OffSeq #CVE #infosec #vulnerability

CRITICAL vuln (CVE-2026-114220) in NT OneAPP ≤1.5.22: improper certificate validation lets network-adjacent attackers run MITM attacks, risking data exposure. Patch status unknown. Details: https://radar.offseq.com/threat/cve-2026-114220-cwe-295-improper-certificate-validation-in-newtype-infortech-nt-oneapp-9989fe91f72af746 #OffSeq #infosec #mitm #CVE2026114220

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Cisco's security hardening release fixes Cisco Unified CM vulnerabilities, including CVSS 9.8 flaws CVE-2026-76473 and CVE-2026-76474.

#Cisco #UnifiedCM #CVE202676473 #CVE202676474 #CVE202676487 #SecurityHardening #VoIP #CyberSecurity

https://securityonline.info/cisco-unified-cm-vulnerabilities-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

Update the Duplicator WordPress plugin to 5.0.0 to fix CVE-2026-82814, a high-severity PHP Object Injection flaw risking RCE and site takeover.

#WordPress #Duplicator #PHPObjectInjection #Wordfence #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/duplicator-wordpress-plugin-php-object-injection/?utm_source=mastodon&utm_medium=jetpack_social

“Siemens on Oct. 19 disclosed that attackers exploited a flaw in its Software Center product by spreading malware via a ClickFix attack.

The flaw — CVE-2026-110936 — loads dynamic-link libraries (DLLs) from an uncontrolled search path into the affected application.”

https://www.scworld.com/news/siemens-software-center-flaw-exploited-in-clickfix-dll-sideloading-attack

RingRTC (Signal): Flooded Call Event Queue Blocks Local Hang-Up

RingRTC 2.72.0 이전 버전에서 원격 통화 상대가 FSM 이벤트 큐를 과도하게 채우면, 사용자의 로컬 종료(hang-up) 이벤트가 처리되지 않아 오디오와 경우에 따라 비디오 트랙이 계속 유지될 수 있다는 CVE-2026-113380이 보고됐다. 원인은 신뢰할 수 없는 피어 이벤트와 종료 같은 중요 제어 이벤트가 동일한 FIFO 큐를 공유하고, 피어 이벤트에 대한 속도 제한이나 종료 이벤트 우선순위가 없었던 점이다. Signal Android·iOS·Desktop 등 이전 RingRTC를 포함한 클라이언트는 RingRTC 2.72.0...

https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380

Details and a PoC are public for CVE-2026-113380, a Signal call vulnerability in RingRTC that keeps calls live after hang-up. Update now.

#Signal #RingRTC #CVE2026113380 #Privacy #PoC #MobileSecurity #Eavesdropping #CyberSecurity

https://securityonline.info/signal-call-vulnerability-ringrtc-poc/?utm_source=mastodon&utm_medium=jetpack_social

Horizon3 released details and a PoC for CVE-2026-106173, a FortiSIEM vulnerability enabling unauthenticated remote code execution. Patch now.

#FortiSIEM #Fortinet #CVE2026106173 #RCE #PoC #Horizon3 #SIEM #CyberSecurity

https://securityonline.info/fortisiem-vulnerability-cve-2026-106173-poc/?utm_source=mastodon&utm_medium=jetpack_social

Horizon3 released details and a PoC for CVE-2026-106173, a FortiSIEM vulnerability enabling unauthenticated remote code execution. Patch now.

#FortiSIEM #Fortinet #CVE2026106173 #RCE #PoC #Horizon3 #SIEM #CyberSecurity

https://securityonline.info/fortisiem-vulnerability-cve-2026-106173-poc/?utm_source=mastodon&utm_medium=jetpack_social

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-93479/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-93479/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

@badsamurai @christopherkunz No no, the sev:CRIT ../ in ColdFusion was last week. 🤪

https://nvd.nist.gov/vuln/detail/cve-2026-90530

GitLab security fixes are really next level.

19.4.2: CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler
Thanks joaxcar for reporting [...].

... **nine days** pass by ...

19.4.3: CVE-2026-110264 - Integer Overflow issue in Regular Expression Compiler
Thanks joaxcar for reporting [...].

Did they even bother to look further in fixing CVE-2026-97229? 🤔

And this is also wild for an RCE fix: "This patch includes database migrations that may impact your upgrade process."

@Laukidh psst:

pro fix CVE-2026-80521 --dry-run

🔄 CSAF advisory updated (version 2.0.0)

VDE-2026-094
CODESYS Gateway Client - Uncontrolled Memory Allocation
CVE-2026-76992

Changes: Updated remediation category - fixed SL runtimes are now available, updated summary - typo corrected, formal adaptions.

HTML: https://www.certvde.com/en/advisories/VDE-2026-094/
CSAF JSON: https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-11_vde-2026-094.json

#OT #Advisory

🔄 CSAF advisory updated (version 1.1.0)

VDE-2026-097
CODESYS Control Runtime - Improper Synchronization in Monitoring
CVE-2026-79625

Changes: Updated remediation category - fixed SL runtimes are now available, formal adaptions.

HTML: https://www.certvde.com/en/advisories/VDE-2026-097/
CSAF JSON: https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-12_vde-2026-097.json

#OT #Advisory

Taking 'execute logging' a bit too seriously – CVE-2026-88771

CERT-EU는 Citrix NetScaler의 사전 인증 RCE 취약점 CVE-2026-88771이 로그 인젝션과 안전하지 않은 셸 명령 보간을 통해 악용될 수 있음을 분석했다. 공격자는 HTTP User-Agent에 base64 인코딩된 Bash 페이로드를 남기고, 인증 로그에 조작된 `PPE missed too many heartbeats` 패턴을 기록해 `ns_monuploadd_err.pl` 실행 시 해당 로그 내용을 셸로 실행시키는 체인을 사용한다. 후속 페이로드는 `/etc/httpd.conf`에서 PHP...

https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

CVE-2026-89139: Temporal Worker Service lets any authenticated caller with a single-namespace write role run arbitrary commands via the subprocess compute provider. CVSS 9.9. No patch yet. Audit access and restrict writes. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-89139/

CVE-2026-94215 Keycloak Admin REST API flaw lets low-priv admins read/modify master realm client configs via a realm they control. CVSS 5.5, currently unpatched. Review access and patch as soon as a fix lands. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94215/

CVE-2026-15801: CRI-O checkpoint/restore flaw lets privileged users write to the host filesystem via unvalidated restore metadata. CVSS 8, no patch yet. Disable checkpoint/restore if you don't need it and watch for fixes. #CVE #infosec #Kubernetes https://www.valtersit.com/cve/CVE-2026-15801/

CVE-2026-94218 Keycloak auth bypass, CVSS 3.1: users can skip enforced 2FA via a session restart link. No patch yet, so review your auth flows and watch for updates. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94218/

CVE-2026-47321: CompressionFilter inflates incoming data with no size limit, so a high-ratio zip bomb can exhaust app memory (DoS). CVSS 7.5, no patch yet. Apply a size limit or restrict untrusted input now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-47321/

CVE-2026-94277 MISP stored XSS, CVSS 5.4. Galaxy editor perm users can inject script into the statistics page, hitting anyone who opens it. Patch under review, so limit galaxy editing rights for now. #CVE #infosec #MISP https://www.valtersit.com/cve/CVE-2026-94277/

CVE-2026-88857: Auth privileged RCE in OrdaSoft Joomla Gallery (<6.2.7) via unsanitised upload in saveWatermark(). CVSS 7.2, no known patch. Patch or disable now. #CVE #infosec #Joomla https://www.valtersit.com/cve/CVE-2026-88857/

Oracle fixed 98 MySQL vulnerabilities in October 2026, including CVSS 9.8 bugs CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl.

#MySQL #Oracle #CVE202515467 #CVE20269547 #DatabaseSecurity

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

@lienrag @mgorny Normally, when you use pip to install packages, it installs the latest versions that satisfies “the given constraints”. These certainly include constraints given on the command line; whether this also includes dependency metadata of packages already installed inside the venv in use, I'm not sure (would have to check).

Anyway, there are circumstances in which developers want to have an easy way to install a set of packages with clearly defined versions (to have things reproducible, especially when the venv creation is automated). This is what lock files do: they record the versions of the packages you want to “pin” (normally, compatible versions!). Of course, you need to update the lock file when there is a security update for one of the locked packages, or it will be blocked...

The link given earlier by @mgorny is full of expert advice. If you don't want to micro-manage your venvs, I believe the following should be safe:

1. Make sure your distro has patched everything related to these problems (in particular, that the distro-shipped pip doesn't use the compromised CA certificates).

2. Delete your existing venvs (I assume they contain no interesting data, only installed packages).

3. Recreate them in a way that does not force vulnerable versions to be installed: should be fine unless you use lock files or otherwise hardcode version requirements.

For me, the hardest part was 1: for instance, one can see in the pip ChangeLog that upstream pip ugraded its bundled certifi package, however the ChangeLog entry does not mention any CVE, therefore checking whether my distro-provided pip is safe was difficult, until the very recent 26.2.2+dfsg-1 changelog.Debian.gz entry for python3-pip clarified things:

python-pip (26.2.2+dfsg-1) unstable; urgency=high

  * New upstream release.
    - Note that while this version contains a critical certifi security update
      upstream, for Debian this is completely delegated to ca-certificates.
    - CVE-2026-13346: Correctly handle handle doubly-encoded package URLs
      (Closes: #1143072)
  * Refresh patches.
  * Update copyright.

 -- Stefano Rivera <ste...an.org>  Wed, 21 Oct 2026 16:04:45 +0200

(this just reached unstable a few minutes ago).

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-13125: wenn man die Redaktion mit einem Keks besticht dann lassen sie dich auf dem Account posten was man will. CVSS von 6,7.

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

A PAN-OS GlobalProtect vulnerability, CVE-2026-0257, lets Qilin and Inc ransomware bypass VPN login and reach internal networks.

#PANOS #GlobalProtect #CVE20260257 #Qilin #IncRansomware #PaloAltoNetworks #Unit42 #Ransomware

https://meterpreter.org/pan-os-globalprotect-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

#Hosteurope hat sich mittlerweile geäußert. Merkwürdigerweise benutzen sie noch #PHP version 8.1. Auf die Version wird in den FAQ nicht explizit hingewiesen.

#php2shell

https://www.hosteurope.de/faq/server/server-allgemeines/php-issue-cve-2026-10961x

@linuxundich Für ältere Versionen kann man sich Patches von Ondřej holen: https://ma.ttias.be/php-cve-2026-109618-patch/#notes

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the...

🔗️ [Securelist] https://link.is.it/9Ayk39

@mdhughes There was a pretty major Gopher CVE back in the day though: https://nvd.nist.gov/vuln/detail/cve-2002-0371

But yeah, anything static and JavaScript-free or PHP-free will do these days.

@mdhughes There was a pretty major Gopher CVE back in the day though: https://nvd.nist.gov/vuln/detail/cve-2002-0371

But yeah, anything static and JavaScript-free or PHP-free will do these days.

🐧 SIGINT // Ubuntu Watch — 2026-10-23

Kernel ipv4 checksum validation bug lets malformed packets bypass checksum_start checks before completing checksum calc. Worth patching kernels promptly on any box facing untrusted networks or NAT.ed traffic.

🔗 https://ubuntu.com/security/CVE-2026-99999

#Ubuntu #Linux #infosec

@syn @sara_objectionable The internet was turned off on October 15th but we're living in hell: https://nvd.nist.gov/vuln/detail/cve-2026-99999

NO MORE CVEs THIS YEAR
NO USE FOUND FOR GOING BEYOND CVE-2026-99999
LET'S ALL STOP LOOKING

CVE-2026-111943: Compromised Intermediate Certificate Authority
https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority
https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority
https://news.ycombinator.com/item?id=50192900

#hackernews #tech

CVE-2026-111943: Compromised Intermediate Certificate Authority

Link: https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority

Link: https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority
Link: https://nvd.nist.gov/vuln/detail/cve-2026-111943
Comments: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority

Link: https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority

https://nvd.nist.gov/vuln/detail/cve-2026-111943

#gov

Ah, the classic tale of #technology "protecting" us by slamming the door in our faces. 🤦‍♂️ Apparently, even certificates need a security blanket these days! 🛡️ Meanwhile, Cloudflare's blocking prowess is unmatched—just try accessing nist.gov. 😂
https://nvd.nist.gov/vuln/detail/cve-2026-111943 #humor #cybersecurity #Cloudflare #nistgov #accessissues #HackerNews #ngated

CVE-2026-111943: Compromised Intermediate Certificate Authority

https://nvd.nist.gov/vuln/detail/cve-2026-111943

Comments: https://news.ycombinator.com/item?id=50192900

#HackerNews #CVE2026111943 #CompromisedCertificateAuthority #Cybersecurity #Vulnerability #NIST #SecurityNews

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution

PoC: https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.

#cPanel #PHP2Shell #WPToolkit #CVE2026109618 #CVE2026109619 #CVE2026107663 #WebHosting #CyberSecurity

https://securityonline.info/cpanel-php-update-php2shell-wp-toolkit/?utm_source=mastodon&utm_medium=jetpack_social