Oh man, light a candle for #infosec, #sysop, and #ops, cause if you thought the #php #cve was fun, wait till you hear about CVE-2026-111497, AKA as Node2Shell, HTTP2Shell, and Broccoli2Shell, a high-severity out-of-bounds write vulnerability in the Brotli decoder that can permit remote code execution (#RCE). The bug allows data to overwrite memory buffers when a process decompresses untrusted Brotli streams. It was surfaced by #OpenAI’s red team.

Fixed versions were released this weekend, but systems using system-linked Brotli libraries (e.g., Debian, Alpine) must verify their distribution-specific package updates, as the Node.js binary release does not patch those external dependencies.

While researchers from Imperva demonstrated successful code execution on a specific Node.js 24.22.0 Linux arm64 build, no widespread exploitation in the wild has been reported as of October 25, 2026..

https://nvd.nist.gov/vuln/detail/cve-2026-111497

Wach auf, Honig.
Neue kritische Sicherheitslücke just dropped.
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Alright, off I go to disable brotli compression in Apache out of an abundance of caution.

Blessed are those that don't manage a server on the internet.

https://nvd.nist.gov/vuln/detail/cve-2026-111497

Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497) - Affecting Node.js, Python, C library

https://nord.pub/c/technology@lemmy.world/p/497144/broccoli2shell-the-brotli-decoder-bug-cve-2026-111497-affecting-node-js-python-c-library

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

OpenAI has disclosed that red-teaming agents testing its research environments achieved virtual machine escapes and communicated between separate sandboxes through a processor cache timing side-channel, and that the campaign also uncovered the critical Brotli flaw CVE-2026-111497, The Hacker News reports. The company said it will conduct frontier model training with no live internet access, and that it resumed frontier training and internal inference on October 1 after strengthening its containment architecture. https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html

The shit just keeps on coming 😬

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

@offby1 this might be a duplicate, but maybe not?
https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/

@jschauma For Debian sid/unstable, there is a patched package in the Bug Tracking System by Salvatore Bonaccorso who is part of the Debian security team; his changes are also in the salsa Git repo).

The bug log seems to indicate that the Debian maintainer doesn't consider there is any hurry for sid. So I downloaded the source package, visually inspected the patch, applied it, verified that the two modified source files were now identical to those from upstream commit b418fa81c48262a86a9 which is referenced at the bottom of the Debian security tracker page for CVE-2026-111497, built the source package and upgraded the relevant binary packages.

To be on the safe side, I also uninstalled libio-compress-brotli-perl which is built from a different source package, although that one is quite possibly not affected by the bug (the package was only recommended by other packages I have installed, not depended on).

👉 For everyone who started #Node2Shell triage over the weekend, we see you and your huge effort! If you need a hand, we just added detection for CVE-2026-111497 to our Network Scanner, in every paid plan. ( ⏭️ Free trial link below.)

The scan tests if your endpoint decodes Brotli with a vulnerable decoder, so you see reachability (not a version guess). Once it completes, you get a PDF report with: 👇

✅ the finding and the request and response behind it

✅ the fixed release for Node.js, Bun, or Envoy

✅ the CVSS score and severity rating

✅ remediation steps you can hand to whoever owns the fix

❗One thing to check before you call it patched: the runtime hides in more places than your package.json shows. Container base images, Envoy and Istio sidecars, and Python services that use the Brotli or brotlicffi packages all carry their own copy of the decoder.

Need to check every service, rescan after each patch, or document findings for compliance? Start Node2Shell detection with the Network Scanner with a free trial. ⬇️ ⬇️ ⬇️

#Node2Shell details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896

Free Pentest-Tools.com trial: https://app.pentest-tools.com/trial/signup

#offensivesecurity #pentesting #vulnerabilitymanagement #ethicalhacking #cybersecurity

Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
https://broccoli2shell.com/

CVE-2026-111497-POC

example

#Nodejs released #fixes for ten #vulnerabilities, including CVE-2026-111497 in the Brotli decoder enabling remote code execution or disruption. Updates for versions 26.x, 24.x and 22.x are urged; end-of-life versions remain exposed. https://cybernews.com/security/php-node-js-vulnerabilities-patch-exploit/?eicker.news #tech #news #ainews

The Brotli CVE-2026-111497 vulnerability enables unauthenticated remote code execution across Node.js, Bun, Python, Envoy, and Istio cloud infrastructure.

#Brotli #CVE2026111497 #Node2Shell #Cybersecurity #AppSec

https://meterpreter.org/brotli-cve-2026-111497-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

From the .NET blog...

In case you missed it earlier...

.NET October 2026 Out-of-Band Security Updates
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/ #dotnet #MaintenanceUpdates #Security #NET10 #NET11 #NET8 #NET9 #CVE2026111497 #CVE2026114148 #OOB

From the .NET blog...

.NET October 2026 Out-of-Band Security Updates
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/ #dotnet #MaintenanceUpdates #Security #NET10 #NET11 #NET8 #NET9 #CVE2026111497 #CVE2026114148 #OOB

Microsoft's out-of-band .NET security update fixes Brotli flaw CVE-2026-111497 and Linux tarball bug CVE-2026-114148. Update to 8.0.33 or 9.0.22.

#DotNET #Microsoft #Brotli #CVE2026111497 #CVE2026114148 #CVE202670197 #ASPNETCore #CyberSecurity

https://securityonline.info/dotnet-security-update-brotli-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

"Black October 2026" marks critical cybersecurity events, including the AI-assisted discovery of PHP2Shell vulnerabilities (CVE-2026-109618/109619) leading to global government website shutdowns and emergency patching (Oct 21). Oracle Health also reported a breach impacting 20M patients. Geopolitically, the US reduced embassy staff in four Middle Eastern nations (Jordan, Lebanon, Qatar, UAE) amid escalating threats (Oct 24).
#AnonNews_irc #Cybersecurity #News

3 real PHP2Shell RCE demos with reverse-shell:

• phpMyAdmin 5.2.2 / PHP 8.4.26 (both CVEs)
https://youtu.be/dNtQxA8WSxY

• WordPress 7.1.2 / PHP 8.3.35 (both CVEs)
https://youtu.be/ln0rwy_Arjc

• PHP 8.5.4 exact lab (CVE-2026-109618)
https://youtu.be/4fdF4740Ewg

Currently building PHPCANNON. Some apps are easier to pwn than others. Got about 30-40 working exploits so far.

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

This is my shocked face.

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…

Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…

https://nexus8.8bitsecurity.com/entity/signal_event-12861123

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

The memory limit was supposed to stop the request. It became the exploit

PHP2Shell, as a vulnerability, an impact, a public technical chain, and a patch that is not finished until the worker restarts.

26 October 2026 · Defensive reading of Calif, Wiz, and OpenAI · Not an exploit write-up

PHP has treated memory_limit as a safety rail for two decades. Hit the ceiling, abort the request, move on. For PHP2Shell, that story is backwards.

The fatal is not the recovery. The fatal is the primitive. A safety check fires while the engine has already published request state and has not committed it. Teardown trusts the publish step. On the SAPIs that keep the worker, the next request trusts the leftovers.

That is the whole post. The rest is the vulnerability, what it costs, what the public research actually demonstrated, and what “patched” means in a process that is already running.

The vulnerability

PHP2Shell is two bugs in the PHP engine, not in an application.

Both are reached while PHP is still parsing the request. No login. No bug in WordPress, Drupal, Laravel, or the one-file script you deployed last year. The guest application has not started.

The affected range runs from PHP 5.4 through the unpatched 8.x releases. Web SAPIs are in scope: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. The PHP project and the researchers agree the practical risk is highest on mod_php, because that worker shuts the failed request down and then stays alive.

Two engine rules make it possible.

Publish before commit. Some paths mark a structure as live, then do the allocation that fills it in. If the second step fatals, teardown still believes the first step.

Abort is not rollback. memory_limit is a non-local exit (zend_bailout), not an unwind of every mutation that already happened. Shutdown walks whatever the counters say is live.

This shape is old. In 2004 Stefan Esser showed that a memory-limit fatal could interrupt PHP where interruption was unsafe. A 2020 report, PHP bug #78876, and a 2024 audit both touched the out-of-memory behavior. Exploitation was not proven, so it stayed a cleanup glitch. Calif, in OpenAI’s Patch the Planet work, and Wiz, independently, showed the chain holds under default settings. Frontier models cut the cost of a chain that had sat near the edge of manual research for years. That is a claim about discovery cost. It is not a claim that every host falls over on the first packet.

The impact

Successful use is unauthenticated remote code execution as the PHP worker, or a read of that worker’s memory. Wiz describes the second outcome as Heartbleed-shaped: passwords, tokens, and keys that belong to other requests, because the worker is shared. Its heap is not a per-customer enclave.

Calif reports pre-auth confirmation on the builds they tested:

• WordPress, Drupal, Joomla, MediaWiki
• Magento, Laravel, Symfony
• Roundcube, phpMyAdmin, Nextcloud, WHMCS
• some arbitrary scripts, not only full applications

Those are their results, on their builds. “Default config, before the script runs” is a claim to check in a lab you own. It is not a census of the internet.

What follows from the architecture, without inventing a victim count:

PHP 8.1 and older have no upstream release. Those hosts stay vulnerable until someone backports or the stack moves.

Patching the CMS does not move the bug. The interpreter fails first.

mod_php and PHP-FPM are not the same risk. A startup fatal that becomes the next request’s state on mod_php is often just a dead worker on FPM. FPM does not remove the post-startup path.

A leaked advisory beat the embargo. Scanning around 17–21 October 2026 shows interest. Interest is not proof that every probe achieved code execution. Reliable chains depend on SAPI, build, and whether session.upload_progress is enabled. That setting is a common default, not a universal one.

The public chain, as a technical write-up
This is a reading of Calif’s published mechanism. It is not a reproduction, and it is not a procedure you should run against anything you do not own.

Calif’s analysis is about request startup.

PHP registers $_POST and $_FILES inside php_request_startup(), before the target file runs. Nested form names become HashTables. An empty RFC1867 upload part (filename=””) still creates the six $_FILES slots, and a deeply nested name makes PHP build that tree for each slot. The body can stay modest while the allocator works hard. That is how a request reaches memory_limit without first dying on post_max_size. Chunked HTTP/1.1 or HTTP/2 widens the gap: declared length and parsed bytes are not the same check.

The line that matters is the order inside _zend_hash_str_add_or_update_i:

C

 idx = ht->nNumUsed++;  ht->nNumOfElements++;   p = ht->arData + idx;  p->key = zend_string_init(str, len, persistent); /* may zend_bailout() */ 

The live count moves first. The key allocation can bail out. Teardown walks nNumUsed and treats the slot as a real bucket. The key was never written. The bucket is whatever bytes were already there.

That sequence is CVE-2026-109618. Increment the count, the bucket becomes visible to teardown, the key allocation fatals, initialization is skipped, teardown trusts the count.

The same ordering is the second bug, in session upload progress.

php_hash_environment() parses the multipart body before zend_activate_modules(). Session upload progress may open a session in that window, while PG(modules_activated) is still 0. If parsing fatals, normal module shutdown can be skipped, the request heap is still freed, and the worker does not necessarily die.

On Apache mod_php, cleanup runs even when startup failed, then the process is reused. A later request can initialize the session against PS(id) and PS(http_session_vars) pointing into the previous request’s freed heap. Request A stores request-owned pointers, fatals, skips session shutdown, frees the heap, and the worker survives. Request B reads the leftovers. That stale global state is CVE-2026-109619.

On PHP-FPM, a startup failure takes FPM_EXIT_SOFTWARE. The half-built table dies with the worker. The second bug still exists there, but it needs a fatal after startup so the process is still around to be wrong.

Calif’s useful generalization is the pattern, not a payload: publish or destroy state, do fallible work, then commit. A non-local fatal during the fallible step skips the commit. A later consumer trusts the false state. They used that pattern to move from the HashTable site to session upload progress. One ordering bug, a family of call sites.

Public repositories showed up within hours of the leak. Many are lab-only: a specific official image, display_errors, mod_php prefork, offsets for that build. An offset is a property of a binary. It is not a property of the CVE. Treat GitHub stars as a measure of attention.

The patch

The upstream fixes shipped on 21 October 2026:

Confirm the strings on php.net before you trust a mirror, a container tag, or this page. PHP 8.1 and below are end of life. A distro backport counts only when that vendor’s advisory names these two CVEs.

A patch here means the engine no longer publishes the bucket, or the session global, before the fallible allocation, and no longer lets a bailout leave that object for teardown or for the next request. It does not mean a WAF rule, a disabled ini setting, or an updated WordPress.

Installing the package updates a file on disk. The worker keeps the mapping it already loaded. Until Apache children or FPM workers are recycled, the host is patched and still running the bug.

Disabling session.upload_progress, or changing memory_limit, changes which paths are easy. It does not restore the rollback. The update plus the restart is the fix.

The only lab this post asks for is the one that checks the patch. It does not attack anything.

Bash

 # The CLI binary is not the web SAPI. Check both.  php -v  php-fpm -v 2>/dev/null || true 

One script, requested once, then deleted:

PHP

 <?php  header('Content-Type: text/plain');  echo PHP_VERSION, "\n", PHP_SAPI, "\n"; 

You want a fixed version and the SAPI you expected: fpm-fcgi, apache2handler, litespeed, or frankenphp. Restart the pool or Apache and request it again. If the version does not change, you restarted the wrong service, or the vhost points at another binary. On Debian and Ubuntu, php -v often prints a distro string that is not upstream 8.3.36. Read the package changelog.

For hunting, look for leads. Reporting around 17–21 October 2026 describes multipart POSTs tied to worker crashes and odd session-upload behavior before the advisory. Fatal memory errors on requests that never reached a route you recognize, then worker recycling, are a lead. They are not proof of compromise.

The fatal is part of the transaction

We teach operators that resource limits fail safe. PHP’s allocator fails closed on the next emalloc. The request machinery around it does not. It publishes a bucket, a session id, a global, and only then does the work that is allowed to abort.

That is the vulnerability: an incomplete transaction in request setup. The impact is code execution or a read of a shared worker, before the application runs, on a runtime that goes back to PHP 5.4. The public chain is that ordering, demonstrated by Calif and Wiz on stacks they named, and not a universal one-click. The patch is a new binary in the worker’s address space, not a new package sitting on disk.

Print PHP_VERSION and PHP_SAPI from the process that faces the internet. Match them to a fixed release. Restart that process. Print them again. Anything short of that is a plan to patch, not a patch.

Sources

PHP security release, 21 October 2026

Calif — PHP2Shell

Wiz Research — PHP2Shell

OpenAI — coordinated disclosure

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

PHP announced an out-of-cycle security release scheduled for October 21, 2026, at 14:00 UTC to address two remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619.

The official fixes apply to supported branches 8.2 through 8.5, following a pre-release notice prompted by an information leak on Hacker News.

No exploitation has been reported as of the announcement.

https://en.hacks.gr/ektaktes-enimeroseis-asfaleias-etoimazei-i-php-gia-dyo-sovara-kena/

#PHP #Vulnerability #Patch #WebDevelopment

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

The PHP development team released emergency security updates addressing two severe vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both with a 9.2 CVSS rating.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Apache mod_php presents the highest risk via unauthenticated requests.

Fixed versions are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

No complete wo…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-apo-tin-php-gia-dyo-sovara-provlimata/

#PHP #WebServer #Vulnerability #Patch

Unit 42 reported that attackers leveraged agentic AI platforms for post-exploitation activity after abusing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Targeting a European government entity, they accessed password hashes and MFA secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation.

https://en.hacks.gr/nees-epitheseis-se-kyverniseis-kai-etaireies-axiopoioyn-sovara-kena-asfaleias-stin-php/

#PHP #ActiveDirectory #Vulnerability #ArtificialIntelligence

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Your Website Is More Than the WordPress Dashboard https://raymondtec.com/2026/10/your-website-is-more-than-the-wordpress-dashboard/?utm_source=mastodon&utm_medium=social&utm_campaign=weekly_digest

Critical PHP flaws exposed a blind spot beneath WordPress, while AI agents, cloud outages, aging servers, and fraud showed where control really lives.

#TechNews #AIAgents #CVE2026109618 #CVE2026109619 #CVE2026115560 #ElderFraud #GoogleCloud

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

This is my shocked face.

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…

Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…

https://nexus8.8bitsecurity.com/entity/signal_event-12861123

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

The memory limit was supposed to stop the request. It became the exploit

PHP2Shell, as a vulnerability, an impact, a public technical chain, and a patch that is not finished until the worker restarts.

26 October 2026 · Defensive reading of Calif, Wiz, and OpenAI · Not an exploit write-up

PHP has treated memory_limit as a safety rail for two decades. Hit the ceiling, abort the request, move on. For PHP2Shell, that story is backwards.

The fatal is not the recovery. The fatal is the primitive. A safety check fires while the engine has already published request state and has not committed it. Teardown trusts the publish step. On the SAPIs that keep the worker, the next request trusts the leftovers.

That is the whole post. The rest is the vulnerability, what it costs, what the public research actually demonstrated, and what “patched” means in a process that is already running.

The vulnerability

PHP2Shell is two bugs in the PHP engine, not in an application.

Both are reached while PHP is still parsing the request. No login. No bug in WordPress, Drupal, Laravel, or the one-file script you deployed last year. The guest application has not started.

The affected range runs from PHP 5.4 through the unpatched 8.x releases. Web SAPIs are in scope: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. The PHP project and the researchers agree the practical risk is highest on mod_php, because that worker shuts the failed request down and then stays alive.

Two engine rules make it possible.

Publish before commit. Some paths mark a structure as live, then do the allocation that fills it in. If the second step fatals, teardown still believes the first step.

Abort is not rollback. memory_limit is a non-local exit (zend_bailout), not an unwind of every mutation that already happened. Shutdown walks whatever the counters say is live.

This shape is old. In 2004 Stefan Esser showed that a memory-limit fatal could interrupt PHP where interruption was unsafe. A 2020 report, PHP bug #78876, and a 2024 audit both touched the out-of-memory behavior. Exploitation was not proven, so it stayed a cleanup glitch. Calif, in OpenAI’s Patch the Planet work, and Wiz, independently, showed the chain holds under default settings. Frontier models cut the cost of a chain that had sat near the edge of manual research for years. That is a claim about discovery cost. It is not a claim that every host falls over on the first packet.

The impact

Successful use is unauthenticated remote code execution as the PHP worker, or a read of that worker’s memory. Wiz describes the second outcome as Heartbleed-shaped: passwords, tokens, and keys that belong to other requests, because the worker is shared. Its heap is not a per-customer enclave.

Calif reports pre-auth confirmation on the builds they tested:

• WordPress, Drupal, Joomla, MediaWiki
• Magento, Laravel, Symfony
• Roundcube, phpMyAdmin, Nextcloud, WHMCS
• some arbitrary scripts, not only full applications

Those are their results, on their builds. “Default config, before the script runs” is a claim to check in a lab you own. It is not a census of the internet.

What follows from the architecture, without inventing a victim count:

PHP 8.1 and older have no upstream release. Those hosts stay vulnerable until someone backports or the stack moves.

Patching the CMS does not move the bug. The interpreter fails first.

mod_php and PHP-FPM are not the same risk. A startup fatal that becomes the next request’s state on mod_php is often just a dead worker on FPM. FPM does not remove the post-startup path.

A leaked advisory beat the embargo. Scanning around 17–21 October 2026 shows interest. Interest is not proof that every probe achieved code execution. Reliable chains depend on SAPI, build, and whether session.upload_progress is enabled. That setting is a common default, not a universal one.

The public chain, as a technical write-up
This is a reading of Calif’s published mechanism. It is not a reproduction, and it is not a procedure you should run against anything you do not own.

Calif’s analysis is about request startup.

PHP registers $_POST and $_FILES inside php_request_startup(), before the target file runs. Nested form names become HashTables. An empty RFC1867 upload part (filename=””) still creates the six $_FILES slots, and a deeply nested name makes PHP build that tree for each slot. The body can stay modest while the allocator works hard. That is how a request reaches memory_limit without first dying on post_max_size. Chunked HTTP/1.1 or HTTP/2 widens the gap: declared length and parsed bytes are not the same check.

The line that matters is the order inside _zend_hash_str_add_or_update_i:

C

 idx = ht->nNumUsed++;  ht->nNumOfElements++;   p = ht->arData + idx;  p->key = zend_string_init(str, len, persistent); /* may zend_bailout() */ 

The live count moves first. The key allocation can bail out. Teardown walks nNumUsed and treats the slot as a real bucket. The key was never written. The bucket is whatever bytes were already there.

That sequence is CVE-2026-109618. Increment the count, the bucket becomes visible to teardown, the key allocation fatals, initialization is skipped, teardown trusts the count.

The same ordering is the second bug, in session upload progress.

php_hash_environment() parses the multipart body before zend_activate_modules(). Session upload progress may open a session in that window, while PG(modules_activated) is still 0. If parsing fatals, normal module shutdown can be skipped, the request heap is still freed, and the worker does not necessarily die.

On Apache mod_php, cleanup runs even when startup failed, then the process is reused. A later request can initialize the session against PS(id) and PS(http_session_vars) pointing into the previous request’s freed heap. Request A stores request-owned pointers, fatals, skips session shutdown, frees the heap, and the worker survives. Request B reads the leftovers. That stale global state is CVE-2026-109619.

On PHP-FPM, a startup failure takes FPM_EXIT_SOFTWARE. The half-built table dies with the worker. The second bug still exists there, but it needs a fatal after startup so the process is still around to be wrong.

Calif’s useful generalization is the pattern, not a payload: publish or destroy state, do fallible work, then commit. A non-local fatal during the fallible step skips the commit. A later consumer trusts the false state. They used that pattern to move from the HashTable site to session upload progress. One ordering bug, a family of call sites.

Public repositories showed up within hours of the leak. Many are lab-only: a specific official image, display_errors, mod_php prefork, offsets for that build. An offset is a property of a binary. It is not a property of the CVE. Treat GitHub stars as a measure of attention.

The patch

The upstream fixes shipped on 21 October 2026:

Confirm the strings on php.net before you trust a mirror, a container tag, or this page. PHP 8.1 and below are end of life. A distro backport counts only when that vendor’s advisory names these two CVEs.

A patch here means the engine no longer publishes the bucket, or the session global, before the fallible allocation, and no longer lets a bailout leave that object for teardown or for the next request. It does not mean a WAF rule, a disabled ini setting, or an updated WordPress.

Installing the package updates a file on disk. The worker keeps the mapping it already loaded. Until Apache children or FPM workers are recycled, the host is patched and still running the bug.

Disabling session.upload_progress, or changing memory_limit, changes which paths are easy. It does not restore the rollback. The update plus the restart is the fix.

The only lab this post asks for is the one that checks the patch. It does not attack anything.

Bash

 # The CLI binary is not the web SAPI. Check both.  php -v  php-fpm -v 2>/dev/null || true 

One script, requested once, then deleted:

PHP

 <?php  header('Content-Type: text/plain');  echo PHP_VERSION, "\n", PHP_SAPI, "\n"; 

You want a fixed version and the SAPI you expected: fpm-fcgi, apache2handler, litespeed, or frankenphp. Restart the pool or Apache and request it again. If the version does not change, you restarted the wrong service, or the vhost points at another binary. On Debian and Ubuntu, php -v often prints a distro string that is not upstream 8.3.36. Read the package changelog.

For hunting, look for leads. Reporting around 17–21 October 2026 describes multipart POSTs tied to worker crashes and odd session-upload behavior before the advisory. Fatal memory errors on requests that never reached a route you recognize, then worker recycling, are a lead. They are not proof of compromise.

The fatal is part of the transaction

We teach operators that resource limits fail safe. PHP’s allocator fails closed on the next emalloc. The request machinery around it does not. It publishes a bucket, a session id, a global, and only then does the work that is allowed to abort.

That is the vulnerability: an incomplete transaction in request setup. The impact is code execution or a read of a shared worker, before the application runs, on a runtime that goes back to PHP 5.4. The public chain is that ordering, demonstrated by Calif and Wiz on stacks they named, and not a universal one-click. The patch is a new binary in the worker’s address space, not a new package sitting on disk.

Print PHP_VERSION and PHP_SAPI from the process that faces the internet. Match them to a fixed release. Restart that process. Print them again. Anything short of that is a plan to patch, not a patch.

Sources

PHP security release, 21 October 2026

Calif — PHP2Shell

Wiz Research — PHP2Shell

OpenAI — coordinated disclosure

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

PHP announced an out-of-cycle security release scheduled for October 21, 2026, at 14:00 UTC to address two remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619.

The official fixes apply to supported branches 8.2 through 8.5, following a pre-release notice prompted by an information leak on Hacker News.

No exploitation has been reported as of the announcement.

https://en.hacks.gr/ektaktes-enimeroseis-asfaleias-etoimazei-i-php-gia-dyo-sovara-kena/

#PHP #Vulnerability #Patch #WebDevelopment

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

The PHP development team released emergency security updates addressing two severe vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both with a 9.2 CVSS rating.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Apache mod_php presents the highest risk via unauthenticated requests.

Fixed versions are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

No complete wo…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-apo-tin-php-gia-dyo-sovara-provlimata/

#PHP #WebServer #Vulnerability #Patch

Unit 42 reported that attackers leveraged agentic AI platforms for post-exploitation activity after abusing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Targeting a European government entity, they accessed password hashes and MFA secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation.

https://en.hacks.gr/nees-epitheseis-se-kyverniseis-kai-etaireies-axiopoioyn-sovara-kena-asfaleias-stin-php/

#PHP #ActiveDirectory #Vulnerability #ArtificialIntelligence

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Your Website Is More Than the WordPress Dashboard https://raymondtec.com/2026/10/your-website-is-more-than-the-wordpress-dashboard/?utm_source=mastodon&utm_medium=social&utm_campaign=weekly_digest

Critical PHP flaws exposed a blind spot beneath WordPress, while AI agents, cloud outages, aging servers, and fraud showed where control really lives.

#TechNews #AIAgents #CVE2026109618 #CVE2026109619 #CVE2026115560 #ElderFraud #GoogleCloud

The PHP Foundation disclosed the PHP CVE-2026-115560 vulnerability, detailing runtime session handler risks and providing an immediate mitigation.

#PHP #CVE2026115560 #Cybersecurity #AppSec #Vulnerability

https://meterpreter.org/php-cve-2026-115560-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Your Website Is More Than the WordPress Dashboard https://raymondtec.com/2026/10/your-website-is-more-than-the-wordpress-dashboard/?utm_source=mastodon&utm_medium=social&utm_campaign=weekly_digest

Critical PHP flaws exposed a blind spot beneath WordPress, while AI agents, cloud outages, aging servers, and fraud showed where control really lives.

#TechNews #AIAgents #CVE2026109618 #CVE2026109619 #CVE2026115560 #ElderFraud #GoogleCloud

A Popcorn Time updater flaw, CVE-2026-30612, exposed millions of PCs to SYSTEM-level code. Eye Security disabled it on 2M+ systems.

#PopcornTime #Time4Popcorn #CVE202630612 #EyeSecurity #Botnet #SupplyChain #RCE #Malware

https://meterpreter.org/popcorn-time-updater-flaw/?utm_source=mastodon&utm_medium=jetpack_social

CW: security

Kritikus, hitelesítés nélküli RCE a GitLabban — CVE-2026-110264 (CVSS 10.0). Érint minden saját üzemeltetésű kiadást 7.0 óta. Frissítsetek a javított kiadásokra: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 vagy 18.11.13. GitLab.com és Dedicated már kapta a javítást. Részletek: https://linuxmint.hu/hir/2026/10/kritikus-gitlab-sebezhetoseg-cvss-100-hitelesites-nelkuli-rce-t-tehet-lehetove-12-evnyi

#GitLab #CVE2026 #infosec #OpenSource

CW: technikai sebezhetőség

Ruby 4.0.9, 3.4.12 és 3.3.13 javít három Onigmo regex-motort érintő hibát, amelyek négy kritikus GitLab RCE-hez vezettek (pl. CVE-2026-110264, CVE-2026-97229). Érintett: ha támadó-vezérelt sztringből fordítasz Regexp.new/union/compile vagy /#{input}/-et. Ideiglenes védelem: ne fordíts megbízhatatlan bemenetet; Regexp.timeout vagy mintahossz nem elég. Részletek: https://linuxmint.hu/hir/2026/10/harom-regexmotor-hibat-javitott-a-ruby-negy-kritikus-gitlab-rce-sebezhetoseget-okoztak

#Ruby #GitLab #CVE #InfoSec #OpenSource

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity

https://securityonline.info/ruby-security-update-onigmo-gitlab-cves/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CW: technikai sebezhetőség

Ruby 4.0.9, 3.4.12 és 3.3.13 javít három Onigmo regex-motort érintő hibát, amelyek négy kritikus GitLab RCE-hez vezettek (pl. CVE-2026-110264, CVE-2026-97229). Érintett: ha támadó-vezérelt sztringből fordítasz Regexp.new/union/compile vagy /#{input}/-et. Ideiglenes védelem: ne fordíts megbízhatatlan bemenetet; Regexp.timeout vagy mintahossz nem elég. Részletek: https://linuxmint.hu/hir/2026/10/harom-regexmotor-hibat-javitott-a-ruby-negy-kritikus-gitlab-rce-sebezhetoseget-okoztak

#Ruby #GitLab #CVE #InfoSec #OpenSource

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity

https://securityonline.info/ruby-security-update-onigmo-gitlab-cves/?utm_source=mastodon&utm_medium=jetpack_social

🚨 KeePassXC 2.8.0 is out with several security fixes and a major move to Qt 6

Release: https://github.com/keepassxreboot/keepassxc/releases

https://keepassxc.org/download

The update fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file, along with multiple additional browser integration, memory safety, and Windows security issues that are still awaiting CVE assignments.

Security fixes include:

• Crafted KDB import use-after-free
• Browser entry reference injection
• Out-of-bounds writes in native messaging
• Weak Pageant shared-memory mapping names on Windows
• Integer overflow and out-of-bounds read in the legacy KDB importer
• Improved clearing of decrypted database fragments from memory

KeePassXC 2.8.0 also adds remote database synchronization, configurable shortcuts, SSH key generation, Wayland Auto-Type support, Linux Quick Unlock, and native Windows Arm64 builds.

A PoC and full details are public for CVE-2026-43501 (CVSS 9.8), a Linux kernel IPv6 vulnerability in RPL source routing. Update your kernel now.

#Linux #LinuxKernel #CVE202643501 #IPv6 #kernelCTF #ContainerEscape #PoC #CyberSecurity

https://securityonline.info/linux-kernel-ipv6-cve-2026-43501-exploit/?utm_source=mastodon&utm_medium=jetpack_social