Vulnerabilities
Tue 20 Oct
Updated Mon 2 Nov
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws each rated 9.2 under CVSS 4.0 that can let an attacker run code on a server without logging in, and PHP says updating is the only complete fix (php.net advisory, 21 Oct). Before the release, the PHP security team had said on 20 October 2026 that it would publish a security release on Wednesday 21 October at 14:00 UTC (10:00 pm Perth, 1:00 am 22 October in Sydney and Melbourne) to fix two critical vulnerabilities, each rated 9.2 under CVSS 4.0, and urged all PHP users to prepare to upgrade as soon as it lands. PHP says it may release earlier if details of either flaw become public or if exploitation appears in the wild, and that affected versions, fixed versions and technical details will only be published with the release. watchTowr told BleepingComputer the two bugs are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, believed to affect PHP 5, 6, 7 and 8, and that information about them leaked before the originally planned disclosure on Thursday 22 October at 11:00 am US Eastern. watchTowr says it has reproduced CVE-2026-109618 and is holding technical details until patches are out, and that it has not seen exploitation in the wild. BleepingComputer reports that a now-deleted post on Y Combinator's Hacker News forum, which it saw, had named the same CVE IDs, and that watchTowr and that post described the flaws as CVSS 10.0, while PHP itself rates them 9.2. BleepingComputer notes that PHP powers many websites and web applications, including content management systems, e-commerce platforms and custom web services. Primary: PHP.net news (20 Oct); wire: BleepingComputer (20 Oct). UPDATE (21 Oct): CERT-EU issued Security Advisory 2026-018 on the two flaws (published 20 Oct 20:33, v1.0 dated 21 Oct), saying they could affect all PHP versions from PHP 5 onwards and advising organisations to prepare for immediate patching and, where that is not possible, to consider isolating internet-facing PHP applications from public networks until a fix is applied. As of 08:20 Perth on 21 October PHP had not yet published the release. UPDATE (21 Oct, afternoon Perth): ASD's ACSC issued a 'critical' alert on the two flaws and said it was 'not aware of active exploitation related to these vulnerabilities', according to Information Age (22 Oct). Researchers have nicknamed the pair 'php2shell'; that is not PHP's name. UPDATE (21 Oct, evening Perth): iTnews reports that, hours after the existence of the two vulnerabilities surfaced on social media, a researcher posted the alleged full details of both flaws on the web, including two proofs of concept; iTnews says it has sighted the website but has not had independent confirmation that the proofs of concept work. PHP had not published the release as of 17:30 Perth on 21 October; its notice says it may release early if details become public. UPDATE (21 Oct, 20:30 Perth): PHP core developer Gina Peter Banyard warned that no mitigations exist and that applying the official patches is the only solution, so workarounds and firewall protections are temporary measures only (BleepingComputer). Cloudflare released an emergency update to its managed Web Application Firewall rules, and its CTO Dane Knecht said Cloudflare was already observing early attacks while stressing the protections are only temporary (BleepingComputer). Neither CVE was in CISA's KEV catalog as of 21 October. PHP had still not published the release at 20:30 Perth. UPDATE (21 Oct, 23:30 Perth): PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October (after 10 am US Eastern, 10 pm Perth, according to The Record), saying they fix two critical vulnerabilities that can allow unauthenticated remote code execution and that all PHP users are strongly encouraged to update immediately. PHP says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that it considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. PHP's GitHub advisories describe CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) as out-of-memory handling that can interrupt PHP while request data is only partially initialised, so that request cleanup treats the invalid data as valid, and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) as request-owned state that survives after its memory is freed and is used by a later request on the same worker (a use after free); both advisories rate the flaws 9.2 under CVSS 4.0 and list PHP versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says PHP 8.1 and older no longer receive updates from the PHP project, that it has provided minimal source backports for PHP 7.4, 8.0 and 8.1, and that Linux distributions and LTS vendors received the patches in advance. It says only an update is a complete solution; the interim settings it lists reduce exposure to specific attack paths but do not make an installation safe. BleepingComputer reports the flaws were found by researchers at Calif, Wiz and OpenAI, and that the UK NCSC told UK organisations to update PHP systems immediately or take them offline until they are patched. watchTowr's head of threat intelligence, Jake Knott, told The Record that watchTowr is observing in-the-wild exploitation of the flaws with proof-of-concept tools built with the help of AI, and said: 'Whilst nobody has been successful to date, we don't expect that will last long.' Neither CVE was in CISA's KEV catalog as of 21 October. UPDATE (22 Oct, 2:30 am Perth): The PHP Foundation said in a 21 October blog post that full remote code execution through CVE-2026-109618 was demonstrated on Apache with mod_php with default settings, and that remote code execution was also confirmed on PHP-FPM through application-level code paths. The Foundation says a PHP core developer first found signs of the out-of-memory problem in 2024 while fixing an issue from a Quarkslab audit, that work on a fix stalled and restarted for months, and calls the delay 'a structural failure'; it says a Calif researcher reported an unconditional remote code execution with the same root cause on 11 August, OpenAI independently reported the same root cause that day, and Wiz (24 August) and OpenAI (18 September) reported further attack vectors. The Foundation says the two CVE IDs began circulating online at about 15:00 UTC on 20 October with a wrong release time and a wrong CVSS score of 10.0, so PHP brought its pre-announcement forward and moved the release from 22 to 21 October; it says Calif mistakenly published a video showing its proof of concept working, which contributed to faster development of proof-of-concept exploits, and that the PHP security team did not identify any functional exploits at the time of release. The PHP Foundation also says Chainguard broke the embargo at 07:41 UTC on 21 October, more than six hours before the coordinated release, by publishing built images containing the fix; The Record says Chainguard did not respond to its request for comment. CISA said in a 21 October alert that it strongly urges organisations to patch immediately, that it had not observed exploitation as of publication, and that organisations that cannot update immediately, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched or updated. Palo Alto Networks said in an advisory published at 16:00 UTC on 21 October (midnight Perth) that PAN-OS and Panorama are affected and that Cloud NGFW, Prisma Access, Cortex XDR Agent, Cortex XSOAR, Cortex Xpanse, Bridgecrew and Idira are not; it says the issue will be fixed in upcoming PAN-OS releases, rates it CVSS-B 8.7 in PAN-OS when the management interface is reachable from the internet (7.1 when access is limited to a jump box), and says it is not aware of malicious exploitation against its products. ConnectWise's Trust Center says that on 21 October, in response to the PHP vulnerabilities, it completed remediation for Axcient x360Recover while the Backup for Files Portal (Legacy Portal) remained temporarily offline, and that all Axcient backup services remained operational, with backups running. UPDATE (22 Oct, 4:45 am Perth): Linux distributions have shipped fixed packages. Debian's advisories DSA-6574-1 and DLA-4848-1 (21 October) give php8.4 8.4.27-1~deb13u1 for Debian 13 trixie and php8.2 8.2.35-1~deb12u1 for Debian 12 bookworm as the fixed versions. Ubuntu published USN-8948-1 and USN-8948-2 on 21 October, and its CVE page for CVE-2026-109618 lists fixes in php8.3 8.3.6-0ubuntu0.24.04.13 (24.04 LTS), php8.1 8.1.2-1ubuntu2.28 (22.04 LTS) and php8.5 8.5.4-0ubuntu1.5 (26.04 LTS), with fixes for some older releases available through Ubuntu Pro. The CVE records, published on 21 October, confirm CVSS 4.0 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) for both flaws, and CISA's enrichment of those records lists exploitation as 'none'. Neither CVE was in CISA's KEV catalog as of its 21 October 14:04 UTC update. PHP has published no new advisory since its 21 October release notice. UPDATE (22 Oct, 5:45 am Perth): Palo Alto Networks updated its advisory at 19:18 UTC on 21 October (3:18 am Perth 22 Oct) to list GlobalProtect App and Prisma Access Agent as not impacted; its FAQ says the issue strictly affects the PAN-OS management web interface (the HTTPS web UI and XML API service), affects a dataplane interface only if a management profile is attached to it, and does not affect GlobalProtect portals and gateways or the captive portal. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Red Hat's security bulletin RHSB-2026-013 rates the two flaws Important and lists Red Hat Enterprise Linux 10, 9 and 8 and Red Hat OpenShift Dev Spaces 3 as affected, saying RHEL 7 and earlier ship PHP versions that are not affected; Red Hat says some fixes are already available with more in progress, that standard RHEL deployments use PHP-FPM, where remote code execution is difficult in practice, and that environments running mod_php with default configuration are at higher risk. SUSE's page for CVE-2026-109618 lists fixed php8 8.3.36-150700.3.24.1 packages for SUSE Linux Enterprise Server 15 SP7 and its Web and Scripting module; as of 1 November 2026 it marks the overall state of the issue as Resolved. ConnectWise's Trust Center says the Backup for Files Portal (Legacy Portal) was fully restored on 22 October. UPDATE (22 Oct, 8:30 am Perth): Palo Alto Networks' advisory timeline now also lists Cortex XSIAM and Prisma Cloud as not impacted and records that Threat IDs were released; it says customers with a Threat Prevention subscription get coverage by enabling Threat IDs 543004, 97622, 97623, 97624 and 97625 (Applications and Threats content version 9162 and later), and that for these Threat IDs to protect against the attack, management traffic must be routed through a dataplane port, the certificate for inbound management traffic replaced, that traffic decrypted and threat prevention enabled on it. Palo Alto still lists fixed PAN-OS and Panorama versions as 'ETA: TBD' as of 22 Oct. Fortinet's PSIRT advisory FG-IR-26-186 (21 Oct) says Fortinet is investigating the impact on FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint, lists FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient for Linux, Windows and macOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC as confirmed not impacted, and marks the issue 'Known Exploited: No'. The WA Government's Cyber Security Unit (WASOC) published advisory 20261022001 on 22 October recommending that administrators apply PHP's fixes, and said it had not received any reports of exploitation on Western Australian Government networks at the time of writing. UPDATE (22 Oct, 11:00 am Perth): Amazon Threat Intelligence says in an AWS Security Blog post (21 Oct, 22:36 UTC; 6:36 am Perth 22 Oct) that it identified a PHP2Shell exploitation attempt dating to 17 October in its MadPot honeypot telemetry, four days before public disclosure, from an IP address associated with a commercial anonymization network, and that it remains unclear how the actor acquired exploit information before disclosure. Amazon says it identified multiple proof-of-concept exploits on release day, the earliest around 02:00 UTC on 21 October, and further exploitation attempts against MadPot from other anonymized infrastructure between 02:00 and 08:00 UTC that suggested multiple actors; it says it is unclear if any of these attempts would have succeeded in real-world systems. Amazon says that once the embargo lifted at 14:00 UTC additional proof-of-concept exploits appeared within hours and were used against its sensors almost immediately, that PHP2Shell is now being broadly exploited in the wild, and that investigations should start from at least 17 October. AWS Security Bulletin 2026-143-AWS (first published 21 Oct) says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix; see the 23 Oct update for the status of AWS's own fixes. In Australia, according to Information Age (ACS), ASD said on Wednesday night (21 Oct) that it was 'aware of an outage that may be affecting government websites', including its own. ASD's 'ALERT UPDATE' post on X (22:51 UTC on 21 Oct; 6:51 am Perth 22 Oct), embedded in the Information Age report, says 'Patches are now available for two critical PHP vulnerabilities' and recommends that organisations using PHP identify affected systems, review official PHP guidance and apply appropriate mitigations as soon as possible. According to ABC News (22 Oct), GovCMS, which hosts many major Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available; Moodle 'took its website offline as a precaution, before beginning to restore them after applying security fixes'; and Australian hosting provider VentraIP restricted some of its file uploads on customer hosting. UPDATE (23 Oct 2026, 7:45 am Perth): AWS updated Security Bulletin 2026-143-AWS at 14:00 PDT on 22 October (5:00 am Perth 23 Oct) to say its fixes have shipped: for Amazon WorkMail 'AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required'; for Elastic Beanstalk it 'has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix'; updated Amazon Linux PHP packages are available for commercial regions, with non-commercial regions targeted for 22 October; and 'Updated Lightsail blueprints are now available in all regions'. AWS still says AWS services are not impacted and that PHP 5.4 to 8.1 have no upstream fix. Fortinet updated FG-IR-26-186 on 22 October: only FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS remain under investigation; FortiADC, FortiADC Manager, FortiClient EMS, FortiSIEM and FortiMonitor, among others, are now listed as confirmed not impacted; and it still marks the issue 'Known Exploited: No'. UPDATE (23 Oct 2026, 11:40 am Perth): Palo Alto Networks updated its advisory on 23 October to list WildFire Appliance WF-500 and WF-500-B as affected, with no fixed version yet ('ETA: TBD'); it says Cortex XCORE (SaaS) and WildFire Cloud were previously impacted and received remediation patches on 21 and 22 October respectively, and lists Cortex XDR Broker VM and Strata Cloud Manager as not impacted. At that update, fixed PAN-OS and Panorama versions were still 'ETA: TBD'. UPDATE (23 Oct 2026): Palo Alto Networks updated its advisory again at 03:45 UTC on 23 October (11:45 am Perth) to list fixed PAN-OS hotfix versions with estimated release dates from 26 to 30 October, for example 12.2.4-h1 (ETA 28 Oct), 12.1.10-h3 (ETA 30 Oct), 11.2.10-h16, 11.1.16-h4 and 10.2.18-h13 (ETA 26 Oct); Panorama and WildFire WF-500/WF-500-B still show no fixed version ('ETA: TBD'). Palo Alto still rates its own exposure CVSS-B 8.7 (High). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (23 Oct 2026, 5:40 pm Perth): Sophos corrected its own earlier report. In an update at 21:21 UTC on 22 October it said its customer telemetry shows scanning and a small number of failed exploitation attempts, not the successful exploitation it had reported at 16:18 UTC, and that there is no evidence of a successful compromise due to these vulnerabilities as of that update. Sophos says the attempted payload, a likely Mirai botnet variant known as Potassium, was not delivered because Sophos countermeasures blocked it, and that developing a successful exploit is not straightforward, but it still recommends urgent patching. (source: Sophos) UPDATE (25 Oct 2026): Palo Alto Networks revised its advisory again on 25 October, removing the estimated release dates for PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16, which the advisory now lists as fixed versions without an ETA; the other PAN-OS hotfixes still carry ETAs from 27 to 30 October (for example 11.2.13-h4 and 11.1.13-h16 on 27 October, 12.2.4-h1 on 28 October and 12.1.10-h3 on 30 October). The advisory's product table now lists WildFire Appliance WF-500 and WF-500-B as unaffected, following a 23 October revision that Palo Alto describes as a correction to their impact status, and it has no separate Panorama row; its note says the issue applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). On 24 October Palo Alto added 20 more Threat Prevention signatures (Threat IDs 97643 to 97678, as listed in the advisory; content versions 9162, 9163, 9164 and later). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (25 Oct 2026, 11:30 pm Perth): Palo Alto Networks reworded its 25 October timeline entry to say it removed the ETAs for PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 'as these versions are released'; the other PAN-OS hotfixes still carry ETAs from 27 to 30 October. (source: Palo Alto Networks advisory CVE-2026-109618) Correction (26 Oct 2026): Unit 42 retracted its 23 October update on 25 October (2:15 pm PT; 26 October, 5:15 am Perth), saying it is unable to confirm that the attack it described against a European government agency, carried out through a vulnerable PHP application, is associated with the PHP2Shell CVEs; our earlier update reporting that attack as PHP2Shell post-exploitation activity has been removed. (source: Palo Alto Networks Unit 42) UPDATE (26 Oct 2026): Schneider Electric's security notifications page now lists a security bulletin for the two flaws, SESB-2026-295-01, 'PHP Vulnerabilities (php2shell)', CVE-2026-109618 and CVE-2026-109619, last updated 22 October 2026. It lists the affected products and versions as EcoStruxure Security Expert (All versions prior to Version 1.48.4.0), ProLeiT LINEoptimize, formerly known as Plant iT LMS (All versions), and EcoStruxure Control Engineering (All versions). The listing itself gives no remediation steps; those are in the bulletin document. (source: Schneider Electric) UPDATE (26 Oct 2026): Palo Alto Networks revised its advisory on 26 October, removing the estimated release dates for PAN-OS 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 because those hotfixes are now released. On the 11.1 line, 11.1.7-h12 still carries an ETA of 30 October, and other hotfixes on the 12.2, 12.1, 11.2 and 10.2 lines still show ETAs from 27 to 30 October. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (26 Oct 2026): Adel Karimi published honeypot evidence dated 24 October (UTC) of confirmed remote code execution: his report correlates 35 complete execution-stage requests with 35 /bin/sh processes started directly by Apache workers on three disposable honeypots running PHP 8.4.26 under Apache mod_php, from two source addresses, using a chain that closely matches a public HTTP-only proof-of-concept exploit; he says the activity is consistent with CVE-2026-109618 and that his records do not establish use of a distinct CVE-2026-109619 path. (source: Adel Karimi honeypot report) BleepingComputer, which describes Karimi as detection and response lead at Perplexity, reported on 26 October that Expel researcher Marcus Hutchins called it 'by far the highest quality confirmation of in-the-wild php2shell exploitation' he had seen. (source: BleepingComputer) UPDATE (27 Oct 2026; Palo Alto Networks): Palo Alto Networks revised its advisory on 27 October, removing the ETAs for PAN-OS 10.2.13-h27 and 10.2.16-h12 because those hotfixes are now released. As of 27 October the advisory lists nine PAN-OS hotfixes without an ETA (10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4 and 11.2.10-h16); the others still carry ETAs from 27 to 30 October, including 11.2.13-h4 (ETA 27 October), 12.2.4-h1 (ETA 28 October) and 10.2.7-h39 and 11.1.7-h12 (ETA 30 October). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (27 Oct 2026): CISA added CVE-2026-109618 ('PHP Memory Corruption Vulnerability') and CVE-2026-109619 ('PHP Stale Internal Request-State Vulnerability') to its Known Exploited Vulnerabilities (KEV) catalog on 26 October 2026, with a remediation due date of 29 October for US federal agencies and ransomware use listed as unknown, and updated its 21 October PHP alert to reflect the addition. This supersedes the earlier lines saying neither CVE was in the KEV catalog as of 21 October. (source: CISA) UPDATE (27 Oct 2026): Palo Alto Networks revised its advisory again on 27 October, removing the ETAs for PAN-OS 12.1.7-h11 and 12.2.4-h1 because those hotfixes are now released. The advisory now lists eleven PAN-OS hotfixes without an ETA (10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.2.10-h16, 12.1.7-h11 and 12.2.4-h1); the others still carry ETAs from 27 to 30 October, including 11.2.13-h4 (ETA 27 October) and 10.2.7-h39, 11.1.7-h12 and 12.1.10-h3 (ETA 30 October). Palo Alto still says it is not aware of any malicious exploitation of this issue against its products. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): Palo Alto Networks revised its advisory again on 27 October, updating the severity to Critical (CVSS-B 9.2) with suggested urgency Highest, and its Exploitation Status now reads: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." This supersedes the earlier lines saying Palo Alto was not aware of malicious exploitation against its products. Palo Alto says the risk is highest when the management interface is reachable from external IP addresses on the internet and that the issue strictly affects the management web interface (the HTTPS web UI and XML API); GlobalProtect portal, gateway and Clientless VPN and the captive portal are not impacted. The hotfix list is unchanged from its previous revision; as of 28 Oct (Perth) the hotfixes still carrying ETAs include 11.2.13-h4 (27 October), 11.2.16-h1 (28 October), 10.2.10-h42, 11.2.7-h23 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): In its latest revision of the advisory (dated 27 October), Palo Alto Networks changed its Exploitation Status from very limited exploitation to: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." The advisory timeline has no separate entry for this wording change. Hotfix ETAs read the same as in the previous revision: 11.2.13-h4 (ETA 27 October), 11.2.16-h1 (28 October), 10.2.10-h42, 11.2.7-h23 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). Restrict the management interface to trusted internal IP addresses until your hotfix is out. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (28 Oct 2026, Perth; Palo Alto Networks): In a revision dated 28 October, Palo Alto Networks removed the ETAs for PAN-OS 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 'as these versions are released'. Hotfixes still carrying ETAs are 10.2.10-h42 and 12.1.4-h13 (29 October), and 10.2.7-h39, 11.1.7-h12, 11.2.4-h23 and 12.1.10-h3 (30 October). (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (29 Oct 2026, Perth; Dream): Israeli security company Dream published research dated 26 October saying that on 25 October its researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that combined a custom, non-public PHP2Shell exploit (CVE-2026-109618/CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root 25 servers across the United States, Japan, Taiwan and South Korea, including systems in a US government-affiliated environment. Dream says the affected devices run specific versions of a large vendor's firewall software. According to Dream, the exploit targets PHP's session.upload_progress mechanism on the firewall's management web server (PHP 8.0.30), and the attacker used FOFA to find about 19,000 internet-facing firewalls, fingerprinted about 5,000, filtered to 240 targets and rooted 24 firewalls, planting a web shell; two belonged to a US government-affiliated organisation (rooted on 23 Oct at 18:14 UTC, which then crashed, and on 24 Oct at 10:09 UTC), and at 11:35 UTC a third, internal firewall management server was rooted through a reverse SSH tunnel and used to attack Active Directory. Dream says Claude Code had been installed and the aiscan platform was configured with DeepSeek and Kimi models in the attack infrastructure, but it has no direct evidence the AI tools wrote the exploit, and that it cannot determine the full extent of the compromise. (source: Dream) UPDATE (29 Oct 2026, Perth; CISA): CISA added CVE-2026-46300, the Linux kernel flaw that Dream says was paired with PHP2Shell (the 'Fragnesia' privilege escalation), to its Known Exploited Vulnerabilities catalog on 28 October; CISA's KEV entry says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root, and gives US federal agencies a due date of 31 October. Linux kernel fixes are listed in the CVE record. (source: CISA) UPDATE (29 Oct 2026, Perth; Palo Alto Networks): In a revision dated 29 October, Palo Alto Networks removed the ETAs for PAN-OS 10.2.7-h39, 10.2.10-h42, 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 'as these versions are released'; as of 29 October the only hotfix in its product status table still showing an ETA is 11.1.7-h12 (30 October), and the advisory still says active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet. (source: Palo Alto Networks advisory CVE-2026-109618) UPDATE (30 Oct 2026, Perth; The Record; GreyNoise): The Record reported on 29 October 2026 that cybersecurity firm GreyNoise said it has seen at least six successful exploitations of CVE-2026-109618 and CVE-2026-109619. (source: The Record) GreyNoise's PHP2Shell activity page, read on 30 October (Perth), defines a confirmed exploitation as "a session on a vulnerable GreyNoise sensor in which the web server ran operating-system commands" and listed 192 such sessions when read. (source: GreyNoise) Dream's vice president of cyber research, Kfir Fleischer, told The Record that its researchers found 24 compromised firewalls, most attacked between 23 and 24 October, that for 22 of them the attackers did nothing beyond planting webshells, and that Dream is working with the firewall vendor and relevant authorities on investigating its findings; The Record says CISA declined to comment on Dream's report, directing it to previous advisories about PHP2Shell. (source: The Record) UPDATE (30 Oct 2026, Perth; Palo Alto Networks): Palo Alto Networks' advisory timeline has a further entry dated 29 October 2026: "Removed ETAs for 11.1.7-h12 as the version is released. Also updated the Frequently Asked question (FAQ) section." With that, no hotfix in its product status table still shows an ETA. The updated FAQ answers whether the PAN-OS fixes address both PHP vulnerabilities: "Yes. The released hotfixes address both CVE-2026-109618 and CVE-2026-109619." The advisory still says: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." (source: Palo Alto Networks) UPDATE (31 Oct 2026): Palo Alto Networks' advisory, read on 31 October (12:41 pm Perth), lists all 20 PAN-OS hotfixes as released, with no ETA left in its product status table; its latest timeline entry, dated 29 October, says 11.1.7-h12, the last of them, is released, and its FAQ says the released hotfixes address both CVE-2026-109618 and CVE-2026-109619. (source: Palo Alto Networks advisory CVE-2026-109618) Correction (1 Nov 2026): details credited to iTnews, ConnectWise, Debian, Ubuntu and SUSE are now linked to the pages that state them; the iTnews line now follows iTnews's wording; ConnectWise's PHP updates now follow its Trust Center advisories; Debian's fixed versions now follow its advisories; SUSE's page now marks the issue Resolved rather than pending; and two lines that no readable linked source supports were removed. (source: iTnews; ConnectWise Trust Center; Debian; SUSE) Correction (02 Nov 2026): removed The Hacker News and the BBC's live page as sources, with the details only they gave; each remaining detail is credited to the strongest readable source that states it. (source: BleepingComputer; Dream; PHP) Updated (02 Nov 2026): Dream's post, in an update dated 29 October, names the firewall vendor as Palo Alto Networks and says it is working with it on the investigation. (source: Dream)
PHP.net — Security advisory: Critical remote code execution vulnerabilities, update now (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; 21 Oct 2026)
vulnerabilities australia
