23 Oct 2026
Week in review
Greetings,
This week, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The flaws could allow remote code execution and affect a wide range of PHP deployments, with reports indicating exploitation attempts emerged shortly after disclosure.
PHP powers a significant portion of the internet, with estimates of 70% of all web sites running it. This means vulnerabilities in the scripting language can have widespread consequences across the globe. The wave of exploitation activity that has started to emerge is likely to be significant, with many web sites unlikely to be patched.
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Date: 2026-10-21
Author: The Hacker News
[AUSCERT has notified potentially affected members via a Critical MSIN. Also see AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0252.2]
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.
The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs.
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
Date: 2026-10-21
Author: The Hacker News
[See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.13041/]
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.
The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Date: 2026-10-17
Author: Bleeping Computer
[See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2026.12790/]
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure.
“The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned.
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Date: 2026-10-20
Author: The Hacker News
[See AUSCERT Bulletin https://portal.auscert.org.au/bulletins/ESB-2026.12627]
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.
Patches for the flaw were released last week by Fortinet in the following versions –
FortiSIEM 7.5.0 (Upgrade to 7.5.1 or above)
FortiSIEM 7.6 (Not affected)
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
Date: 2026-10-15
Author: CyberScoop
That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.
The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru.
ASB-2026.0252.2 – PHP: CVSS (Max): 9.8
PHP have released updates to address two critical PHP vulnerabilities – CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state) which allow unauthenticated remote code execution and have been assigned a CVSS score of 9.2 (v4.0) by PHP.
ASB-2026.0261 – Oracle E-Business Suite: CVSS (Max): 10.0
Oracle have released a Critical Patch Update that contains 194 new security patches for Oracle E-Business Suite; 31 of these vulnerabilities may be remotely exploitable without authentication
ESB-2026.13041 – GitLab Community & Enterprise Edition: CVSS (Max): 10.0
On October 21, 2026, GitLab released updated versions for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and GitLab strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
ESB-2026.13044 – Fortinet Products: CVSS (Max): 9.8
Fortinet have published their advisory on PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619). Fortinet is currently investigating the impact of CVE-2026-109618 over Fortinet Products.
ESB-2026.13061 – Palo Alto Products: CVSS (Max): 9.2
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Palo Alto Networks is not aware of any malicious exploitation of this issue against their products and will update their advisory with fixed versions and release estimates as they become available.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
