The sound you are currently experiencing is the sound of a million script kiddies humming “time to do some sketchy shit, doo dah doodah, hope I get away with it, oh doodah day”

So, today’s entry in how #ai is destroying the internet, I give you a bug that affects most servers on earth, so that’s fun! It doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives.

The vulnerability, tracked as #CVE-2026-97631, is a Sev 9.5 memory-corruption flaw in an #ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses.

Discovered by teams at #anthropic and #google, it was surfaced by #AMI publishing a pull request with a fix for some of their hardware. Because the bug had been “embargoed“ while manufacturers worked on fixes, this is an unpatched bug in many cases, that has just been announced publicly.

#infosec #sysops #netops

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

Faille UEFI CVE-2026-97631 : un paquet ICMP suffit pour exécuter du code avant le Secure Boot https://www.it-connect.fr/faille-uefi-edk-ii-pxe-icmp-cve-2026-97631/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Patch CVE-2026-97631 now. This critical 9.5 CVSS EDK II PXE vulnerability allows unauthenticated pre-boot RCE via crafted ICMP error packets.

#EDKII #TianoCore #UEFI #PXEBoot #CVE202697631 #Cybersecurity #Vulnerability #InfoSec #13302

https://securityonline.info/edk-ii-pxe-vulnerability-pre-boot-rce-cve-2026-97631/?utm_source=mastodon&utm_medium=jetpack_social

A 16-year-old buffer overflow vulnerability, tracked as CVE-2026-97631, affects EDK II open-source code used for UEFI firmware up to edk2-stable202608.

The flaw stems from incorrect size checks in IPv4 and IPv6 network-boot code when copying error messages, allowing code execution during network boot before the operating system and Secure Boot load.

Affected packages include distributions from Red Hat, SUSE, and Debian.

https://en.hacks.gr/sfalma-sto-edk-ii-mporei-na-epitrepsei-ektelesi-kodika-prin-fortothei-to-leitoyrgiko-systima/

#UEFI #Firmware #EDKII #Debian

CVE-2026-97631

pls stop

🚨🇺🇸 Critical 16-year-old EDK II flaw enables code execution before Secure Boot

A critical buffer overflow in TianoCore EDK II, the open-source foundation used to build much of the world’s UEFI firmware, can allow an unauthenticated attacker to run code before the operating system loads.

Tracked as CVE-2026-97631, the vulnerability carries a CVSS score of 9.5 and has existed in the code since November 2010.
⠀
The flaw resides in the PXE network-boot driver, which copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size.
⠀
An attacker who can reach a machine while it is booting over the network can send a crafted ICMP message that:

• Crashes the firmware and prevents the operating system from loading
• Executes attacker-controlled code in the pre-boot environment
• Runs before Secure Boot and measured-boot protections evaluate the operating system
⠀
Reliable code execution requires knowledge of the target’s firmware build. Systems that boot exclusively from local storage are not exposed through this attack path.
⠀
An upstream fix was merged into EDK II on October 15, but no stable EDK II release currently includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates to customers.

Source: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

🧐😱🫣
Critical UEFI Firmware Flaw
CVE-2026-97631

CVE-2026-97631: How a 16-Year-Old EDK II PXE Bug Exposes UEFI Firmware Before the OS Loads

https://thecybersecguru.com/news/cve-2026-97631-edk2-pxe-uefi-vulnerability/

https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.

https://security.paloaltonetworks.com/CVE-2026-109618

Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.

:brdThink:

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

PHP2Shell: One Vulnerable PHP Server Can Become Your Next Major Security Incident

The vulnerability is in PHP. The real failure may be in your IT operations.

On October 21, 2026, security researchers disclosed two critical vulnerabilities in PHP that can allow an unauthenticated attacker to execute code remotely. Within days, exploitation reports emerged, and CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Both received a CVSS 4.0 severity score of 9.2. PHP is widely deployed, making the potential attack surface enormous.

This isn’t a theoretical risk to put on next quarter’s security roadmap.
It’s an operational problem that needs attention now.

Sources: Wiz Research · Canadian Centre for Cyber Security

Why PHP2Shell is different

Most people hear about a vulnerability and immediately ask: Which application is affected?

PHP2Shell changes the conversation because the flaw sits in the PHP runtime itself, below application-level defenses.

The vulnerabilities involve memory-management errors that can leave PHP in an unsafe state when handling requests. Under the right conditions, an attacker can exploit that behavior to execute arbitrary code or expose sensitive process memory.

An attacker doesn’t necessarily need a valid account or a compromised employee laptop. A vulnerable, internet-facing PHP service may be enough.

And the implications go beyond the web application itself. Successful remote code execution can give an attacker a foothold to steal credentials, access sensitive files, establish persistence, or move toward other systems.

The critical detail: an application-level security check cannot reliably protect against a vulnerability that can be triggered before application code runs.

That is why PHP2Shell requires infrastructure-level remediation, not simply a code change in your application.

The uncomfortable question: Do you know where you’re running PHP?

PHP is not limited to the application your engineering team actively maintains.

It may be running in a WordPress installation, a legacy internal tool, a customer portal, a third-party application, a container, or a server that nobody remembers deploying.

The affected environments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team has identified Apache mod_php as particularly concerning.

For a 50- or 200-person company without a large security team, the difficult part may not be understanding the vulnerability. It may be answering five basic questions:

• Which internet-facing systems run PHP?
• Which versions are installed, including bundled and containerized versions?
• Who owns each system, and who can patch it?
• Have the vulnerable systems actually been updated and restarted?
• Has anything suspicious happened since the vulnerability became exploitable?

If those answers require days of Slack messages and spreadsheet archaeology, your company has an operational security gap.

What companies should do now

1. Find every affected PHP installation

Inventory production servers, development environments, containers, hosted applications, and third-party software that bundles PHP.

Don’t rely on the engineering team’s memory or a list of approved assets. Verify the running versions and configurations.

2. Patch to a fixed release

The PHP security releases addressing the two PHP2Shell vulnerabilities are:

• PHP 8.5.12 or later
• PHP 8.4.27 or later
• PHP 8.3.36 or later
• PHP 8.2.35 or later

These are the minimum fixed releases for the respective branches; use the latest supported security release available. PHP 8.1 and older branches are end-of-life and require migration to a supported version.

Verify the actual runtime, deploy the appropriate update, restart affected services where necessary, and confirm that the fix is active. Updating a development dependency doesn’t patch a production server. If you cannot patch immediately, restrict exposure and apply the PHP team’s recommended temporary mitigations. Disabling session upload-progress tracking can reduce risk, but it is not a substitute for installing the security update.

Important: A separate PHP issue, CVE-2026-115560, was disclosed shortly afterward. It involves a specific combination of session configuration and application behavior and is not fixed by the PHP2Shell releases above. Check the latest PHP security advisories rather than assuming one update resolves every newly disclosed PHP vulnerability.

3. Look for signs of compromise

Patching closes the known vulnerability. It does not prove that nobody exploited it before the update.
Review web-server, application, authentication, and endpoint telemetry for suspicious activity. Pay particular attention to unexpected child processes launched by PHP workers, unfamiliar files, new accounts, unusual outbound connections, and unexplained changes to services.

Don’t rely exclusively on matching a known malicious request. Exploitation can be difficult to identify from application logs alone, especially when the vulnerable behavior occurs before application code executes. If you find evidence of compromise, treat it as an incident: investigate the host, contain the threat, assess credential exposure, and follow an appropriate recovery process.

4. Turn the response into a repeatable process

PHP2Shell is one example of a recurring problem: a critical vulnerability is disclosed, and every organization must quickly discover its exposure, assign ownership, remediate affected systems, and document the outcome.
The companies that handle this well aren’t necessarily the ones with the largest security budgets. They are the ones that can answer those questions quickly and consistently.

Where EspressoLabs fits

EspressoLabs is building an AI-native IT, security, and compliance platform for small and midsize businesses. The goal is to make security operations more accessible without requiring every company to assemble an enterprise-sized IT and security team.

An incident like PHP2Shell illustrates why that matters.

1. Better visibility into your environment.
You cannot protect an asset you don’t know exists. An effective IT operations process starts with discovering systems, understanding their software and configuration, and identifying who owns them.

2. Faster remediation and verification.
Security teams need more than a vulnerability alert. They need a clear path from identifying an affected system to assigning remediation, tracking progress, and verifying that the change was completed. EspressoLabs can help streamline the IT operations and follow-through around that process.

3. Security that doesn’t stop at the endpoint.
Endpoint protection is important, but it cannot replace patching a vulnerable server-side runtime. Companies need complementary controls across infrastructure, identity, endpoint security, and application operations.

4. Evidence that security work actually happened.
For companies preparing for SOC 2 or maintaining an existing program, asset inventories, remediation records, assigned ownership, and documented follow-up can support a stronger vulnerability-management process. Those records do not, by themselves, establish SOC 2 compliance; controls must also be appropriately designed, implemented, and tested.

One important distinction: an IT management platform does not automatically patch every PHP installation, detect every exploit, or replace specialist incident response. Coverage depends on the systems integrated, permissions granted, and controls deployed. Internet-facing applications and runtimes still need explicit assessment and remediation.

The broader objective is to make these tasks part of routine operations rather than a fire drill every time a critical CVE hits the news.

The CTO’s PHP2Shell checklist

If I were responsible for technology at a 100-person company today, this would be my immediate checklist:

• Inventory all PHP runtimes and internet-facing applications.
• Identify affected versions, including bundled and containerized installations.
• Assign an owner and deadline to every affected asset.
• Patch to a fixed, supported PHP release and verify the running version.
• Review exposure during the pre-patch window for signs of compromise.
• Investigate suspicious processes, files, credentials, and outbound traffic.
• Review the latest PHP advisories for additional vulnerabilities, including CVE-2026-115560.
• Document remediation and improve the process for the next critical vulnerability.

The bottom line

PHP2Shell is a reminder that security isn’t just about buying the right tools. It’s about knowing what you operate, understanding where you’re exposed, and being able to act before a vulnerability becomes a breach.
If your team needs a spreadsheet, three meetings, and a week of investigation to discover which systems are affected by a critical vulnerability, the problem is bigger than PHP.

You need a better way to run IT and security.

EspressoLabs helps SMBs build a more manageable approach to IT, security, and compliance, without the cost and complexity of traditional enterprise operations.
If you’re also working toward SOC 2, explore our EspressoLabs SOC 2 offer to see how we can help make the journey more accessible.

Rate this:

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP "php2shell" (CVE-2026-109618/109619) is in CISA KEV and under attack: no-login code execution on PHP web servers. That includes the web UI on OPNsense, pfSense and Unraid, and PHP apps on Synology and QNAP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the vendor update), then restart PHP.

Also: Nextcloud's built-in Collabora CODE app (CVE-2026-110447), update to 26.4.303.

This week's issue:
https://patchorpass.beehiiv.com/p/patchorpass-2-php-php2shell-exploit-patch-now-plus-nextcloud-collabora?utm_source=mastodon&utm_medium=social&utm_campaign=issue-2

#infosec #homelab #selfhosted #nextcloud

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

Palo Alto Networks has issued warnings regarding active exploitation of PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, targeting management interfaces exposed directly to the internet.

Threat actors have been observed chaining these flaws with a Linux kernel escalation bug to compromise multiple servers across international environments.

Admins should review exposure and apply available patches or ve…

https://en.hacks.gr/proeidopoiisi-apo-tin-palo-alto-networks-gia-epitheseis-se-ergaleia-diktyoy/

#PaloAlto #PHP #Vulnerability #Security

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js

We've built a scanner to detect the exposure of your website to Node2Shell (CVE-2026-111497). We have emergency remediation measures ready if you need help - just reach out and our team can help.
https://nodejsguard.io/

I built a free, open source scanner for CVE-2026-111497 (Node2Shell / HTTP2Shell / Broccoli2Shell).

It checks the Brotli code inside binaries instead of trusting version numbers, so it finds copies hidden in Node.js, Python, .NET and Bun, and sees fixes that distros backported.

Read-only. For Kubernetes, container images and Linux hosts.

https://github.com/depuschm/brotli-k8s-scan

#Node2Shell #HTTP2Shell #Broccoli2Shell #InfoSec #CyberSecurity #NodeJS #Python #Kubernetes #OpenSource

Más actualizaciones para Broccoli 2Shell (HTTP2Shell - CVE-2026-111497), revisa TODOS tus dispositivos y aplicaciones

Vía: @seguinfo

https://blog.segu-info.com.ar/2026/10/mas-actualizaciones-para-broccoli.html

📰 CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV

📢 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-google-brotli-and-adobe-commerce-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups leveraged a BeyondTrust zero-day (CVE-2026-102764), and AI agents reportedly compromised live websites during testing (Oct 27-28, 2026). In technology, Amazon Business introduced new agentic AI tools. Geopolitically, Israel's elections are heading towards a coalition deadlock.

#Cybersecurity #AnonNews_irc #News

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).

On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.

"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise

This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/

“The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“”

https://thenewstack.io/php2shell-unpatched-php-servers/

#CyberSecurity #PHP #PHP2Shell #Programming #SoftwareDevelopment

PHP2Shell: One Vulnerable PHP Server Can Become Your Next Major Security Incident

The vulnerability is in PHP. The real failure may be in your IT operations.

On October 21, 2026, security researchers disclosed two critical vulnerabilities in PHP that can allow an unauthenticated attacker to execute code remotely. Within days, exploitation reports emerged, and CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Both received a CVSS 4.0 severity score of 9.2. PHP is widely deployed, making the potential attack surface enormous.

This isn’t a theoretical risk to put on next quarter’s security roadmap.
It’s an operational problem that needs attention now.

Sources: Wiz Research · Canadian Centre for Cyber Security

Why PHP2Shell is different

Most people hear about a vulnerability and immediately ask: Which application is affected?

PHP2Shell changes the conversation because the flaw sits in the PHP runtime itself, below application-level defenses.

The vulnerabilities involve memory-management errors that can leave PHP in an unsafe state when handling requests. Under the right conditions, an attacker can exploit that behavior to execute arbitrary code or expose sensitive process memory.

An attacker doesn’t necessarily need a valid account or a compromised employee laptop. A vulnerable, internet-facing PHP service may be enough.

And the implications go beyond the web application itself. Successful remote code execution can give an attacker a foothold to steal credentials, access sensitive files, establish persistence, or move toward other systems.

The critical detail: an application-level security check cannot reliably protect against a vulnerability that can be triggered before application code runs.

That is why PHP2Shell requires infrastructure-level remediation, not simply a code change in your application.

The uncomfortable question: Do you know where you’re running PHP?

PHP is not limited to the application your engineering team actively maintains.

It may be running in a WordPress installation, a legacy internal tool, a customer portal, a third-party application, a container, or a server that nobody remembers deploying.

The affected environments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team has identified Apache mod_php as particularly concerning.

For a 50- or 200-person company without a large security team, the difficult part may not be understanding the vulnerability. It may be answering five basic questions:

• Which internet-facing systems run PHP?
• Which versions are installed, including bundled and containerized versions?
• Who owns each system, and who can patch it?
• Have the vulnerable systems actually been updated and restarted?
• Has anything suspicious happened since the vulnerability became exploitable?

If those answers require days of Slack messages and spreadsheet archaeology, your company has an operational security gap.

What companies should do now

1. Find every affected PHP installation

Inventory production servers, development environments, containers, hosted applications, and third-party software that bundles PHP.

Don’t rely on the engineering team’s memory or a list of approved assets. Verify the running versions and configurations.

2. Patch to a fixed release

The PHP security releases addressing the two PHP2Shell vulnerabilities are:

• PHP 8.5.12 or later
• PHP 8.4.27 or later
• PHP 8.3.36 or later
• PHP 8.2.35 or later

These are the minimum fixed releases for the respective branches; use the latest supported security release available. PHP 8.1 and older branches are end-of-life and require migration to a supported version.

Verify the actual runtime, deploy the appropriate update, restart affected services where necessary, and confirm that the fix is active. Updating a development dependency doesn’t patch a production server. If you cannot patch immediately, restrict exposure and apply the PHP team’s recommended temporary mitigations. Disabling session upload-progress tracking can reduce risk, but it is not a substitute for installing the security update.

Important: A separate PHP issue, CVE-2026-115560, was disclosed shortly afterward. It involves a specific combination of session configuration and application behavior and is not fixed by the PHP2Shell releases above. Check the latest PHP security advisories rather than assuming one update resolves every newly disclosed PHP vulnerability.

3. Look for signs of compromise

Patching closes the known vulnerability. It does not prove that nobody exploited it before the update.
Review web-server, application, authentication, and endpoint telemetry for suspicious activity. Pay particular attention to unexpected child processes launched by PHP workers, unfamiliar files, new accounts, unusual outbound connections, and unexplained changes to services.

Don’t rely exclusively on matching a known malicious request. Exploitation can be difficult to identify from application logs alone, especially when the vulnerable behavior occurs before application code executes. If you find evidence of compromise, treat it as an incident: investigate the host, contain the threat, assess credential exposure, and follow an appropriate recovery process.

4. Turn the response into a repeatable process

PHP2Shell is one example of a recurring problem: a critical vulnerability is disclosed, and every organization must quickly discover its exposure, assign ownership, remediate affected systems, and document the outcome.
The companies that handle this well aren’t necessarily the ones with the largest security budgets. They are the ones that can answer those questions quickly and consistently.

Where EspressoLabs fits

EspressoLabs is building an AI-native IT, security, and compliance platform for small and midsize businesses. The goal is to make security operations more accessible without requiring every company to assemble an enterprise-sized IT and security team.

An incident like PHP2Shell illustrates why that matters.

1. Better visibility into your environment.
You cannot protect an asset you don’t know exists. An effective IT operations process starts with discovering systems, understanding their software and configuration, and identifying who owns them.

2. Faster remediation and verification.
Security teams need more than a vulnerability alert. They need a clear path from identifying an affected system to assigning remediation, tracking progress, and verifying that the change was completed. EspressoLabs can help streamline the IT operations and follow-through around that process.

3. Security that doesn’t stop at the endpoint.
Endpoint protection is important, but it cannot replace patching a vulnerable server-side runtime. Companies need complementary controls across infrastructure, identity, endpoint security, and application operations.

4. Evidence that security work actually happened.
For companies preparing for SOC 2 or maintaining an existing program, asset inventories, remediation records, assigned ownership, and documented follow-up can support a stronger vulnerability-management process. Those records do not, by themselves, establish SOC 2 compliance; controls must also be appropriately designed, implemented, and tested.

One important distinction: an IT management platform does not automatically patch every PHP installation, detect every exploit, or replace specialist incident response. Coverage depends on the systems integrated, permissions granted, and controls deployed. Internet-facing applications and runtimes still need explicit assessment and remediation.

The broader objective is to make these tasks part of routine operations rather than a fire drill every time a critical CVE hits the news.

The CTO’s PHP2Shell checklist

If I were responsible for technology at a 100-person company today, this would be my immediate checklist:

• Inventory all PHP runtimes and internet-facing applications.
• Identify affected versions, including bundled and containerized installations.
• Assign an owner and deadline to every affected asset.
• Patch to a fixed, supported PHP release and verify the running version.
• Review exposure during the pre-patch window for signs of compromise.
• Investigate suspicious processes, files, credentials, and outbound traffic.
• Review the latest PHP advisories for additional vulnerabilities, including CVE-2026-115560.
• Document remediation and improve the process for the next critical vulnerability.

The bottom line

PHP2Shell is a reminder that security isn’t just about buying the right tools. It’s about knowing what you operate, understanding where you’re exposed, and being able to act before a vulnerability becomes a breach.
If your team needs a spreadsheet, three meetings, and a week of investigation to discover which systems are affected by a critical vulnerability, the problem is bigger than PHP.

You need a better way to run IT and security.

EspressoLabs helps SMBs build a more manageable approach to IT, security, and compliance, without the cost and complexity of traditional enterprise operations.
If you’re also working toward SOC 2, explore our EspressoLabs SOC 2 offer to see how we can help make the journey more accessible.

Rate this:

🔒 New CSAF advisory published

VDE-2026-137
METTLER TOLEDO: PHP2Shell in Octo Image Server
CVE-2026-109618, CVE-2026-109619

OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.

HTML: https://certvde.com/en/advisories/VDE-2026-137/
CSAF JSON: https://mettler-toledo.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-137.json

#OT #Advisory

PHP2Shell: The 'End of the World' Vulnerability in PHP and How Major Companies Moved to Contain the Disaster

On October 21, 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the PHP core affecting every version since 5.4 and allowing unauthenticated rem...

🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/foss/php2shell-critical-vulnerability-response/

#PHP2Shell #Cybersecurity #PHP #Critical_Vulnerabilities #RCE #Linux #Red_Hat #Ubuntu #Cloudflare #gnutux

PHP2Shell Update: Still No Confirmed WordPress Compromises - What we've seen across over 5 million WordPress sites we protect.

As of Oct 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Here's what we've seen so far:

https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/

Palo Alto Networks has issued warnings regarding active exploitation of PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, targeting management interfaces exposed directly to the internet.

Threat actors have been observed chaining these flaws with a Linux kernel escalation bug to compromise multiple servers across international environments.

Admins should review exposure and apply available patches or ve…

https://en.hacks.gr/proeidopoiisi-apo-tin-palo-alto-networks-gia-epitheseis-se-ergaleia-diktyoy/

#PaloAlto #PHP #Vulnerability #Security

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security

An attacker targeted GitLab vulnerability CVE-2026-97229 (CVSS 10 RCE) on Alpine Linux's server. Alpine rebuilt GitLab and reset all passwords.

#GitLab #AlpineLinux #CVE202697229 #RCE #Ruby #Onigmo #ActiveExploitation #SupplyChainSecurity

https://securityonline.info/alpine-linux-gitlab-cve-2026-97229/?utm_source=mastodon&utm_medium=jetpack_social

🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw

Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution.
⠀
The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15.
⠀
An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account.
⠀
Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information.
⠀
Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable.
⠀
Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.

Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

Source: https://www.oracle.com/security-alerts/cpuoct2026.html

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite, according to threat intelligence firm Defused Cyber, The Hacker News reports. The flaw, CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library, was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

🚨 Rapid Response: CVE-2026-101767 (CVSS 9.8) could allow unauthenticated takeover of Oracle E-Business Suite.

Censys identified 2,246 exposed web properties. Exposure does not confirm vulnerability.

Patch and investigate: https://censys.com/advisory/cve-2026-101767/

#CensysARC #Cybersecurity #VulnerabilityManagement #Oracle #InfoSec

Oracle EBS, CVE-2026-101767 (CVSS 9.8): SQL injection non autenticata su /OA_HTML/AppsTCFServer (consentito di default), concatenabile a RCE come account applicativo. Colpisce 12.2.3-12.2.15; fix nella CPU di ottobre. Defused Cyber ha visto tentativi esplorativi sui decoy (27/10).

Senza patch: rimuovi il path dall'allowlist, limita il web tier. Caccia: POST non auth con GanttDataServer, oracle che lancia /bin/sh.

https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/

#cybersecurity #infosec #threatintel

What. The. Fuck.

https://access.redhat.com/security/cve/cve-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

🚨 NEW on CISA KEV — exploited in the wild

🛡 Broadcom VMware ESX
Broadcom VMWare ESX Insufficient Logging Vulnerability
CVE: CVE-2026-41709 · patch by 2026-11-11

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-41709
#cybersecurity #KEV #CVE #infosec

CISA adds Linux kernel vulnerability CVE-2026-46300, chained with PHP2Shell for root, and VMware ESX flaw CVE-2026-41709 to KEV. Patch now.

#CISA #KEV #LinuxKernel #PHP2Shell #VMware #ESX #CVE202646300 #ActiveExploitation

https://securityonline.info/cisa-kev-linux-kernel-php2shell-vmware-esx/?utm_source=mastodon&utm_medium=jetpack_social

Cisco zero-day: CVE-2026-76418 (8.6 high)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

#cisco #zeroday #eitw #CVE

Patch CVE-2026-76418 now. This high-severity Cisco Secure Firewall vulnerability is exploited in the wild to trigger SSL VPN DoS reloads on ASA and FTD.

#Cisco #CiscoASA #CiscoFTD #CVE202676418 #SSLVPN #ZeroDay #Cybersecurity #Vulnerability

https://securityonline.info/cisco-secure-firewall-vulnerability-exploited-ssl-vpn/?utm_source=mastodon&utm_medium=jetpack_social

Cisco Talos uncovered the KeyDrift malware UAT-11473 campaign exploiting CVE-2026-20127 to steal IPsec keys from Cisco SD-WAN controllers.

#KeyDriftMalware #UAT11473 #VoltTyphoon #CiscoTalos #CiscoSDWAN #CVE202620127 #CyberEspionage

https://securityonline.info/keydrift-malware-uat-11473-cisco-sd-wan/?utm_source=mastodon&utm_medium=jetpack_social