Skip to main content
Editorial illustration of a global cybersecurity crisis: a large glowing blue shield cracking apart with a small PHP emblem at its core

Weekly Top 10 Cyber Security Stories for 26/10/2026 to 01/11/2026 – PHP2Shell Breaks the Web

Steve V Other

The week was dominated by the PHP2Shell “Black October” crisis: two unauthenticated RCE flaws in PHP (CVE-2026-109618/109619, CVSS 9.2, CISA KEV) triggered a global surge of 50,000+ attacks, were chained with the Fragnesia bug to gain root, and hit PAN-OS, Cisco, and WordPress. Alongside it came the largest cryptocurrency theft in history (a $5.8 to 6.3B Binance breach traced to a compromised DevOps laptop, attributed to North Korea’s TraderTraitor cluster), a cluster of unauthenticated RCEs in security products (GitLab CVSS 10.0, Linux kernel TCP UAF CVSS 9.8, Ivanti, PAN-OS, Cisco SEG, BeyondTrust, FortiSIEM), and an eMudhra CA key compromise that forced emergency trust-store fixes across browsers and platforms.

1. PHP2Shell: CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2, CISA KEV)

  • Unauthenticated RCE in PHP (OOM corruption plus stale internal request state); affects PHP 5/6/7/8.
  • CISA added both to KEV on Oct 27; actively exploited in the wild.
  • “Black October”: global attack surge past 50,000; flaw detected by AI teams (OpenAI, Wiz).
  • Chained with Fragnesia (CVE-2026-46300, KEV Oct 28) to implant webshells and run as root; a suspected China-nexus actor rooted 25 servers across US, Japan, Taiwan, and South Korea, including 3 US government-affiliated systems, with confirmed Active Directory credential extraction.
  • Upstream patched Oct 21 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35); PAN-OS and many Cisco products affected.

2. Binance $5.8 to 6.3B hack (largest cryptocurrency theft in history)

  • World’s largest crypto exchange linked the theft to a DevOps engineer’s compromised laptop (valid credentials, T1078 class).
  • Figures: $5.6B (on-chain) to about $6.3B (Binance).
  • Attribution: North Korean “TraderTraitor” cluster (preliminary, blockchain analysts).
  • No public post-mortem as of Nov 1.

3. GitLab CVE-2026-97229 (CVSS 10.0, CISA KEV)

  • Insufficient regex validation in Onigmo (the Ruby regex engine) gives unauthenticated RCE via a crafted CI/CD configuration.
  • Actively exploited against Alpine Linux’s gitlab.alpinelinux.org (Oct 20 to 26); CISA KEV Oct 30.
  • Patching trap: the fix is a patch to the Ruby bundled in GitLab’s official packages; Alpine’s custom container used separately installed standard Ruby, so upgrading GitLab alone did NOT remediate it.
  • Affects any program compiling regular expressions from untrusted input, not only GitLab.

4. Linux kernel TCP UAF: CVE-2026-98432 (CVSS 9.8)

  • Race-condition use-after-free in the IPv4 TCP request path (IP-options memory used after free); kernels back to 4.4 affected.
  • Unauthenticated remote root on MPTCP servers; an Anthropic internal research model wrote a working exploit in about 53 minutes (memory leak, KASLR bypass, control-flow hijack, arbitrary root command).
  • RHEL-based kernels and Ubuntu still unpatched as of Oct 30; Go 1.24+ enables MPTCP on listening sockets by default (silently expands the attack surface).

5. Ivanti Connect Secure CVE-2026-104935 (CVSS 8.6, CISA KEV)

  • Unauthenticated arbitrary command execution (auth bypass by spoofing); KEV Oct 13; exploited prior to disclosure.
  • A 3-vulnerability zero-day chain (auth bypass plus RCE plus an unpatched EoP) gave unauthenticated root on a fully (at the time) patched 22.8R2.4 appliance; credential theft and data exfiltration.

6. PAN-OS CVE-2026-0322 (CVSS 8.6, CISA KEV)

  • RCE in the management interface (CWE-94); KEV (FCEB deadline Oct 17); actively exploited from 3 US IPs.
  • PA-Series, VM-Series, Panorama (virtual) and M-Series affected; post-exploitation: disable logging, lateral movement.

7. Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8, CISA KEV)

  • Unauthenticated arbitrary file write (CWE-23 relative path traversal) gives root command execution; KEV Oct 14; actively exploited.
  • Same-day hardening release: umbrella CVEs 76440/76441/20353/76443 (9.8 each) plus 76442 (7.5).

8. BeyondTrust CVE-2026-102764 (auth bypass, zero-day)

  • Actively exploited since late August (zero-day); unprivileged remote file operations on unpatched appliances; affects Remote Support 26.2.3 or earlier.
  • Abused by China-nexus Armory Castle (UNC5221) / Warp Panda; 1,400+ instances exposed online; 75% of Fortune 100 are customers.

9. FortiSIEM CVE-2026-106173 (CVSS 9.4)

  • Unauthenticated RCE via path traversal plus null-byte injection in the gRPC SendQueryResult() service; overwrites a Redis health-check shell script run every 60 seconds by cron, giving root-level execution context.
  • Public exploit PoC released Oct 20; fixed in FortiSIEM 7.5.1.

10. eMudhra CA key compromise (trust-store crisis)

  • Private keys of 8 eMudhra intermediate CA certificates compromised (one key was literally the value “4”); confirmed by Mozilla and the Chrome Root Program.
  • Emergency trust-store fixes across Chrome (CRLSet, blocked within 100 minutes), Firefox (OneCRL), Go, NSS, certifi, and others.
  • Any holder could issue fraudulently trusted TLS and code-signing certificates; non-browser clients (API clients, containers, build pipelines, embedded devices) are the gap until their trust stores update.

Also notable (near-misses)

  • WordPress core CVE-2026-119977 (CVSS 8.1, unauthenticated RCE, 62,969 exploitation attempts in 24 hours, fixed in 7.1.4).
  • Windows Netlogon CVE-2026-41089 (CVSS 9.8, unauthenticated RCE on domain controllers, actively exploited).
  • BlackX UEFI bootkit (APT41, Secure Boot bypass on patched Windows systems missing revocations, diplomatic targets in Central Asia).
  • Claude Code VS Code extension trojanized via the Cursor marketplace (persistent SSH backdoor, up to 5,000 users, about an 11-hour window).
  • Drupal Commerce CVE-2026-118539 (access bypass, actively exploited, financial impact).
  • Microsoft October 2026 Patch Tuesday (1,411 CVEs, 3 zero-days).

Weekly digest of the ten most critical security findings from the daily briefings covering 2026-10-26 to 2026-11-01. Ranked by active exploitation and CISA KEV status, severity, unauthenticated or remote code execution, breadth of impact, and patch availability. All facts are drawn from the cited daily briefings.

References