Today's outlook

CISA urges immediate PHP patching as "php2shell" flaws affect all web-serving installations

By The IT Security Desk

Good morning. CISA published an alert on 21 October urging organizations to immediately patch CVE-2026-109618 and CVE-2026-109619, which it says are known as "php2shell" and "allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests." CISA says it had not observed exploitation of these vulnerabilities as of the time of publication. Krebs on Security reports that working exploits exist and that nearly 70 percent of websites need to update their core software to fix the pair. CVE-2026-109618 carries a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8; CVE-2026-109619 carries CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1.

CISA says organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. CISA also advises identifying and inventorying systems running any version of PHP, noting that PHP is often a component of other software and its prevalence may not be directly observable. Match this against your estate.

The Hacker News reports that GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, affecting every version of the software going back to 7.0, released in 2014. The Hacker News notes that the October 12 update covered only some versions, so administrators who patched nine days earlier still need this fix.

BleepingComputer reports that CISA is warning attackers are actively exploiting four vulnerabilities in Plex Media Server, chained in what it calls "Plex2Shell" attacks to breach servers.

Three supply-chain and intrusion items rounded out the day. The Register reports a LiteLLM supply chain attack that harvests passwords and secrets and also delivers a RAT, and urges threat hunting now. BleepingComputer reports that hackers compromised Japan's Onamae Desktop Cloud VPS provider and installed malware on up to 26,739 customers' servers. BleepingComputer also reports that North Korean Lazarus hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery.

Google's Chrome release advisory lists four flaws fixed in Chrome 156.0.8078.47 — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328 and CVE-2026-113300 — each carrying a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6. Update to the listed release.