CISA urges immediate PHP patching as "php2shell" flaws affect all web-serving installations
A pair of unauthenticated remote code execution flaws in PHP topped a day that also brought a GitLab fix reaching back to 2014 and active exploitation of Plex Media Server.
CISA published an alert on 21 October urging organizations to immediately patch CVE-2026-109618 and CVE-2026-109619, which it says are known as "php2shell" and "allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests." CISA says it had not observed exploitation of these vulnerabilities as of the time of publication. Krebs on Security reports that working exploits exist and that nearly 70 percent of websites need to update their core software to fix the pair. CVE-2026-109618 carries a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8; CVE-2026-109619 carries CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1.
CISA says organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. CISA also advises identifying and inventorying systems running any version of PHP, noting that PHP is often a component of other software and its prevalence may not be directly observable. Match this against your estate.
The Hacker News reports that GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, affecting every version of the software going back to 7.0, released in 2014. The Hacker News notes that the October 12 update covered only some versions, so administrators who patched nine days earlier still need this fix.
BleepingComputer reports that CISA is warning attackers are actively exploiting four vulnerabilities in Plex Media Server, chained in what it calls "Plex2Shell" attacks to breach servers.
Three supply-chain and intrusion items rounded out the day. The Register reports a LiteLLM supply chain attack that harvests passwords and secrets and also delivers a RAT, and urges threat hunting now. BleepingComputer reports that hackers compromised Japan's Onamae Desktop Cloud VPS provider and installed malware on up to 26,739 customers' servers. BleepingComputer also reports that North Korean Lazarus hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery.
Google's Chrome release advisory lists four flaws fixed in Chrome 156.0.8078.47 — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328 and CVE-2026-113300 — each carrying a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6. Update to the listed release.
Sources
- The Register — PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Help Net Security — Chrome puts insecure sites behind a permission prompt
- BleepingComputer — Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
- The Record — Meta on the spot for $25 billion under New Mexico privacy ruling
- The Hacker News — Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- SecurityWeek — Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- Krebs on Security — Widespread PHP Flaw May Cause Many Site Outages Today
- CISA — Critical Vulnerabilities in PHP Require Immediate Patching
- Schneier on Security — Workshop on Economics and Information Security (WEIS) Archive
- BleepingComputer — Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
- BleepingComputer — Lazarus hackers use post-quantum cryptography for malware delivery
- The Record — Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
- BleepingComputer — CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
- The Register — LiteLLM supply chain attack hoovers up passwords and secrets