PHP php2shell: two unauthenticated RCE flaws got an emergency release
The headline for the last two days is the PHP emergency release on 2026-10-21 for CVE-2026-109618 and CVE-2026-109619, both rated Critical at CVSS 9.8 and both unauthenticated remote code execution. These affect millions of web servers, and they are the top two hot movers right now. CVE-2026-109618 is also the most-discussed vulnerability on Hacker News, with 920 points across 13 stories, and CVE-2026-109619 adds another 700 points across 8 stories.
Neither is on the CISA Known Exploited Vulnerabilities list yet, and neither is tagged ransomware-linked in the facts. But there is already a public scanner that checks your hosts for both, so the window between public patch and real attempts is short. If you run PHP anywhere on an internet-facing server, apply the emergency release now and scan to confirm you are not exposed.
China-linked actor used ARTEX AI against 2,250 Microsoft 365 tenants
Microsoft attributed a ConnectWise supply chain compromise to a Chinese state actor, tracked as Storm-0940, that used ARTEX agentic AI to drive the campaign. The reporting says roughly 2,250 Microsoft 365 tenants were targeted after the ConnectWise breach. This matters directly if you manage Microsoft 365, because the downstream target was tenant access, not just the vendor.
Related reporting the same window is worth pairing with this: attackers are abusing legitimate platforms to send phishing that passes authentication checks, and China-linked operators are turning trusted Windows applications into backdoors to steal credentials. Treat any ConnectWise-related access and any unusual OAuth or application consent in your tenant as a priority review item.
KEV CVEs that are ransomware-linked right now
No new KEV entries landed in this window, but several active movers are already on KEV and tagged ransomware-linked, which is the line between patch eventually and patch now. CVE-2026-63077 in JetBrains TeamCity (CVSS 9.8, EPSS 0.8957), CVE-2026-35273 in Oracle PeopleSoft PeopleTools (CVSS 9.8, EPSS 0.9668), and CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.9853) are all KEV-listed and ransomware-associated.
Older KEV flaws with very high exploitation probability are also in the mix: CVE-2015-3306 in ProFTPD (CVSS 10, EPSS 0.995), CVE-2016-3081 in Apache Struts, and CVE-2015-5477 in ISC BIND. If any of these run in your estate, they are not theoretical.
Other exploitation worth logging
BleepingComputer reports Arista patched a VeloCloud Orchestrator zero-day that is being exploited in attacks. Cyber Security News reports attackers are actively exploiting a Siemens Software Center flaw, CVE-2026-110936, in ClickFix malware campaigns. There is also a 12-year-old GitLab self-managed RCE (CVE-2026-110264) and a critical Signal flaw (CVE-2026-113380) that can keep mic and camera live after a call ends.
CISA also published a large batch of Siemens ICS advisories on 2026-10-22 covering WinCC, SIMATIC S7-1500, RUGGEDCOM, and more. Operational technology teams should pull the specific advisories for the products they run.
Do this first
Work the items with the shortest fuse before you touch anything routine.
- Apply the PHP emergency release for CVE-2026-109618 and CVE-2026-109619, then run the public scanner against your hosts.
- Review ConnectWise-related access and recent OAuth consent in Microsoft 365, given the Storm-0940 ARTEX campaign against 2,250 tenants.
- Patch the ransomware-linked KEV CVEs you actually run: TeamCity CVE-2026-63077, PeopleSoft CVE-2026-35273, cPanel CVE-2026-41940.
- Check the Critical Windows rollups carrying KEV content, including KB5046616 for Windows Server 2022 and KB5046617 for Windows 11 24H2.
- Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions.
Sources
- Help Net Security: New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 (2026-10-22)
- Cyber Security News: PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers (2026-10-21)
- Cyber Security News: China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach (2026-10-22)
- The Record: Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents (2026-10-22)
- Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (2026-10-21)
- BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (2026-10-22)
- Cyber Security News: Hackers Actively Exploiting Siemens Software Center Flaw in ClickFix Malware Attacks (2026-10-22)
- Cyber Security News: 12-Year-Old GitLab Vulnerability Allows Remote Code Execution on Self-Managed Server (2026-10-22)
- Cyber Security News: Critical Signal Vulnerability Could Keep Your Mic and Camera Live Even After Hang Up (2026-10-22)
- CISA Cybersecurity Advisories: Siemens WinCC (2026-10-22)
- CISA Cybersecurity Advisories: Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (2026-10-22)
- CISA Cybersecurity Advisories: Siemens RUGGEDCOM APE1808 Devices (2026-10-22)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-23.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.