PHP php2shell exploit code is public and being abused
The emergency PHP release of 2026-10-21 covered two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.8. As of 2026-10-23, exploit code is public and attackers are using it to try to deploy botnet malware. These are the top two hot movers of the day and the loudest items in the broader community discussion, with CVE-2026-109618 and CVE-2026-109619 drawing the most attention on Hacker News (buzz).
This is not an abstract library problem. Palo Alto Networks confirmed on 2026-10-24 that the PHP RCE flaws affect PAN-OS and multiple network products, so if you run Palo Alto gear you need to track their guidance alongside your PHP footprint. CERT-EU also issued advisory 2026-018 on the PHP vulnerabilities. Help Net Security's week in review frames the PHP patches and the exploited Palo Alto GlobalProtect VPN flaw as the dominant story of the week.
Neither php2shell CVE is on the KEV catalog yet, but with public exploit code and active botnet deployment, treat them as patch-now. Inventory where PHP runs, including inside appliances and vendor products, and apply the emergency updates.
Two new CISA KEV additions on October 23
CISA added two actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-10-23. The first is CVE-2026-110447, an OS command injection flaw in the Collabora Online built-in CODE Server. The second is CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator rated CVSS 9.9.
The VeloCloud add is notable because SecurityWeek reports this is the third VeloCloud Orchestrator zero-day exploited in four months. If you operate VeloCloud Orchestrator, this is a recurring target and warrants priority patching plus a hard look at exposure and logs. Neither new KEV entry is marked ransomware-linked, but KEV placement means they are confirmed exploited in the wild, so the federal remediation clock applies and so should yours.
Ransomware-linked flaws still topping the hot list
Several older KEV entries remain high on the exploitation radar and are flagged ransomware-linked: JetBrains TeamCity deserialization (CVE-2026-63077, CVSS 9.8), Oracle PeopleSoft PeopleTools missing authentication (CVE-2026-35273, EPSS 0.9668), WebPros cPanel and WHM (CVE-2026-41940, EPSS 0.9853), Palo Alto PAN-OS authentication bypass (CVE-2026-0257, EPSS 0.9689), Meta React Server Components RCE (CVE-2025-55182, CVSS 10), and ConnectWise ScreenConnect path traversal (CVE-2024-1708). If any of these are open in your environment, that is the difference between patch eventually and patch now.
The Patch Tuesday Windows updates are also still in play. KB5046616 for Windows Server 2022 carries 34 CVEs, KB5046617 for Windows 11 24H2 ARM64 carries 33, and the Windows 10 bundles KB5046615 and KB5046612 carry 28 and 25, all rated critical and all KEV-linked.
Microsoft 365 identity and the rest of the day
Help Net Security reports that Microsoft 365 accounts at 79 organizations were compromised with no passwords needed, using stolen sessions. That is a reminder that token theft bypasses password controls, so session and conditional access hygiene matter as much as patching. Microsoft also detailed the LiteLLM 1.107.0 supply chain compromise that stole credentials through Python startup hooks.
Other items worth noting: Cisco Expressway critical RCE CVE-2026-76466, an emergency Oracle Java update for CVE-2026-91403, active exploitation of Citrix NetScaler CVE-2026-88771 to drop web shells, the Okta Access Gateway flaw CVE-2026-115547, and the Node2Shell Node.js RCE CVE-2026-111497.
Do this first
Prioritize based on confirmed exploitation and your own exposure:
- Inventory PHP everywhere, including appliances and Palo Alto products, and apply the 2026-10-21 emergency updates for CVE-2026-109618 and CVE-2026-109619 now that exploit code is public.
- Patch the two new KEV adds: Collabora Online CODE Server CVE-2026-110447 and Arista VeloCloud Orchestrator CVE-2026-114625, and review VeloCloud logs given the repeat zero-day history.
- Clear the ransomware-linked KEV backlog: TeamCity, PeopleSoft, cPanel, PAN-OS, React Server Components, and ScreenConnect. Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft tracker follows KEV adds daily.
- Review Microsoft 365 session and conditional access controls after the stolen-session compromises at 79 organizations. You can run a complete audit of your Microsoft 365, Intune, Defender, and Entra ID environment with Senserva's free unlimited audits.
Sources
- Help Net Security: Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw (2026-10-25)
- Cyber Security News: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products (2026-10-24)
- Cyber Security News: Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware (2026-10-23)
- SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months (2026-10-23)
- Help Net Security: Microsoft 365 accounts compromised at 79 organizations, no passwords needed (2026-10-23)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-23)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-23)
- CERT-EU: 2026-018: Critical Vulnerabilities in PHP (2026-10-23)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-25.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.