All posts

PHP php2shell flaws now exploited in the wild

October 26, 2026 · Senserva Trustworthy AI

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

The Senserva daily security read, October 26, 2026

PHP php2shell RCE now exploited in the wild

The two critical PHP php2shell flaws from last week's emergency release, CVE-2026-109618 and CVE-2026-109619, are now being exploited in the wild per BleepingComputer. Both are unauthenticated remote code execution with a CVSS of 9.8, and they are the top two hot movers today. They also dominate practitioner chatter, with the pair pulling well over a thousand Hacker News points combined.

This matters beyond standalone PHP installs. Palo Alto Networks confirmed on October 24 that these PHP RCE vulnerabilities impact PAN-OS and multiple network products. If you run PAN-OS, treat this as an edge-device exposure, not an application-tier problem. CERT-EU also issued advisory 2026-018 covering the critical PHP vulnerabilities.

Confirmed exploitation changes the priority from patch soon to patch now. Apply the emergency PHP releases and follow Palo Alto's guidance for affected products immediately.

The Brotli node2shell and http2shell chain keeps widening

A separate decompression flaw, CVE-2026-111497, is spreading across ecosystems. It started as a Node.js RCE through Brotli-compressed data (node2shell) and now extends beyond HTTP into .NET, FFmpeg, ClickHouse, and Apache Arrow under the http2shell label. SecurityWeek reports the Brotli flaw is triggering patching across Microsoft, Node.js, and Python packages.

Microsoft shipped out-of-band security updates for the Brotli and .NET tarballs issue, and Cloudflare pushed an emergency WAF ruleset update in response. If you build on any of these runtimes or libraries, inventory where Brotli decompression touches untrusted input and patch to the fixed versions.

KEV-listed and ransomware-linked movers to check

No new CISA KEV additions came through since October 24, but CISA did add single vulnerabilities to the catalog on October 23. Several already-listed, ransomware-linked criticals remain the highest-risk open items if you have not patched them:

  • CVE-2026-63077, JetBrains TeamCity deserialization, CVSS 9.8, KEV and ransomware-linked, EPSS 0.94.
  • CVE-2026-35273, Oracle PeopleSoft PeopleTools missing authentication, CVSS 9.8, KEV and ransomware-linked.
  • CVE-2026-41940, WebPros cPanel and WHM, CVSS 9.8, KEV and ransomware-linked, EPSS 0.99.
  • CVE-2026-0257, Palo Alto Networks PAN-OS authentication bypass, CVSS 9.1, KEV and ransomware-linked.
  • CVE-2025-55182, Meta React Server Components RCE, CVSS 10, KEV and ransomware-linked, EPSS near certain.

Microsoft Authenticator token theft and other items

Cyber Security News reports a Microsoft Authenticator flaw, CVE-2026-80097, that lets malicious Android apps steal account tokens with zero permissions. If you rely on Authenticator for Entra ID sign-in, track that fix and push the updated app to managed devices.

Two more worth noting: a critical Okta Access Gateway flaw, CVE-2026-115547, lets attackers with admin access run system commands, and Microsoft detailed the LiteLLM 1.107.0 supply chain compromise that stole credentials through Python startup hooks. On the Windows side, the heavy cumulative updates this cycle, including KB5046616 for Windows Server 2022 with 34 CVEs and KB5046617 for Windows 11 24H2 with 33 CVEs, carry KEV-listed fixes. Also plan for Windows Server 2016 reaching end of support in January.

Do this first

Work in order of confirmed exploitation and KEV status.

  • Patch PHP php2shell (CVE-2026-109618, CVE-2026-109619) now; apply Palo Alto's guidance for affected PAN-OS and network products.
  • Apply Microsoft's out-of-band Brotli and .NET updates and patch Node.js and Python packages affected by CVE-2026-111497.
  • Close the ransomware-linked KEV entries above, starting with any TeamCity, PeopleSoft, cPanel, PAN-OS, and React Server Components you run.
  • Update Microsoft Authenticator to address CVE-2026-80097 and review LiteLLM usage after the supply chain compromise.
  • Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions as they land.

Sources

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-26.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.

All posts

Patching across Intune, Windows Autopatch, Defender, Azure, and your endpoint managers: see Senserva patching in action.