PHP2Shell RCE and four fresh KEV adds to patch now

PHP2Shell unauthenticated RCE is the story to act on

CISA warned that the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are being actively exploited in attacks. Both are rated Critical at CVSS 9.8 with an EPSS at the top of the scale, both are now on the KEV catalog, and both trace back to the PHP emergency release of 2026-10-21. These are unauthenticated remote code execution flaws, which means anyone who can reach a vulnerable PHP endpoint can run code without credentials.

The exploitation is not theoretical. The two CVEs also lead the public buzz, with CVE-2026-109618 pulling 1,428 points across 16 stories on Hacker News and OffSec already publishing a free lab around the flaw. If you run PHP anywhere internet-facing, apply the emergency release now and hunt for signs of webshell drops.

Four new KEV adds since October 27

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog over the last two days. Treat KEV listing as the line between patch eventually and patch now.

Google Brotli CVE-2026-111497 is the one to watch beyond PHP. It is a buffer overflow in the Brotli decoder, Critical at CVSS 9.8, and it is driving its own set of attacker activity under names like HTTP2Shell and Node2Shell. Sweet Security is offering free virtual patching for affected organizations while you roll out fixes, but virtual patching is a stopgap, not a substitute for updating.

• CVE-2026-111497 Google Brotli, CVSS 9.8, buffer overflow in the decoder, added 2026-10-27
• CVE-2026-48356 Adobe Commerce and Magento, CVSS 9.3, unrestricted file upload, added 2026-10-27
• CVE-2026-46300 Linux Kernel, CVSS 7.8, missing variable initialization, added 2026-10-28
• CVE-2026-41709 VMware ESX, CVSS 2.7, insufficient logging, added 2026-10-28

Other hot movers with ransomware links

Two items on the hot list carry explicit ransomware association. JetBrains TeamCity CVE-2026-63077, a deserialization of untrusted data flaw at CVSS 9.8, and Oracle PeopleSoft Enterprise PeopleTools CVE-2026-35273, a missing authentication flaw at CVSS 9.8 with an EPSS near 0.97, are both KEV-listed and both ransomware-linked. If you run either product, move them to the front of the queue.

Arista VeloCloud Orchestrator CVE-2026-114625, a SQL injection at CVSS 9.9, and Collabora Online CVE-2026-110447 round out the KEV-listed Critical movers.

What the press adds

Microsoft shipped emergency Windows updates to block compromised eMudhra certificates, so expect certificate trust changes alongside your normal patch cycle. Veeam patched a Critical authorization bypass in Backup and Replication, CVE-2026-108142, worth prioritizing given how often backup servers are targeted before ransomware deployment.

On the identity side, Microsoft is again urging Entra ID admins to migrate users to passkeys. FortiBleed 2.0 reportedly exposed thousands of Fortinet VPN and Active Directory credentials in misconfigured deployments, and SecurityWeek reports attackers probing a fresh Oracle EBS flaw, CVE-2026-101767. Volt Typhoon is also being tracked hiding zero-day activity behind a framework called Silent Train.

Do this first

Work from exploitation evidence, not CVSS alone.

• Apply the PHP emergency release for CVE-2026-109618 and CVE-2026-109619 on all internet-facing PHP, then hunt for webshells.
• Patch Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356; use virtual patching only to buy time.
• Prioritize the ransomware-linked JetBrains TeamCity CVE-2026-63077 and Oracle PeopleSoft CVE-2026-35273.
• Patch Veeam CVE-2026-108142 and apply the eMudhra certificate blocking update.
• Confirm your own Microsoft patch state. This month's KEV-flagged cumulative updates include KB5046616 for Windows Server 2022 with 34 CVEs and KB5046617 for Windows 11 24H2 with 33 CVEs. Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker follows the daily KEV additions.

Sources

• Cyber Security News: CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks (2026-10-28)
• Cyber Security News: Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost (2026-10-28)
• Cyber Security News: Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns (2026-10-28)
• Cyber Security News: OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery (2026-10-28)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-28)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-27)
• Cyber Security News: Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability (2026-10-28)
• Cyber Security News: Microsoft Releases Emergency Windows Updates to Block Compromised eMudhra Certificates (2026-10-28)
• BleepingComputer: Microsoft urges Entra ID admins to migrate users to passkeys (2026-10-28)
• SecurityWeek: Hackers Start Probing Fresh Oracle EBS Vulnerability (2026-10-28)
• Cyber Security News: FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations (2026-10-28)
• BleepingComputer: Volt Typhoon hides zero-day attacks using 'Silent Train' framework (2026-10-28)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-29.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.