Vulnerability on Christoph Kemetmüller

CVE-2026-109618 - PHP2Shell a week on: crashes on the web, root on PAN-OS

Fri, 30 Oct 2026 23:04:02 +0100

A week after the PHP2Shell patches, Hunt.io went through its open-directory captures and counted 616 files of exploit kits, cloned PoCs, scanners and post-exploitation tooling for CVE-2026-109618 and CVE-2026-109619. Confirmed shells so far landed on honeypots and sensors; on the open web the heap chain mostly dies in memory exhaustion. One operator aimed it at a national government in Eastern Europe, got a crash, and went in through a different bug instead.

Palo Alto’s PAN-OS is the exception: its management interface runs the same PHP 8.0.30 build on every unpatched box, which turns a flaky heap exploit into a calibrated, repeatable one. Hunt.io found a PAN-OS adaptation of the chain in an exposed directory of the operator behind the 24 rooted firewalls from the earlier post, next to the AI tooling that whittled 19,000 firewalls down to 240 targets. The exploit itself is hand-calibrated work; nothing in the capture shows a model writing it. Turns out a software monoculture is an exploit developer’s best friend.

Four other hosts share a byte-identical ASLR-bypass kit whose lab logs end in uid=33(www-data) against PHP 8.2.34 and 8.4.26. Fixed are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and PAN-OS management interfaces belong off the internet.

CVE-2026-109618 - PHP RCE CVEs leaked before the patch was out

Thu, 29 Oct 2026 18:00:00 +0100

On 20 October Kevin Beaumont noticed two PHP CVE IDs circulating before any patch existed, and by that evening Will Dormann had spotted a Calif video of a proof of concept called php2shell working against WordPress. The PHP Foundation’s account fills in the rest: no technical details leaked, just a wrong release time and a wrong CVSS of 10.0 (it is 9.2), but the early pre-announcement led Calif to publish that video by mistake, Chainguard shipped patched images more than six hours before the embargo lifted, and the release was pulled forward a day to 21 October. The advisory describes two unauthenticated RCEs: hitting memory_limit at the wrong moment leaves half-initialised request data that cleanup treats as valid (CVE-2026-109618), and a fatal error can leave global state pointing into a previous request’s freed memory (CVE-2026-109619), with the first triggerable on Apache with mod_php before any application code runs. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; the stopgaps Dormann passed on (memory_limit=-1, session.upload_progress.enabled=0, a small post_max_size) each close only specific paths. The Foundation is also unusually frank that the OOM problem was first spotted in 2024 and the fix stalled for months, “a structural failure”, until Calif and OpenAI reported the same root cause on 11 August. Meanwhile a pre-patch “weaponized” write-up has since demoted its own bug to a non-RCE CVSS 5.3, proving that leaked CVE numbers attract confident guesses long before they attract facts.

Since the release, Arctic Wolf lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected too, and saw wide scanning but only a few attempts to fetch second-stage payloads from a host serving the Mirai-derived Potassium botnet. The Delft Threat Intelligence Lab’s live tracker counted 66,494 requests from 645 IPs by 27 October, 47,900 of them probes only. A Show HN challenge put a bitcoin key worth about $502 on a server running pre-patch PHP 8.4.26, and KillaBoi got it out on 25 October. The released PoC lands about seven runs in ten in a lab; the stored key did not derive the prize address, and the operator paid out anyway. Dream Group says a custom PHP2Shell build, chained with the Fragnesia kernel privilege escalation (CVE-2026-46300), rooted 24 Palo Alto Networks PAN-OS firewalls with internet-facing management interfaces in the US, Japan, Taiwan and South Korea, plus the internal firewall management server of a US government-affiliated organisation, from which the attacker went after its Active Directory. Per Dream, Unit 42 has verified the tooling and tracks the activity as CL-UNK-1280, a Chinese-speaking actor in UTC+8, while Dream’s own “AI-assisted” label rests on Claude Code and a DeepSeek and Kimi driven offensive platform (aiscan) found on the attacker’s infrastructure, plus the scripts’ commenting style.

Update 2026-10-30: A week on, Hunt.io’s look at the tooling finds php2shell mostly crashing on the open web, with PAN-OS as the exception.

CVE-2026-110264 - Unauthenticated GitLab RCE via a crafted .org file

Thu, 22 Oct 2026 21:30:00 +0200

GitLab’s October 21 patch release fixes CVE-2026-110264: rendering a crafted .org file lets an unauthenticated attacker run code on the server, CVSS 10.0. Ikesan’s analysis traces it to Onigmo, Ruby’s regex engine. The #+TODO: keywords of an Org mode file go unescaped into Regexp.new, and an integer overflow while compiling that pattern ends with commands running as the git user. Every self-managed CE/EE release since 7.0 is affected; GitLab.com and Dedicated are already patched.

The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. 18.10 and older get no fix, so those instances have to follow the upgrade path to 18.11.13 or later. If you just installed the October 12 releases (19.4.2, 19.3.5, 19.2.8), congratulations, you get to do it again. The bug is the third GitLab regex find from joaxcar via HackerOne, and GCVE already links a proof-of-concept repository, so this one shouldn’t wait for the next maintenance window.