This week brought the usual exploited edge appliance, a BeyondTrust Remote Support zero-day in use since August. The different news came from PHP, which shipped fixes for two critical PHP2Shell bugs the morning after an exploit video leaked, and from Terra Security, whose data shows 2.3% of this year's GitHub security fixes were later reported incomplete or bypassable, per The Register. And then there's eMudhra, a certificate authority whose private keys turned out to be guessable.
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday, October 21, for CVE-2026-109618 and CVE-2026-109619, two bugs rated CVSS v4 9.2 that "can allow unauthenticated remote code execution." In the first, out-of-memory handling interrupts PHP while request data is only partly initialized, and cleanup then treats the bad data as valid. In the second, request state outlives its freed memory and the next request on the same worker can use it. PHP rates the risk highest for mod_php, where it describes "a demonstrated exploit" that fires before any application code runs.
watchTowr told CyberScoop the fixes had been embargoed for Thursday, and PHP moved the release up a day, to Wednesday. Overnight, before it shipped, Kirill Firsov shared a video of the exploit chain and credited LCFR and Calif.io. Wiz Research found the first bug on August 19 with its Wiz Atlas tooling, Gemini 4 Argon and GPT-5.6 Sol, reported it on August 24, and credits Gemini with "an invaluable contribution" to finding it. PHP's two advisories credit a Wiz researcher alongside other outside reporters, lcfr-hax among them.
Exploitation is still unsettled. Cloudflare CTO Dane Knecht said Wednesday the company was "seeing early attacks emerging" and pushed firewall rules to every plan, free accounts included, which Cloudflare called "a stopgap," per CyberScoop. PHP's release announcement doesn't mention exploitation, and CISA's KEV catalog didn't list either CVE as of its Wednesday morning update.
PHP 7.4 through 8.1 get only source backports, so a server on one of those needs a self-built PHP or a package from its distribution or LTS vendor. Until then, session.upload_progress.enabled=0 blocks only the confirmed paths for CVE-2026-109619, and PHP says no complete mitigation exists.
Terra Security's Oren Yomtov went through every published CVE record and GitHub-reviewed advisory for fixes that shipped and were later reported incomplete or bypassable. From 2019 to 2025, about 0.2% of GitHub security fixes needed a follow-up advisory for a failed patch within 90 days, and in 2026 the figure is 2.3%, The Register reports from Terra's data. The year isn't over, Terra gives no raw counts, and its own post calls the rise about eightfold. Fixes for bugs on CISA's KEV list were later reported broken about four times as often as the same vendors' other fixes.
Broken security fixes cluster in a few bug classes. Prototype pollution is about 11 times as common among broken-fix CVEs as among all CVEs, and SSRF about 4.6 times, The Register reports, while Terra's post calls both "many times overrepresented." Terra notes these are classes where the usual fix is a reject-list of inputs (hostnames, paths, object keys). In the Linux kernel, 3.2% of CVEs were introduced by the fix for another CVE, rising to about 10% in fs/smb and net/sched. Microsoft's February fix for CVE-2026-21510, a Windows Shell bypass APT28 had exploited, was still bypassable when Akamai looked, and the April fix for what Akamai found, CVE-2026-32202, went on KEV as well.
Cisco Talos counted 1,415 Microsoft advisories in October and 975 in September, against a pre-June average of about 100 a month, with published CVEs up 105% year over year and KEV entries up 37%. Only three of September's 975 saw in-the-wild exploitation, and Kri Dontje and Yves Younan think the count may level off once AI works through the backlog in old code, noting that "disclosure does not equal weaponization." Terra doesn't blame AI for the broken fixes. Its only AI line is a belief that a growing share of attacker effort "and AI tokens" goes into finding bypasses.
What would have sent anyone back to CVE-2026-21510, when Microsoft's April advisory for CVE-2026-32202, the bypass of its fix, never mentions it? A reject-list fix is written to block the reported proof of concept, so rerunning that payload proves little, and Terra's advice is to try the variants the advisory never listed.
On Saturday, October 17, a researcher credited only as Wayne sent Mozilla, Chrome, Apple, Microsoft and eMudhra signed proof of control over the private keys of eight eMudhra intermediate CAs, six for TLS and two for code signing. Scott Helme's table puts every private value below 256, and for EM OV TLS CA - G3C it is 4. All eight came from an April 2025 key ceremony and were cross-signed by Sectigo's AAA Certificate Services root in May 2025, so they sat in the web PKI for about 17 months. Dennis Jackson's write-up finds no Certificate Transparency entries for these intermediates in that period.
eMudhra's preliminary report on Mozilla's Bugzilla says a test in the ceremony script created a second, weak key pair, and similar labels led staff to use it for the CSR, and it admits "human errors in multiple steps." Chrome blocked the six TLS intermediates through CRLSet late on October 17, and Mozilla's OneCRL block followed within hours. eMudhra revoked them October 18 and Sectigo moved to revoke its cross-signs, Apple blocked them October 19, and Microsoft blocked them October 20. Mozilla also removed trust in the emSign ECC Root CA - G3.
Go 1.27.3 and 1.26.10, released October 19, reject chains that pass through "a small set of intermediate certificates" during crypto/x509 verification. Go tracks it as CVE-2026-111943 in golang/go#82345, ran it as an urgent-track release and didn't name the CA.
If a Go service on Linux was last built before October 19, it will still accept a chain through these eight intermediates, because Go checks chains itself there and never reads CRLSet or OneCRL. Helme notes that Terraform and kubectl are Go clients that trust an on-disk CA bundle and skip revocation checks.
BeyondTrust's BT26-05 advisory covers CVE-2026-102764, rated CVSS v4 9.3, in which internal Remote Support components don't properly check where incoming messages come from, so an unauthenticated attacker can perform file operations on the appliance. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch is applied. SaaS tenants were patched by October 9, and self-hosted appliances on 24.3.1 or later can apply the patch from /appliance, while older ones must upgrade first, according to Rapid7. Rapid7 says BeyondTrust dates its two known compromises, one hosted instance and one self-hosted appliance, to August 29. CISA added it to KEV on October 16 with an October 19 deadline.
Google Threat Intelligence Group and Mandiant attribute the exploitation to ARMORY CASTLE, a "suspected PRC-nexus espionage actor" formerly tracked as UNC5221. The actor dropped a PHP web shell Mandiant calls SAWFLY, copied /bin/sh into a root-owned SUID binary, dumped the appliance's credential vault with bt-secrets, and raised a compromised account's Jump Item and Team permissions from No Access to Administrator, which let it open remote sessions to downstream systems. It ran BARECLAW, a SOCKS5-over-WebSocket tunneler, behind a modified HAProxy route and routinely deleted appliance logs. GTIG writes that organizations "should prepare for potential widespread exploitation following this disclosure."
Rebuild any self-hosted appliance that may have been reached since late August from a clean, patched image instead of cleaning it, since GTIG says customers can't audit its host file system and host-level persistence survives a reboot and a configuration reset. Credential rotation comes after the rebuild, because GTIG warns that new credentials set earlier go to an attacker who still controls the appliance.
• Langflow CVE-2026-105740, CVSS 9.9. Any logged-in Langflow user, including non-admins, can add an MCP server that uses the stdio transport, and Langflow passes its command field to a shell without validation, so the command runs on the server every time the server list loads. Langflow fixed it in 1.9.0, and the advisory went up on September 10. Previdian's honeypot telemetry shows 3,332 exploitation attempts from 31 IPs between September 19 and October 21. According to The Hacker News, the attackers logged in with common credentials and pulled LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD from the environment. A second stdio command injection, CVE-2026-105697 (CVSS 9.9), is fixed in 1.10.3. (Langflow, Previdian, The Hacker News)
• BeyondTrust Remote Support CVE-2026-102764, CVSS 9.3, a zero-day and the subject of this week's BeyondTrust Deep Dive. An unauthenticated attacker can abuse improper origin validation in an internal messaging component to perform file operations on the appliance. Mandiant attributes zero-day exploitation starting in late August to ARMORY CASTLE, a suspected PRC-nexus espionage group formerly tracked as UNC5221. Self-hosted 24.3.1 through 26.2.3 need patch BT26-05-RS, older versions have to upgrade first, and SaaS instances were patched October 9. CISA added it to KEV on October 16 with an October 19 deadline. (BeyondTrust, Mandiant, The Hacker News)
• Collabora Online built-in CODE server for Nextcloud CVE-2026-110447, CVSS v4 9.2. An unauthenticated request to the richdocumentscode app's proxy.php can run an OS command as the web server user. The window opens only while the built-in CODE server is not running, for example after a restart, upgrade or crash. The fix, version 26.4.303, shipped September 11, but the advisory and CVE came on October 14. Administrators reported attacks from mid-September, and a Nextcloud community warning says "Web shells were found on real servers." Disabling the app does not close the hole, so upgrade or remove it and check for unexpected PHP files. Standalone Collabora Online servers are not affected. (Collabora, Nextcloud community, BleepingComputer)
• Plex Media Server CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, together called Plex2Shell. Zach Main's chain starts with an unauthenticated SSRF in /player/timeline, reaches the owner's admin token, and ends by writing an ELF shared object into the Codecs directory and loading it. Plex Media Server 1.43.3.10861 fixes the chain. Main published on October 16, and a honeypot running 1.43.2 recorded exploitation on October 17 that installed an XMRig miner and a Linux reverse-proxy backdoor. The individual CVEs score between 5.3 and 8.6, and Main rates the full chain 9.8. (Zach Main, The Hacker News)
• SiteGuard Server Edition CVE-2026-106931, CVSS v4 8.5. An OS command injection in the statistics function of EG Secure Solutions' host-based WAF runs commands as root or SYSTEM, and the statistics function is on by default. JPCERT/CC says the flaw "has been confirmed to be exploited in the wild." It affects version 2.20 and later and is fixed in 8.00 Update 5, or 7.00 Update 6 on FreeBSD. Servers that can't upgrade, including end-of-life versions, can take a vendor patch that replaces the statistics files. IIS editions 3.10 through 4.00 Update 4 are not affected. (JPCERT/CC, BleepingComputer)
• Siemens Software Center CVE-2026-110936, CVSS v4 8.4. The application loads DLLs from an uncontrolled search path. In a ClickFix campaign, an MSI installer launched a genuine signed copy of SiemensSoftwareCenter.exe with a malicious archive.dll next to it and installed a remote access trojan. Siemens says it has "validated that there is an active exploitation" and that its own systems and update channels were not breached. Every version before 4.0.9.8 is affected, and existing installs update the next time the application starts. Jose Oregon of Huntress found the flaw. (Siemens, The Hacker News)
• Palo Alto Networks PAN-OS GlobalProtect CVE-2026-0257, CVSS v4 7.8. This authentication bypass accepts GlobalProtect authentication override cookies without validating them. Palo Alto patched it on May 13, and it has been in KEV since that day. On October 19 Unit 42 reported that Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) use it to get past MFA and open VPN sessions. Unit 42 has investigated these intrusions since early June, and in one of them the attackers moved from the gateway to vCenter and dumped a domain controller's credentials offline. A firewall is exposed only if a GlobalProtect portal or gateway has authentication override cookies enabled. The fixed builds are listed in the advisory, and users have to re-authenticate once after the upgrade. (Unit 42, Palo Alto Networks)
• Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager CVE-2025-61624, CVSS 6.0. Unit 42 reported on October 14 that CL-STA-0954 (UNC5820) got into a telecommunications managed service provider through FortiManager's FortiJump bug (CVE-2024-47575). The group then used this CLI path traversal to go from FortiOS admin to root and load PEERSTITCH, a memory-only ARM64 implant. PEERSTITCH patches the miglogd and iked daemons so that tagged VPN sessions skip FortiOS security checks. The archive the attackers stole held configuration and credentials for more than 500 managed FortiGates. Fortinet patched the flaw in April, in FortiOS 7.6.5 and 7.4.10, and now marks it known exploited. CISA added it to KEV on October 16 with an October 19 deadline. (Fortinet, Unit 42, The Hacker News)
• PHP CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2, the subject of this week's PHP2Shell Deep Dive. One bug corrupts state when PHP runs out of memory, and the other leaves stale request state behind. With either one, an unauthenticated request can reach code execution before any application code runs, and PHP rates the risk highest for mod_php. Fixed October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source-only backports for 7.4, 8.0 and 8.1 published as branches on GitHub. Wiz Research was among the reporters. On release day, PHP described "a demonstrated exploit," and Cloudflare said it was seeing early attacks, but neither PHP, Wiz nor CISA's KEV catalog had confirmed in-the-wild exploitation by Wednesday morning. (PHP, Wiz)
• Fortinet FortiSIEM CVE-2026-106173, CVSS 9.4. An unauthenticated path traversal in the gRPC service on TCP 27918 lets an attacker write files and run code on FortiSIEM 7.5.0. Fortinet fixed it in 7.5.1 on October 13, and FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Horizon3.ai published a write-up and proof of concept on October 20. Fortinet lists it as not known to be exploited, and until you can patch, the workaround is to restrict access to port 27918. (Fortinet, Horizon3.ai)
• Adobe Commerce and Magento Open Source CVE-2026-103849, CVSS 10.0. Sansec calls the bug BlockStrap. A template injection flaw lets an unauthenticated attacker run code on Magento Open Source and Adobe Commerce 2.4.9 and earlier, and on Adobe Commerce B2B 1.5.3 and earlier. Adobe fixed it in APSB26-153 on October 13 along with ten other bugs and rates it priority 2. Sansec reproduced four code-execution routes within 24 hours and expects attacks. A plain Composer install leaves the vulnerable base version in place, so apply the 2026-oct release or Adobe's isolated patch, and keep the September hotfix for CVE-2026-75650 (StyleSmuggler) in place as well. Mage-OS 3.6.0 contains the fix. Adobe and Sansec report no exploitation so far. (Adobe, Sansec)
• Next.js GHSA-673q-mjm6-r5xr and CVE-2026-96889, both rated critical by Vercel. The first lets an unauthenticated attacker run code in App Router apps that use Cache Components when a use cache function returns multiple typed arrays. It has no CVE and no workaround. The second is a memory bug in librsvg, which Next.js reaches through sharp in the Image Optimization API on glibc Linux when SVG handling is enabled. Both are fixed in 16.4.1 and 15.5.28, released October 14, together with a high-severity Server Actions denial of service. On 15.5.28, run npm ls sharp to make sure it resolves to 0.35.5 or later. No attacks have been reported. (Vercel, The Hacker News)
• Linux kernel IPv4 networking (PwnEscape), rated critical by the researchers who found it. Guest-controlled checksum metadata lets an untrusted VM guest change an IPv4 header after the host kernel has validated it, so the host sends 32 bytes of its own memory back to the guest. Paulos Yibelo of pwn.ai showed the leak against Vercel's production sandboxes during Vercel's $1 million challenge. In a lab he chained it into host kernel writes and a helper running as root on the host. The fix, commit 6785011f8b16, reached mainline on October 14. pwn.ai has not published an exploit and expects public ones within weeks. We could not confirm the CVE number used in press coverage, so match the commit against your distribution's kernel advisory. (pwn.ai, The Register)
• F5 NGINX CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479, CVSS v4 9.2 from F5, though nginx.org rates each one medium. Each bug crashes the worker process and could run code, but only with a specific configuration: alias or $request_filename in a location block, asynchronous file I/O with SSI, or map blocks that use unnamed regex captures. nginx 1.31.7 and 1.30.6, released October 14, fix all three. The same releases also fix an HTTP/3 request body injection (CVE-2026-95101) and a TLS session ticket forgery (CVE-2026-97629). On October 19, F5 followed with out-of-band patches for NGINX Plus, Ingress Controller, Gateway Fabric and Instance Manager, and it reports no exploitation. (nginx.org, F5, CSO Online)
• Drupal core CVE-2026-108097, rated 19 of 25 (critical) by Drupal. A flaw in the Field UI module allows code execution, though not through core alone. Contributed modules open the path, and at least one known path needs no login. Fixed October 14 in 11.4.10, 11.3.19 and 10.6.19. End-of-life 11.2.x, 10.5.x and older get no fix, and uninstalling field_ui protects a site until it can update. The Entity List module had the same flaw, tracked as CVE-2026-108099 and fixed in 3.0.10, and updating core does not update the module. No exploit had surfaced as of October 15. (Drupal, The Hacker News)
• Linux kernel vhost CVE-2026-74580, CVSS 8.8 from the kernel.org CNA. Tencent named it Vghost. VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM don't reset a cached copy of vhost IOTLB metadata, and the stale cache gives a local user root through arbitrary kernel read and write on Linux 4.11 through 7.2-rc4. With a virtual IOMMU, a guest can also write out of bounds into the host's QEMU process. Tencent Zhuque Lab's Corvus AI system found it in about two hours. Fixed in commit de845981da67 and in stable releases 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 and 7.2. Tencent reproduced a working proof of concept on Ubuntu, RHEL, Amazon Linux, Azure Linux and Oracle Linux and reports no exploitation. Vghost and PwnEscape are separate bugs. (Tencent Zhuque Lab)
• Symfony HttpFoundation CVE-2026-108082, CVSS v4 8.7. A crafted Cache-Control header triggers catastrophic regex backtracking in HeaderUtils::split(). Symfony parses that header on every request, before routing or authentication, so the bug also reaches Laravel, Drupal, PrestaShop and Shopware. The researcher's write-up measured up to 12.7 seconds of CPU for a single request against real targets. The 5.4 branch is fixed in 5.4.54. On 6.4, 7.4 and 8.1 the first fixes (6.4.46, 7.4.19 and 8.1.7) broke splitting on whitespace, so upgrade to 6.4.48, 7.4.21 or 8.1.9. (Symfony, r3verii)
• Broadcom Wi-Fi Protected Setup (no CVE, no patch). Quentin Kaiser disclosed an overflow in how Broadcom's proprietary Wi-Fi stack reassembles WPS EAP fragments. An attacker in radio range can use it to run code as root without the network key or a completed WPS enrollment. Kaiser calls the eCos-based BCM3380, BCM3383 and BCM33834 chips a "definitive forever day," and the Linux-based BCM3390, BCM63xx, BCM65xx and BCM68xx chips potential ones. He showed the attack working on gateways from three Belgian ISPs. Broadcom has known about the bug since 2018, shipped an incomplete fix and declined to assign a CVE. Since disclosure, Proximus has disabled WPS across its fleet, and disabling WPS is the only mitigation available. (Quentin Kaiser, The Hacker News)
• Go crypto/x509 CVE-2026-111943, covered in this week's eMudhra Deep Dive. Go 1.27.3 and 1.26.10, released October 19, block trust in "a small set of intermediate certificates" without naming the certificate authority. The block is compiled into the standard library, so a Go program gets it only after a rebuild with a fixed toolchain. (Go)
• Why Your CVE Program Misses Most AI Agent Vulnerabilities (Amine Raji)
Why it's worth your time: Raji works in the OWASP Agentic Top 10 and MCP Top 10 groups. He sorts agent flaws into six locations and argues that a CVE fits only the first two, implementation bugs and approval logic in agent hosts. His examples include OX Security tracing ten downstream CVEs to one stdio transport default in the official MCP SDKs. In mcp-server-git, four more tools went three months without argument-injection guards after the CVE fix, and those later fixes carry no CVE. The postmark-mcp package shipped 15 clean versions before 1.0.16 added a hidden BCC to every email. This week's Langflow entry is that same stdio pattern. His triage questions apply to any agent deployment: whether attacker-influenced content reaches the component, and whether the agent can write, execute or send data out.
• Documenting Certificate Distribution Pain Points for the Python Ecosystem (Seth Larson, Python Software Foundation) Why it's worth your time: the eMudhra Deep Dive covers how Go shipped its block, and Larson, writing the day the compromise went public, explains Python's version. OpenSSL-based Python has no active revocation by default, so a distrust has to travel from a certifi release to a pip release to Python releases on three or four branches. After that come manylinux images, build bots, the Sigstore CLI and banners on pypi.org. He argues, and says he may be wrong, that PyPI should stop being a certificate distribution channel and that pip should drop certifi as a default (pip issue 14374).
• Putting Models to the Secure Coding Test: Security Rules (Datadog Security Labs, Kennedy Toomey) Why it's worth your time: Toomey gave Sonnet 5 in Claude Code, Composer 2.5 in Cursor and GPT 5.5 in Codex the same document-portal prompt, once in default mode and once with Project CodeGuard security rules installed (v1.4.0 for Claude Code). Only GPT 5.5's rules build closed the cross-user document IDOR that every default build shipped. Composer's SAST findings fell from 17 to 4, but its rules build kept hardcoded secret fallbacks and tokens that stay valid 24 hours after logout. Sonnet's rules build kept the IDOR and added a session-revocation regression. Each model ran once, and Toomey scored the builds with Datadog Code Security and Claude's code_review skill, which runs on Sonnet 5, one of the models under test. Toomey concludes that the prompt matters as much as the rules, and that it has to state constraints like filtering document queries by owner outright.
• Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (Calif, Andrew Griffiths)
Why it's worth your time: OpenBSD counted shared memory attachments in a signed 16-bit field, so forking a process that holds attachments enough times pushes shm_nattch past 32,767 and wraps it negative, which becomes a use-after-free through a race. Griffiths chains that with a separate conditional -1 write over the membership counters in struct ip_moptions to get root on OpenBSD 7.9. The chain gets past KARL, SMAP and SMEP without an information leak. OpenBSD fixed both bugs in 7.9 errata 026 and 018. The post does not say AI found the bugs. Its closing argument is that eliminating whole bug classes matters more once AI-assisted discovery is common.
• RCE (Kind Of) in Transmission BitTorrent's Daemon (Joshua Rogers)
Why it's worth your time: Transmission's RPC server sends Access-Control-Allow-Origin: * and lets cross-origin scripts read X-Transmission-Session-Id. That gives any web page the token meant to stop exactly this kind of cross-site attack. On the default configuration, with password authentication off and RPC bound to loopback, a page the user visits can set the torrent-done script and have it run. It is only "kind of" RCE because the daemon calls execvp with no shell, so the attacker can only point it at an executable already on disk. Rogers reported it on May 7 and got no reply, and the fix in PR 8938 is not in any release yet. Any token your API returns in a header that cross-origin scripts can read gives no CSRF protection.
• Silently Install VSCode Extensions (Pepe Berba)
Why it's worth your time: Berba installs VS Code extensions on macOS by writing straight into ~/.vscode/extensions/ and extensions.json, and they run without a restart or a prompt. Setting isBuiltin: true hides an extension from the list, and reusing a verified extension's name and publisher gets it the verified badge. He also hollows out existing extensions by changing their main entry point. VS Code closed his report on September 25 as not a vulnerability, since the attacker already needs file write as the user, and Cursor did not respond. That makes it a persistence technique for developer machines. The detection section, which covers file integrity monitoring on the VS Code, Cursor and Antigravity extension folders, a jq hunt for isBuiltin entries and an extensions.allowed policy pushed through MDM, is the part to copy.
Every Thursday, 1,500+ security leaders get the week in AppSec cut down to a 5-minute read.
Join 1,500+ security leaders. Five minutes, once a week.
Your first issue lands Thursday.
One email a week. Unsubscribe in one click.