CVE Watch: PHP2Shell Roots Firewalls as CISA Adds 12 Exploited Bugs

Window: Oct. 23 to Nov. 2, 2026. CISA added 12 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in these ten days, and the busiest was PHP2Shell, the pair of PHP bugs that one operator chained with a Linux kernel flaw to root 24 Palo Alto Networks firewalls. Edge gear had another rough week too: an Ivanti VPN chain, a third exploited VeloCloud Orchestrator bug since July, and a Cisco firewall crash bug. Below are the 11 entries that cleared the bar (Critical or High, or exploited regardless of score), with a ready-to-paste “Heads up” for each.

CVE	Vendor + product	CVSS	Exploited?	PoC	CISA KEV
CVE-2026-109618	PHP	9.2 Critical (v4.0)	Known	Public	Yes, Oct. 26
CVE-2026-109619	PHP	9.2 Critical (v4.0)	Known	Public	Yes, Oct. 26
CVE-2026-111357	Ivanti Connect Secure	7.0 High (NVD) / 8.8 High (reported)	Known	Public (chain)	Yes, Oct. 30
CVE-2026-118527	Ivanti Connect Secure	4.3 Medium	Known	Public (chain)	Yes, Oct. 30
CVE-2026-114625	Arista VeloCloud Orchestrator	9.9 Critical	Known	None known	Yes, Oct. 23
CVE-2026-110447	Collabora Built-in CODE Server (Nextcloud)	9.2 Critical (reported)	Known	None known	Yes, Oct. 23
CVE-2026-97229	GitLab CE/EE	10.0 Critical	Known (attempts)	Public	Yes, Oct. 29
CVE-2026-111497	Google Brotli (Node.js and others)	9.2 Critical (v4.0)	Known (attempts)	Public	Yes, Oct. 27
CVE-2026-48356	Adobe Commerce / Magento	9.3 Critical	Known	Public (reported)	Yes, Oct. 27
CVE-2026-76418	Cisco Secure Firewall ASA / FTD	8.6 High	Known	None known	Yes, Oct. 29
CVE-2026-46300	Linux kernel	7.8 High	Known	Public	Yes, Oct. 28
CVE-2026-41709	Broadcom VMware ESX	2.7 Low	Known (zero-day)	None known	Yes, Oct. 28
CVE-2026-112816	Canonical LXD / MicroCloud	10.0 Critical (v4.0)	No evidence	Public (reported, unverified)	No

CVE-2026-109618 and CVE-2026-109619: PHP use-after-free (PHP2Shell)

PHP2Shell is a pair of memory-safety bugs in PHP’s session upload progress feature, which is on by default. They affect the PHP language runtime itself (watchTowr believes PHP 5 through 8), and are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. One is a half-initialized-data cleanup bug triggered by an out-of-memory condition, the other request state that survives after its memory is freed; both can give unauthenticated remote code execution. An attacker only needs to send crafted HTTP requests to a PHP application, so anything from WordPress to a PAN-OS management page can be the door. The business impact is full control of the web server, and Dream Research documented an operator who used it plus the Fragnesia kernel bug to root 24 internet-facing PAN-OS firewalls and reach a U.S. government-affiliated network.

Heads up: PHP2Shell (CVE-2026-109618/109619) is CVSS v4.0 9.2 from the PHP security team (watchTowr calls it a 10); we don’t have the vector string. PHP says update now, CISA put both on KEV Oct. 26, and EPSS rates them at 99.999%. Exploit code is public, with hundreds of GitHub PoC repos reported, though success depends heavily on how PHP is built. Known campaign: the PAN-OS rooting operator above, who used a custom private exploit and an AI recon framework; no named group. It’s remote, unauthenticated, no user interaction, and fully automatable. Patching is the real fix; as a stopgap set session.upload_progress.enabled = 0 in php.ini and restart every worker. Discovered: not disclosed; details leaked before the coordinated Oct. 21 release; Amazon’s honeypots saw the first attempt Oct. 17, so hunt from that date. Scanning: KNOWN, per Amazon’s MadPot sensors and Hunt.io honeypots. Advisory: https://www.php.net/

Sources: Amazon Threat Intelligence, Hunt.io, Dream Research, GMO Flatt Security, Unit 42, BleepingComputer.

CVE-2026-111357: Ivanti Connect Secure privilege escalation (with CVE-2026-118527)

Why now: the chain was disclosed Oct. 13; Ivanti shipped the last fix Oct. 29 and CISA added these two links to KEV Oct. 30.

CVE-2026-111357 is the root step in a three-bug chain against Ivanti Connect Secure, the remote-access VPN appliance. Ivanti says 22.8R2.6 and 25.1.1.3 fix all disclosed bugs on those branches. It’s a privilege escalation that abuses how the root-run dsinvoked service trusts its cache configuration, while CVE-2026-118527 is a predictable upload filename. An attacker first gets in without a login through CVE-2026-104935 (on KEV since Oct. 13), then uses these two to get root. The impact is a fully owned VPN gateway that the attacker used to pull LAPS passwords and BitLocker recovery keys from Active Directory.

Heads up: CVE-2026-111357 is CVSS 7.0 in NVD (CyberSecurityNews lists 8.8) and CVE-2026-118527 is 4.3; vectors weren’t in the sources we used. Both went on KEV Oct. 30 (federal deadlines Nov. 2 and Nov. 13); EPSS is 0.5% for 111357 and not yet scored for 118527, but the entry bug CVE-2026-104935 sits at 87%. A Nuclei template and five GitHub PoCs are reported for the chain. KNOWN campaign: Volexity found UTA0576 using it at a customer from Oct. 3; Volexity has low confidence on whether it’s criminal or espionage. Remote over the internet, no auth, no user interaction, scriptable (the actor re-ran the chain for every command). Patch is required; the actor also scrubbed logs so Ivanti’s Integrity Checker came back clean, so don’t trust a clean ICT. Discovered by Volexity in an incident response, disclosed Oct. 13 in coordination with Ivanti. Scanning: none reported. Advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

Sources: Volexity, CyberSecurityNews, The Hacker News.

CVE-2026-114625: Arista VeloCloud Orchestrator SQL injection

Why now: Arista’s advisory came out Oct. 22; CISA added it to KEV Oct. 23.

This is a SQL injection in the on-premises VeloCloud Orchestrator, the management console for Arista’s SD-WAN. Affected are 5.2 before 5.2.3.18, 6.1 before 6.1.3.10 and 6.4 before 6.4.2.12; hosted orchestrators were already patched, and Edge and Gateway devices aren’t affected. The flaw lets a low-privilege user escalate to operator (local superuser) and may reach the host itself. An attacker needs network access to the web interface and any valid login, down to the Enterprise Read Only role. The business impact is control of the orchestrator that configures every branch site on the SD-WAN.

Heads up: CVE-2026-114625 is CVSS 9.9; vector not given in the sources we used. Arista confirms exploitation, CISA added it to KEV Oct. 23 with an Oct. 26 deadline, and EPSS is 1.0% (64th percentile), which badly undersells it. No public PoC; the exploit is privately held. Campaign and actor: not disclosed, though Arista named two attacking IPs, 74.82.197[.]86 and 38.54.50[.]151. Remote over the network, needs a valid low-privilege login, no user interaction; the orchestrator is exposed by default and no setting stops this. Patch is required; meanwhile restrict the web UI to admin networks, watch outbound traffic from the VCO host and hunt for web shells. This is the third exploited VCO bug since July, after CVE-2026-16812 and CVE-2026-93952, and those patches don’t cover it. Discovered: not disclosed; advisory published Oct. 22. Scanning: not reported. Advisory: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Sources: The Hacker News, SecurityWeek.

CVE-2026-110447: Collabora Built-in CODE Server command injection

Why now: fixed in September and published Oct. 14; CISA added it to KEV Oct. 23.

CVE-2026-110447 is an OS command injection in proxy.php of the Built-in CODE Server app (richdocumentscode), which runs Collabora Online inside Nextcloud. Versions before 26.4.303 are affected; standalone Collabora, Docker, RPM/DEB installs and Nextcloud All-in-One are not. The bug lives in the code that starts the bundled document server. An unauthenticated attacker sends a crafted request while that server is stopped, such as after a restart, upgrade or crash. Attackers have used it to plant PHP web shells on Nextcloud servers and search for password databases and crypto wallets.

Heads up: CVE-2026-110447 is reported at CVSS 9.2; we couldn’t confirm who scored it or the vector. CISA added it to KEV Oct. 23 (deadline Oct. 26) and EPSS is 73% (99.5th percentile). No public PoC confirmed. KNOWN exploitation since about Sept. 10, with web shells under apps/richdocumentscode/shx*.php; ransomware use is SUSPECTED by some admins but unconfirmed. No actor named. Remote, unauthenticated, no user interaction, automatable. Update to 26.4.303 or remove the app; Collabora says disabling it is not enough. Fix committed Sept. 9, released Sept. 11, community warning Oct. 3, advisory and CVE Oct. 14; Collabora reported it to Nextcloud. Scanning: not reported. Advisory: https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh

Sources: BleepingComputer, eSecurity Planet, richdocumentscode issue 354.

CVE-2026-97229: GitLab CE/EE integer overflow RCE

Why now: patched Oct. 12; an exploitation attempt against Alpine Linux surfaced and CISA added it to KEV Oct. 29.

CVE-2026-97229 is an integer overflow in Onigmo, the Ruby regex engine GitLab uses to compile CI/CD regular expressions. It affects GitLab Community and Enterprise Editions 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The result is remote code execution on the GitLab server. An attacker submits a crafted regex in a CI configuration; at Alpine the attacker simply registered an account to do so. The impact is control of the server that holds your source code and CI secrets.

Heads up: CVE-2026-97229 is CVSS 10.0 with no login required, per Rapid7. CISA added it to KEV Oct. 29 (deadline Nov. 1), EPSS is 27% (98th percentile), and six public PoC repos are reported. KNOWN attempts: Alpine Linux saw an attacker crash its GitLab workers eight times from Oct. 20 and come back Oct. 25 and 26; Alpine found no sign of success but rebuilt anyway. No actor named. Remote, no user interaction, scriptable. Patch, and if you build GitLab with your own Ruby, also upgrade to Ruby 3.3.13, 3.4.12, 4.0.9 or later, which is what caught Alpine. You also need the Oct. 21 releases for the sibling CVE-2026-110264. Patched Oct. 12 in a coordinated release. Scanning: none reported beyond Alpine. Advisory: GitLab’s Oct. 12 critical patch release; Rapid7’s analysis is at https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab

Sources: Alpine Linux, SecurityWeek, Rapid7.

CVE-2026-111497: Google Brotli out-of-bounds write (Node2Shell)

CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decompression library, versions 1.0.3 through 1.2.0. It reaches anything that decompresses attacker-supplied Brotli data, including Node.js 22, 24 and 26, PHP for Windows, .NET, Python packages, Bun and Envoy. The bug is memory corruption that researchers turned into remote code execution on stock Node.js builds. An attacker sends a crafted Brotli request body to an app that decodes it (Express 5 body parsers are in scope) or serves a crafted response to an app that fetches it. The impact is code execution as the service account, and crash dumps can leak live secrets.

Heads up: CVE-2026-111497 is CVSS v4.0 9.2 from Google as CNA; vector not in our sources. CISA added it to KEV Oct. 27 (deadline Nov. 10) and EPSS is 83% (99.7th percentile). Exploit code is public: Imperva’s Node2Shell demo plus about 65 GitHub repos. KNOWN attempts: ELLIO logged a 23 MB exploit body on Oct. 26 from 94.154.43[.]7 aimed at Node 24.22.0 x86-64; no successful compromise reported. No actor named. Remote, unauthenticated, no user interaction, automatable but unreliable (failed tries crash the worker). Patch: Node.js 22.23.4, 24.22.1 or 26.12.1, Brotli 1.0.10, 1.1.1 or 1.2.1, plus vendor builds; until then drop inbound Content-Encoding: br where you don’t need it. Fixed Oct. 21. Scanning: KNOWN, a public node2shell-check/1.0 scanner since June 13, per ELLIO. Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Sources: ELLIO, Imperva, The Hacker News.

CVE-2026-48356: Adobe Commerce and Magento unrestricted file upload (PolyShell)

Why now: fixed in July; CISA added it to KEV Oct. 27 as Sansec tied it to a stealthy store-loader campaign.

PolyShell is an unrestricted file upload in Adobe Commerce and Magento Open Source, fixed in Adobe bulletin APSB26-73 on July 14, 2026. Sansec disclosed it in March 2026, and sources disagree on exactly which 2.4.9 builds contain the fix, so check the bulletin for yours. The flaw lets an attacker upload a file of a dangerous type to the store. It’s reached over the web without a login. Sansec estimates 471 stores were compromised through it, many now carrying a loader hidden in CMS blocks that can deliver card-skimming or other payloads.

Heads up: CVE-2026-48356 is CVSS 9.3; vector not in our sources. Adobe rates it Critical, CISA added it to KEV Oct. 27 (deadline Nov. 10), and EPSS is 45% (98.8th percentile). Public exploit code is reported. KNOWN campaign: Sansec’s CMS-block loader on 953 stores, about half via PolyShell; actor unknown. Remote, unauthenticated, no user interaction, mass-automated. Apply APSB26-73 (and APSB25-88 for SessionReaper), then clean up: Sansec found a fully patched store infected via a rogue admin account, so patching doesn’t prove a store is clean. Disclosed by Sansec in March, patched July 14. Scanning: KNOWN mass exploitation per Sansec. Advisory: https://helpx.adobe.com/security/products/magento/apsb26-73.html

Sources: Sansec, The Hacker News.

CVE-2026-76418: Cisco Secure Firewall ASA and FTD denial of service

CVE-2026-76418 is a logic error in the Remote Access SSL VPN service of Cisco’s ASA and Firepower Threat Defense firewalls. It affects releases before ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. It’s a denial-of-service bug that forces the device to reload. An unauthenticated attacker sends a crafted request to the VPN login service when a tunnel group uses secondary authentication. The business impact is a firewall that can be knocked offline on demand, cutting remote access and anything routed through it.

Heads up: CVE-2026-76418 is CVSS 8.6; vector not in our sources. Cisco confirms active exploitation, CISA added it to KEV Oct. 29 (deadline Nov. 1), and EPSS is 0.8%. No public PoC. Campaign and actor: Cisco hasn’t said. Remote, unauthenticated, no user interaction, easy to script. Patch, or use Cisco’s workaround of turning off secondary authentication on affected tunnel groups (check DefaultWEBVPNGroup too). Cisco says it learned of exploitation in October and published Oct. 28. Scanning: not reported. Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

Sources: The Hacker News, Cisco advisory above.

CVE-2026-46300: Linux kernel privilege escalation (Fragnesia)

Why now: disclosed in May; CISA added it to KEV Oct. 28 after it was used to root PAN-OS firewalls in the PHP2Shell campaign.

Fragnesia is a flaw in the Linux kernel’s XFRM ESP-in-TCP code that corrupts the page cache. It affects kernels without the May 13, 2026 patch across Ubuntu, RHEL, Debian, openSUSE and others; Amazon Linux doesn’t ship the module. It’s a local privilege escalation to root, in the same family as Dirty Frag, with no race condition needed. An attacker must already be running code on the machine. That’s exactly the role it played after PHP2Shell, turning a web-server foothold into root on firewalls.

Heads up: CVE-2026-46300 is CVSS 3.1 7.8 per the kernel CNA and NVD (Red Hat rates it Important). CISA added it to KEV Oct. 28 (deadline Oct. 31) and EPSS is 16% (97th percentile). The PoC is public, released with the disclosure. KNOWN campaign: Dream Research’s PAN-OS rooting operator; no named group. Local only, needs code execution first, no user interaction, scriptable. Patch your kernel; as a mitigation, unload and block the esp4, esp6 and rxrpc modules (the Dirty Frag modprobe rule covers it). Discovered by William Bowling of V12 Security; PoC, patch and CVE all published May 13. Scanning: not applicable (local). Advisory: https://ubuntu.com/security/CVE-2026-46300

Sources: Tenable FAQ via Security Boulevard, kernel patch, Hunt.io.

CVE-2026-41709: Broadcom VMware ESX insufficient logging

Why now: patched in July; CrowdStrike revealed it was a zero-day and CISA added it to KEV Oct. 28. Included despite its low score because it’s an exploited zero-day.

CVE-2026-41709 lets an administrator on a VMware ESX host perform some operations without them being logged. It affects ESX 8.0, Cloud Foundation and vSphere Foundation 9.x and Telco Cloud Platform before the builds in Broadcom’s July advisory. It’s an insufficient-logging weakness (CWE-778), not code execution. An attacker must already hold admin rights on the host. Its value is hiding what happens after a break-in, which makes incident response much harder.

Heads up: CVE-2026-41709 is only CVSS 2.7. CISA added it to KEV Oct. 28 (deadline Nov. 11) and EPSS is 0.7%. No public PoC. KNOWN use: CrowdStrike says the China-linked group it calls Warp Panda used it as a zero-day against US law firms; The Hacker News says that’s the same cluster as Armory Castle (UNC5221). Requires an internal, high-privilege position with hands on keyboard. Patch to the fixed builds, and ship ESXi and vCenter logs off the host, since missing logs prove nothing. Patched in July; exploitation disclosed in CrowdStrike’s 2026 Legal Threat Landscape Report. Scanning: not applicable. Advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Sources: CrowdStrike, The Hacker News.

CVE-2026-112816: Canonical LXD and MicroCloud authentication bypass

CVE-2026-112816 is a certificate-validation flaw in Canonical’s LXD and MicroCloud container and VM managers. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, MicroCloud 3.4.1 and 2.1.5, and Incus 7.6.0; Ubuntu archive packages aren’t affected, the snaps are. It’s an authentication bypass (CWE-295): the server checked every certificate in the client’s chain instead of just the leaf. An attacker with network access to the HTTPS API and a trusted client’s public certificate can log in as that client. Canonical says that can mean root on the host, and at minimum control of the cluster and its VMs.

Heads up: CVE-2026-112816 is CVSS v4.0 10.0; vector not in our sources. Not on KEV, EPSS 0.3%. One GitHub repo is reported as a PoC, unverified. No known exploitation, campaigns or actors. Remote over the network, no user interaction, no private key needed, only the public cert; standalone LXD is exposed only if core.https_address is set. Canonical gives no workaround besides patching; until then firewall the API port (8443 by default) to admin hosts. Found by the Incus project and coordinated with Canonical, published around Nov. 1. Scanning: none reported. Advisory: https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

Sources: The Hacker News, Incus GHSA-xg75-xf37-cph9.

Hunt Lead candidates

• PHP2Shell + Fragnesia chain: honeypot shells, attacker kits, a documented PAN-OS rooting chain and Amazon’s pre-disclosure timeline give plenty of detection material.
• Ivanti Connect Secure chain: Volexity published request patterns, host artifacts, an attacker IP and post-exploitation AD tradecraft.
• Arista VeloCloud Orchestrator: Arista published attacker IPs and log-hunting guidance; thin on exploit mechanics.
• Collabora CODE Server: concrete web shell paths and a known endpoint make for a quick, practical hunt.
• Adobe Commerce PolyShell: Sansec published loader domains, database search strings and upload paths.

Earlier coverage: PHP2Shell roots PAN-OS, Ivanti chain, GitLab at Alpine, PolyShell and Node2Shell on KEV, Cisco ASA, VMware ESX, LXD.

CVE at a glance

CVE-2026-109618CriticalKEVPublic exploitPHP Group PHP

CVSS

9.2 Critical (v4.0)

EPSS

100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Oct 26, 2026

Public exploit

Yes, reported in Exploit-DB, a Nuclei template and 733 GitHub repositories

Full CVE details

CVE-2026-109619CriticalKEVPublic exploitPHP Group PHP

CVSS

9.2 Critical (v4.0)

EPSS

100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Oct 26, 2026

Public exploit

Yes, reported in 24 GitHub repositories

Full CVE details

CVE-2026-111357HighKEVIvanti Connect Secure

CVSS

7 High (v3.1)

EPSS

0.5% chance of exploitation in the next 30 days (higher than 45% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Oct 30, 2026

Public exploit

None reported in public exploit databases

Full CVE details

CVE-2026-114625CriticalKEVArista VeloCloud Orchestrator

CVSS

9.4 Critical (v4.0)

EPSS

1% chance of exploitation in the next 30 days (higher than 63.3% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Oct 23, 2026

Public exploit

None reported in public exploit databases

Full CVE details

CVE-2026-110447CriticalKEVPublic exploitCollabora Online – Built-in CODE Server

CVSS

9.2 Critical (v4.0)

EPSS

12.3% chance of exploitation in the next 30 days (higher than 96.1% of CVEs)

Exploited in the wild

Yes, on CISA’s KEV list since Oct 23, 2026

Public exploit

Yes, reported in 1 GitHub repository

Full CVE details

Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.