Weekly Report: New Hacking Techniques and Critical CVEs 26 Oct to 01 Nov 2026

1PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). It ranks first because exploitation is confirmed on firewall management planes, the flaws need no authentication, and PHP runs under most of the web. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, apply the PAN-OS hotfix for your release, and patch kernels for CVE-2026-46300, which turns a PHP2Shell shell into root.

2Ivanti Connect Secure, CVE-2026-111357 (Ivanti CVSS 8.8). It ranks second because it is the root step in the Connect Secure chain exploited since early October 2026, the fix shipped only on 29 October, and the federal due date is 2 November 2026. Upgrade to 25.1.1.3 or 22.8R2.6 and run a compromise assessment on any appliance that was reachable before the fix.

3Adobe Commerce and Magento, CVE-2026-48356 (CVSS 9.3). It ranks third because Sansec has tracked exploitation since March 2026 and traced a loader campaign across 953 stores, and a storefront is internet-facing by definition. Apply Adobe bulletin APSB26-73 and then check for files already planted, because patching does not remove a webshell.

4GitLab CE/EE, CVE-2026-97229 (CVSS 10.0). It carries the maximum score and GitLab describes it as exploitable without authentication under certain conditions, but the one documented attack, against Alpine Linux’s instance on 21 October 2026, produced crashes rather than a confirmed compromise. Upgrade to 19.4.2, 19.3.5 or 19.2.8, and on self-managed installs also patch Ruby.

What it is: CVE-2026-109618 is a memory corruption flaw in how PHP handles out-of-memory errors that, together with CVE-2026-109619 (stale request state reused across requests), lets an unauthenticated attacker execute code on a PHP server; the pair is known as PHP2Shell and was covered as unconfirmed in last week’s edition.

Affected products and versions: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. Palo Alto Networks PAN-OS on PA-Series and VM-Series firewalls and on Panorama is affected through the management web interface and XML API; a dataplane interface is affected only if it has a management profile attached, and GlobalProtect portal, gateway and Clientless VPN are not affected.

Severity: CVSS 9.2 for both CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0, AV:N/AC:H/AT:P/PR:N/UI:N, assigned by the PHP project). Palo Alto Networks rates the PAN-OS impact CVSS 9.2, or 7.7 (5.2 with threat metrics) when management access is restricted to a jump box.

Exploitation status: Confirmed in the wild. Palo Alto Networks states that active exploitation has been observed targeting PAN-OS management interfaces exposed to the internet. Researchers have reported servers rooted by chaining PHP2Shell with the Linux kernel privilege escalation CVE-2026-46300, most of them firewalls, including systems at a US government-affiliated organization on 23 October 2026. The same day, security researcher Kevin Beaumont warned, as quoted by GovInfoSecurity: “ASLR-supporting PHP exploits are coming, probably next week.” Both PHP CVEs added to CISA KEV on 26 October 2026. Federal remediation due date 29 October 2026.

Patch status: PHP fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. PAN-OS fixed in 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13, with matching hotfixes for earlier maintenance releases listed in the advisory, last updated 29 October 2026; The Hacker News reports hotfixes for every affected release were available by 30 October 2026. On 11.2.10, use 11.2.10-h17, which also covers the Brotli flaw.

What to do: Remove internet access to PAN-OS management interfaces and restrict them to trusted internal addresses, then apply the hotfix for your release. Upgrade PHP on every internet-facing host and patch Linux kernels for CVE-2026-46300, which is fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10. Treat any management interface that was reachable before patching as potentially compromised.

Why it matters: A PHP flaw became a firewall compromise because PAN-OS runs PHP behind its management interface, and a kernel bug turned that foothold into root in one request. Shared components inherited by appliances are a blind spot in most programmes, which is why the inventory of internet-facing management interfaces matters more than any single vendor’s patch cycle.

What it is: CVE-2026-111357 is a privilege escalation in Ivanti Connect Secure, which Ivanti attributes to missing authentication for a critical function and Volexity describes as the dsinvoked broker trusting manipulated DSCache data. It lets a local authenticated attacker on the appliance execute commands as root, and it is the final step of the chain that begins with the authentication bypass CVE-2026-104935 and the file upload CVE-2026-118527.

Affected products and versions: Ivanti Connect Secure 22.8R2.5 and earlier, 25.1.1.2 and earlier, and 25.1.2.2 and earlier, per CISA’s updated alert. The same versions are affected by CVE-2026-118527.

Severity: CVSS 8.8 as rated by Ivanti; MITRE as CNA scores it 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The companion flaw CVE-2026-118527, generation of predictable identifiers, is rated CVSS 4.3 by Ivanti.

Exploitation status: Confirmed in the wild. Volexity documented the full chain in attacks by the actor it tracks as UTA0576, with the earliest exploitation of the appliance it investigated on 3 October 2026. The attackers re-exploited the device for each command rather than dropping a webshell, and tampered with logs to evade the Integrity Checker. Added to CISA KEV on 30 October 2026 together with CVE-2026-118527. Federal remediation due date 2 November 2026 for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527.

Patch status: Fixed in 25.1.1.3 and 22.8R2.6, released 29 October 2026. Ivanti’s 13 October release fixed only the entry point, CVE-2026-104935; both CVE-2026-111357 and CVE-2026-118527 remained unpatched for a further sixteen days. Ivanti publishes no workaround for either, so the upgrade is the fix.

What to do: Upgrade every Connect Secure appliance to 25.1.1.3 or 22.8R2.6 now. An appliance patched on 13 October is still exposed, because that release closed the authentication bypass and left both the file upload and the root escalation open. Run memory and network forensics on any appliance that was internet-reachable between early October and the upgrade, since Volexity notes the Integrity Checker may not identify compromise and the attackers tampered with logs.

Why it matters: Root on a VPN gateway gives an attacker the credentials and sessions of everyone who connects through it. The sixteen-day gap between the entry-point fix and the fixes for the rest of the chain is a reminder that a chain is closed only when its last link is patched, and that an advisory updated in place can leave teams believing they are already done.

What it is: CVE-2026-48356 is an unrestricted upload of a file with dangerous type (CWE-434) in Adobe Commerce and Magento Open Source, reachable through the REST guest cart API without authentication. Sansec discovered it and named it PolyShell. The vulnerable code has existed since the first Magento 2 release.

Affected products and versions: Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier, per Adobe bulletin APSB26-73. Sansec’s own write-up states the May 2026 release of 2.4.9 contained the fix, while Adobe’s bulletin and the CVE record list 2.4.9 as affected and 2.4.9-2026-jul as fixed; treat the July releases as the minimum safe builds.

Severity: CVSS 9.3 per the CVE record; Adobe’s bulletin APSB26-73 scores it 9.6, the two differing on the availability impact.

Exploitation status: Confirmed in the wild. Sansec reported exploitation from March 2026, including 471 stores compromised within one hour on 30 March 2026, and on 24 October 2026 tied PolyShell to a CMS block loader campaign running since at least July 2025 that it found across 953 stores. Of 169 infected Magento 2 installations missing at least one core patch, Sansec found 102 with evidence of uploads through PolyShell or SessionReaper (CVE-2025-54236). Adobe’s bulletin states Adobe is not aware of exploits, so the exploitation evidence here is Sansec’s, and the store counts are Sansec’s observations rather than a census. Added to CISA KEV on 27 October 2026. Federal remediation due date 10 November 2026.

Patch status: Fixed in 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul, published in APSB26-73 on 14 July 2026 and last updated 11 August 2026.

What to do: Apply APSB26-73, then assume the store may already be compromised, because exploitation predates the patch by months. Review CMS blocks for injected script loaders, audit the media and upload directories for executable files, and check the web server configuration, since Sansec notes most stores use a hosting provider’s configuration rather than Adobe’s sample and that this is what decides whether an uploaded file executes.

Why it matters: The payload lives in CMS content rather than in a file on disk, so a store can be cleaned, patched and still serve attacker script from its own database. The campaign has been rotating loader domains across stores it already controlled since 2025, which makes this a persistence problem rather than a patching one, and the data at stake is cardholder and customer records.

What it is: CVE-2026-97229 is an integer overflow in the regular expression compiler used by GitLab CI/CD that lets an attacker execute code on the GitLab server through a crafted regular expression in a CI/CD configuration; GitLab states it could be exploited by an unauthenticated user under certain conditions.

Affected products and versions: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Self-managed installs that bring their own Ruby, such as source installs or custom container images, also need Ruby 3.3.13, 3.4.12 or 4.0.9, according to Alpine Linux’s incident report.

Severity: CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, assigned by GitLab as CNA).

Exploitation status: Confirmed in the wild. Alpine Linux reports that an attacker registered an account on its GitLab instance on 20 October 2026 and attacked it on 21 October, crashing worker processes eight times; Alpine found no evidence of success but cannot rule it out, and rebuilt the instance. Added to CISA KEV on 29 October 2026. Federal remediation due date 1 November 2026.

Patch status: Fixed in GitLab 19.4.2, 19.3.5 and 19.2.8, released 12 October 2026. Ruby fixes shipped upstream on 23 October 2026. Alpine notes that upgrading GitLab alone did not close the flaw on its own Ruby build.

What to do: Upgrade GitLab to 19.4.2, 19.3.5 or 19.2.8, and confirm the Ruby version on self-managed installs. Disable open self-registration on internet-facing GitLab instances, since the reported exploit path relies on an account that can write to a public project. Review CI/CD configurations and worker crash logs from 12 October 2026 onward.

Why it matters: A GitLab server holds source code, CI/CD secrets and deploy keys, so code execution there reaches every environment the pipelines deploy to. Alpine’s experience shows how a patch can be incomplete when the vulnerable code sits in a runtime the vendor does not control.

What it is: CVE-2026-111497 is an out-of-bounds write in Google’s reference C Brotli decoder that lets an attacker who can supply Brotli-compressed data corrupt process memory, leading to a crash, memory disclosure or remote code execution, without authentication. It was reported by OpenAI’s Codex Security team and circulates under three names: Node2Shell, HTTP2Shell and Broccoli2Shell.

Affected products and versions: The Brotli C library 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1, plus every product that bundles its own copy. Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1. Palo Alto Networks PAN-OS 11.2, 12.1 and 12.2 on PA-Series and VM-Series firewalls when TLS/SSL decryption and Brotli inspection are both enabled; PAN-OS 11.1 and 10.2, Panorama and the management interface are out of scope, because Brotli inspection only arrived in 11.2.4. The .NET runtime 8, 9, 10 and 11 RC, fixed in 8.0.33, 9.0.22 and 10.0.14, reached through ASP.NET Core request decompression, HttpClient automatic response decompression and the System.IO.Compression Brotli APIs; .NET Framework is not affected. PowerShell 7.4, 7.5 and 7.6, Visual Studio 2019, 2022 and 2026, the Python Brotli and brotlicffi packages, Bun, Envoy, Istio and Brotli4j. Still unpatched at the end of the window: DuckDB and Apache Arrow reading Brotli-compressed Parquet, plus 7-Zip-zstd, p7zip, EDK II firmware tooling and woff2 builds; ClickHouse took the fix on 25 October and backported it to its LTS lines.

Severity: CVSS 9.2 (CVSS 4.0, AV:N/AC:L/AT:P/PR:N/UI:N, assigned by Google as CNA); NVD scores it CVSS 9.8 under CVSS 3.1. The Node.js project rates it High, and Microsoft rates it critical for .NET and Visual Studio and important for PowerShell.

Exploitation status: Confirmed in the wild. ELLIO observed exploit traffic on 26 October 2026 at 15:08 UTC; the in-the-wild chain did not reach a working shell in ELLIO’s tests, while public proof-of-concept code exists. Wiz reports that 91 percent of cloud environments contain resources exposed to the flaw and 82 percent have publicly exposed Node.js instances. JFrog reproduced a remote crash in ClickHouse, native memory corruption in FFmpeg through JPEG XL, a .NET runtime crash and an infinite loop in Apache Arrow. Added to CISA KEV on 27 October 2026. Federal remediation due date 10 November 2026.

Patch status: Node.js fixed in 22.23.4, 24.22.1 and 26.12.1, released 22 October 2026, a day after the Brotli library itself. Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell. End-of-life Node.js lines receive no fix.

What to do: Treat this as a component inventory problem rather than a Node.js patch. Upgrade Node.js and rebuild container images, checking the Node.js release version rather than process.versions.brotli, which ELLIO notes was not bumped by the fix. On PAN-OS, confirm whether TLS decryption and Brotli inspection are both on before assuming you are exposed. Apply the Microsoft out-of-band updates for .NET, Visual Studio and PowerShell. Remember the outbound path as well as the inbound one: a Node.js service calling fetch() against a third-party API decompresses that server’s Brotli response through the same decoder. Where you cannot patch quickly, reject Brotli-compressed request bodies at the reverse proxy, and quarantine third-party Parquet with Brotli-compressed columns until DuckDB and Arrow ship fixes.

Why it matters: Brotli decompression happens before any route handler runs, so every endpoint of an affected API is exposed, not one feature. The flaw sits in one small C library that dozens of products carry a private copy of, which means a single CVE produced separate advisories from Google, Node.js, Microsoft, Palo Alto Networks and a dozen open-source projects, on different dates and with different fixed versions. That puts every Node.js-backed API on your external surface in scope alongside your firewalls, your .NET services and your data pipelines.

What it is: CVE-2026-76418 is an unchecked return value leading to a NULL pointer dereference (CWE-690) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software that lets an unauthenticated remote attacker force the device to reload.

Affected products and versions: Cisco ASA and FTD with webvpn SSL VPN enabled on at least one interface and secondary authentication configured on any tunnel group, including DefaultWEBVPNGroup. First fixed releases: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.

Severity: CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, assigned by Cisco as CNA).

Exploitation status: Confirmed in the wild. Cisco states its PSIRT became aware of active exploitation in October 2026. Added to CISA KEV on 29 October 2026. Federal remediation due date 1 November 2026.

Patch status: Fixed in the releases above, advisory first published 28 October 2026. Cisco states there are no workarounds and describes a temporary mitigation.

What to do: Upgrade ASA and FTD to the first fixed release for your branch. Until then, disable the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or remove secondary authentication if it does, accepting the weaker VPN posture. Watch for unexpected reloads of VPN headends.

Why it matters: Repeated reloads of a VPN headend cut remote access for the whole workforce, and an outage of the security perimeter is often the moment attackers use to try something else. A denial of service on an edge device is an availability incident with a security tail.

1Fake GitHub repositories and GitHub Pages sites, boosted by SEO poisoning, advertise AI desktop apps such as “GPT-5.6 Sol” and “Claude Opus” as ZIP downloads.

2Each ZIP holds a genuine, signed OpenAI or Anthropic installer alongside a malicious copy of a Windows multimedia library, which the signed installer loads in its place through DLL sideloading.

3The dropper checks its host process name, skips systems with CIS-region keyboard layouts other than Ukrainian, requires admin rights, and installs the loader beside a copied Windows Media Player component, launched by a SYSTEM scheduled task three minutes after boot.

4The loader fetches a Telegram channel’s profile image, turns its last 50 bytes into a dedyn.io domain, and queries Google DNS-over-HTTPS for a TXT record signed with Ed25519 that holds the payload URL.

5The loader downloads the next stage from a public file-hosting service; in this campaign the payload was a Monero cryptominer that connected over Tor.

Why it matters: The technique hides behind two kinds of trust at once: a signed AI-vendor binary on disk and Telegram and Google DNS traffic on the wire. Staff installing AI tools themselves has become an initial access path, and the loader can deliver any payload in a future wave.

CVE	Product	CVSS	Date added to KEV	Federal due date
CVE-2026-109618	PHP (memory corruption)	9.2, CVSS 4.0 (PHP)	26 Oct 2026	29 Oct 2026
CVE-2026-109619	PHP (stale request state)	9.2, CVSS 4.0 (PHP)	26 Oct 2026	29 Oct 2026
CVE-2026-48356	Adobe Commerce and Magento (PolyShell)	9.3 (CVE record); 9.6 (Adobe bulletin)	27 Oct 2026	10 Nov 2026
CVE-2026-111497	Google Brotli (Node2Shell)	9.2, CVSS 4.0 (Google); 9.8 (NVD)	27 Oct 2026	10 Nov 2026
CVE-2026-46300	Linux kernel (Fragnesia)	7.8 (Linux kernel CNA)	28 Oct 2026	31 Oct 2026
CVE-2026-41709	Broadcom VMware ESX (insufficient logging)	2.7 (VMware)	28 Oct 2026	11 Nov 2026
CVE-2026-76418	Cisco Secure Firewall ASA and FTD	8.6 (Cisco)	29 Oct 2026	1 Nov 2026
CVE-2026-97229	GitLab CE/EE	10.0 (GitLab)	29 Oct 2026	1 Nov 2026
CVE-2026-111357	Ivanti Connect Secure (privilege escalation)	8.8 (Ivanti); 7.0 (MITRE)	30 Oct 2026	2 Nov 2026
CVE-2026-118527	Ivanti Connect Secure (predictable identifiers)	4.3 (Ivanti)	30 Oct 2026	13 Nov 2026