PHP rce CVE-2026-109618 https://watchtowr.com/intelligence/php-cve-2026-109618-faq/

@secharvester

Two critical PHP RCE zero-days (CVE-2026-109618, CVE-2026-109619) leaked before patches were available — compressing the exploitation window to near zero. Details surfaced ahead of embargo, meaning defenders had no patch to deploy when attacker tooling began circulating. Web shells, C2 over outbound HTTP/S, and lateral movement through internal APIs are the expected post-compromise path. Runtime egress controls and east-west segmentation help restrict internal pivoting before patches can be applied.

#ZeroDay #CloudSecurity

🔗 Full TRC analysis: https://t.co/S3iJwBNcwM

PHP: Upcoming Critical Security Release

PHP’s security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2.

Public reporting identifies the issues as CVE-2026-109618 and CVE-2026-109619.

Technical details and affected-version information are scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

PHP may release earlier if vulnerability details become public or active exploitation is detected.

Local release times:

Copenhagen / Stockholm: 16:00 CEST · London: 15:00 BST

New York: 10:00 EDT · San Francisco: 07:00 PDT

Dubai: 18:00 GST · Singapore: 22:00 SGT

SecPoint encourages organizations to review potentially affected systems, coordinate with hosting providers and prepare to apply the appropriate security updates promptly once available.

#PHP #CyberSecurity #CVE-2026-109619 #CVE-2026-109618 #SecPoint

Two critical PHP RCE zero-days (CVE-2026-109618, CVE-2026-109619) leaked before patches were available — compressing the exploitation window to near zero. Details surfaced ahead of embargo, meaning defenders had no patch to deploy when attacker tooling began circulating. Web shells, C2 over outbound HTTP/S, and lateral movement through internal APIs are the expected post-compromise path. Runtime egress controls and east-west segmentation help restrict internal pivoting before patches can be applied.

#ZeroDay #CloudSecurity

🔗 Full TRC analysis: https://t.co/S3iJwBNcwM

PHP: Upcoming Critical Security Release

PHP’s security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2.

Public reporting identifies the issues as CVE-2026-109618 and CVE-2026-109619.

Technical details and affected-version information are scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

PHP may release earlier if vulnerability details become public or active exploitation is detected.

Local release times:

Copenhagen / Stockholm: 16:00 CEST · London: 15:00 BST

New York: 10:00 EDT · San Francisco: 07:00 PDT

Dubai: 18:00 GST · Singapore: 22:00 SGT

SecPoint encourages organizations to review potentially affected systems, coordinate with hosting providers and prepare to apply the appropriate security updates promptly once available.

#PHP #CyberSecurity #CVE-2026-109619 #CVE-2026-109618 #SecPoint

🚨 Two critical PHP RCE bugs (CVE-2026-109618 and CVE-2026-109619, CVSS 10) go public tomorrow. They affect default PHP core installs, plus WordPress, Laravel, Drupal, Magento, Joomla, Symfony and more.

The patch lands tomorrow. If you run PHP in prod, get ready to patch the moment it's out.

after exhausting days in Ukraine, filled with physical and cyber attacks, I open twitter to relax and take my mind off things.

today: php criticals, eMudhra certs, CVE-2026-99999.

at this point, should I just rebrand incident response as self-care and call it a day? 🙄

Installed is not patched.

My VPS got a new Linux kernel on 14 October and ran the old one until 19 October, when @contabocom rebooted its hosts for CVE-2026-99999 (PwnEscape).

Check uname -r, not the package list.

#Linux #CyberSecurity https://t.co/ttWiIyk6Ld

PwnEscape (CVE-2026-99999, 9.3) lets a KVM guest reach the host with a few malformed IPv4 packets.

On Proxmox or plain KVM: patch the host kernel, then actually reboot. A kernel update without a reboot is just a downloaded file.

uname -r tells the truth.

#Linux #security

#ParsedReport #CompletenessHigh 15-10-2026

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Report completeness: High

Actors/Campaigns: Cl-unk-1211

Threats: Credential_harvesting_technique Sysgorat Netcat_tool Timestomp_technique React2shell_vuln Gsocket_tool Pwnkit_tool Linpeas_tool Revsocks_tool Pysoxy_tool Gs-netcat

Victims: Government entities, State affiliated infrastructure, Government mail servers, Linux server infrastructure

Industry: Government

CVEs: CVE-2025-55182 [Vulners] CVSS V3.1: 10.0, Vulners: Exploitation: True Soft: - facebook react (19.0.0, 19.1.0, 19.1.1, 19.2.0)

CVE-2021-4034 [Vulners] CVSS V3.1: 7.8, Vulners: Exploitation: True Soft: - polkit_project polkit (<121)

TTPs: Tactics: 6 Technics: 0

IOCs: File: 7 IP: 18 Command: 1 Hash: 10 Domain: 4

Soft: Linux, WildFire, php-fpm, Plesk, sudo, systemd, crontab, MSSQL, sshpass, curl, have more...

Algorithms: base64, gzip, zip, sha256

Languages: javascript, php, python

Platforms: cross-platform

Links: https://github.com/kost/revsocks https://github.com/ly4k/PwnKit https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS have more...

#ParsedReport #CompletenessHigh 15-10-2026

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Report completeness: High

Actors/Campaigns: Cl-unk-1211

Threats: Credential_harvesting_technique Sysgorat Netcat_tool Timestomp_technique React2shell_vuln Gsocket_tool Pwnkit_tool Linpeas_tool Revsocks_tool Pysoxy_tool Gs-netcat

Victims: Government entities, State affiliated infrastructure, Government mail servers, Linux server infrastructure

Industry: Government

CVEs: CVE-2025-55182 [Vulners] CVSS V3.1: 10.0, Vulners: Exploitation: True Soft: - facebook react (19.0.0, 19.1.0, 19.1.1, 19.2.0)

CVE-2021-4034 [Vulners] CVSS V3.1: 7.8, Vulners: Exploitation: True Soft: - polkit_project polkit (<121)

TTPs: Tactics: 6 Technics: 0

IOCs: File: 7 IP: 18 Command: 1 Hash: 10 Domain: 4

Soft: Linux, WildFire, php-fpm, Plesk, sudo, systemd, crontab, MSSQL, sshpass, curl, have more...

Algorithms: base64, gzip, zip, sha256

Languages: javascript, php, python

Platforms: cross-platform

Links: https://github.com/kost/revsocks https://github.com/ly4k/PwnKit https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS have more...

#threatreport #HighCompleteness AI-Powered Espionage Campaign Targets Government Linux Infrastructure | 15-10-2026 Source: https://t.co/dvzgA83OFm Key details below ↓

🧑‍💻Actors/Campaigns: Cl-unk-1211

💀Threats: Credential_harvesting_technique, Sysgorat, Netcat_tool, Timestomp_technique, React2shell_vuln, Gsocket_tool, Pwnkit_tool, Linpeas_tool, Revsocks_tool, Pysoxy_tool, Gs-netcat, 🎯Victims: Government entities, State affiliated infrastructure, Government mail servers, Linux server infrastructure

🏭Industry: Government

🔓CVEs: CVE-2025-55182 [Vulners]

CVE-2021-4034 [Vulners]

📚TTPs: ⚔️Tactics: 6 🛠️Technics: 0

🧨IOCs:

💽Software: Linux, WildFire, php-fpm, Plesk, sudo, systemd, crontab, MSSQL, sshpass, curl, ...

🔢Algorithms: zip, gzip, base64, sha256

📜Programming Languages: javascript, php, python

💻Platforms: cross-platform

#threatreport: Unit 42 attributed activity observed from October 2025 through April 2026 to the unattributed cluster CL-UNK-1211. The campaign targeted government entities and state-affiliated infrastructure, primarily Linux servers and database environments. Attackers sought persistent access, conducted extensive network and mailbox reconnaissance, dumped sensitive databases, and attempted to steal government email data to identify credentials or links associated with external social media accounts.

Initial access and persistence relied heavily on PHP web shells, including custom and open-source shells. The attackers modified the auto_prepend_file setting across PHP configurations in /etc/php/ and /opt/plesk/php/, causing malicious code to execute before legitimate PHP scripts. A web shell named plesk_sys_driver.php was placed in /usr/lib/php/ to appear legitimate. Credential theft included replacing .bashrc with a malicious version that intercepted passwords entered through sudo, adding credential-logging code to PHP login pages, and scanning networks for cleartext passwords.

The attackers deployed SysGoRAT, a custom Go-based, cross-platform remote access Trojan for Windows and Linux. It communicated with operators over WebSocket, using a hardcoded IP address and supporting multiple command and persistence functions. They also used in-memory reverse shells through Netcat named pipes and Python subprocesses, reducing disk-based forensic evidence. Persistence and lateral movement included SSH public keys added to authorized_keys, hardcoded administrative credentials used with sshpass, and tunneling tools such as revsocks, pysoxy, and GSocket/gs-netcat.

Privilege escalation and reconnaissance involved LinPEAS, the PwnKit exploit for CVE-2021-4034, renamed SUID-enabled binaries, and scripts that scanned for SQL servers, databases, users, computers, and open shares. A custom Go scanner targeted systems vulnerable to CVE-2025-55182, referred to as React2Shell. Attackers also enabled MSSQL XP_CMDSHELL to execute operating-system commands and create double-hop paths between network segments.

For data theft, they enumerated Qmail mailboxes, searched messages for social-media-related terms, dumped database tables to CSV files, compressed archives locally, and attempted exfiltration through Netcat and legitimate file-hosting services. Defense evasion included attempts to terminate endpoint-security processes, timestomping, clearing logs and shell history, deleting residual files, using misleading names such as Solarwinds.StatusLog.txt, and planting red-team-themed indicators including RedTeamOps2025 and pentest123. Scripts showed extensive Base64 encoding and apparent AI-assisted generation across PHP, Bash, Python, and JavaScript.

The uncomfortable part of this curl flaw is that sending data can be the dangerous operation.

Teams naturally scrutinize downloads from untrusted systems. CVE-2026-92392 reverses that intuition: the documented path begins when a client uploads over HTTP/2 and the receiving server manipulates stream handling during cleanup.

That matters for backup exporters, CI jobs, telemetry pipelines, API clients, and automation that sends artifacts outward. Egress is not automatically a lower-risk trust boundary.

Do your threat models treat outbound application connections as carefully as inbound ones?

#LinuxSecurity #DevSecOps #ThreatDetection #CyberSecurity https://t.co/9xVa16axBl

CVE-2026-92392: HTTP/2 upload Use-After-Free https://t.co/GU3WUDjMVg

A closed lab just did free security work for open source

OSS Scanner, 11 days in >650 projects applied >114 accepted >77 critical and 803 high findings

An early build of OSS Scanner found CVE-2026-92392 in curl, a bug Daniel Stenberg called one of curl's worst in a long time...