This edition focuses on PHP, which runs on most web servers: two critical flaws have been confirmed as actively exploited and were added to the CISA catalogue yesterday. In addition, attackers are stealing Microsoft 365 tokens that render MFA no obstacle, and Tailscale SSH is awaiting a patch for serious privilege escalation.
- Critical PHP2Shell flaws in PHP actively exploited: CISA gives US government agencies until 29 October
- Token replay in Microsoft 365: 97 accounts at 79 organisations taken over despite MFA
- Tailscale SSH: researcher demonstrates privilege escalation to root, patch expected within 24 hours
Critical PHP2Shell flaws in PHP actively exploited: CISA gives US government agencies until 29 October
| Vulnerability | Two critical vulnerabilities in PHP (PHP2Shell) that allow unauthenticated remote code execution: memory corruption under low-memory conditions and a stale internal request state |
| CVE number | CVE-2026-109618 and CVE-2026-109619 |
| CVSS score | 9.2 (both) |
| Actively exploited | Yes. CISA added both to the KEV catalogue on 26 October 2026; successful code execution on a honeypot reported on 24 October |
| Patch available | Yes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released on 21 October 2026) |
How has this been exploited?
According to The Hacker News, Adel Karimi of Perplexity reported on 24 October that he had successfully executed code on honeypots using a public exploit. He cautions, however, that this was achieved in a deliberately favourable setup with a single mod_php worker, so reliability in other configurations remains unknown. Meanwhile, Palo Alto Networks’ Unit 42 withdrew its claim that a breach at a European government was linked to these flaws.
What could the impact be?
PHP runs on around 70 per cent of all websites, and Censys counts more than 32.5 million PHP services running a vulnerable version. For MSPs with hosting or web clients, this means CMS sites, online shops and customer portals could be taken over directly. The PHP developers are also warning of a third RCE risk for which no patch is yet available. Windows builds additionally received a second update because of a Brotli bug, which is reachable via cURL when automatic decompression of HTTP responses is enabled.
What should IT administrators do now?
Take an inventory of all PHP servers, both your own and your clients’, including shared hosting and containers, and update to one of the patched versions. On Windows, install the rebuilt packages with the fixed Brotli library. Disable automatic decompression in cURL where you do not need it, and check logs for unusual requests with large cookies since 21 October.
Token replay in Microsoft 365: 97 accounts at 79 organisations taken over despite MFA
| Vulnerability | Abuse of stolen Microsoft 365 sign-in tokens via phishing pages that sit between the user and Microsoft (adversary-in-the-middle) and via device code phishing. This involves abuse of legitimate sign-in flows, not a software bug |
| CVE number | No CVE assigned |
| Actively exploited | Yes, observed by Huntress from 14 July to 22 September 2026 (published on 26 October) |
| Patch available | No, this is not a software flaw. It can be mitigated with Conditional Access and by cleaning up residual access |
How has this been exploited?
According to The Hacker News, Huntress based its findings on almost 200,000 failed login attempts from the 193.26.115.0/24 range, which resulted in 497 successful sign-ins. The attackers stole tokens via spoofed login pages, device code phishing and social engineering, and replayed them within minutes from their own systems. Huntress calls this ‘token spraying’. Because the token has already been issued after the MFA step, the attacker no longer needs a second factor.
What could the impact be?
In total, 97 accounts at 79 organisations were affected. In at least 19 organisations, the attackers removed existing MFA methods and registered their own method within three hours. Some 48 fake devices were registered in Entra, which continue to provide access until the devices are removed. Hidden inbox rules deleted or moved emails about salaries, deposits and bonuses, and one mailbox sent spam to hundreds of external recipients. This is consistent with preparation for invoice and payment fraud.
What should IT administrators do now?
Revoke sessions and reset passwords for suspicious accounts. Check Entra for unknown devices, changed MFA methods, new enterprise applications and inbox rules with cryptic names. Restrict the device code flow with Conditional Access and enforce MFA for all users, all cloud apps and all client types.
Tailscale SSH: researcher demonstrates privilege escalation to root, patch expected within 24 hours
| Vulnerability | Multiple vulnerabilities (‘Tailworm’, 11 findings) in Tailscale SSH and related components. In the lab, a compromised device can gain root on other servers if SSH forwarding is enabled. Tested on Tailscale 1.104.2 and headscale 0.29.5 |
| CVE number | No CVE assigned |
| Actively exploited | No, no exploitation reported; the findings come from lab tests on 25 October 2026 and the proof of concept is not public |
| Patch available | Not yet. Tailscale confirmed serious issues on 27 October and is aiming for a release within 24 hours; until then, the measures below apply |
How could the vulnerability be exploited?
According to The Hacker News, the research was published by Erica Windisch of Cyberdione Labs. The attacker must already control a device on the network that the access rules permit to reach the target. Using SSH forwarding, a swapped socket and a race condition, she was able in the lab to gain root and to have her own machine accepted as a trusted server. The claim that the flaws are ‘wormable’ is disputed by other researchers, and the final step did not work with Tailnet Lock enabled.
What could the impact be?
For MSPs that use Tailscale for administrative access to client servers, a single compromised device could escalate to root privileges on multiple systems. Tailscale VP Mike Shaver does not recommend disabling Tailscale SSH, and Tailscale describes the issues as primarily privilege escalation.
What should IT administrators do now?
Disable SSH forwarding, either per rule in the hosted service or with TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment (the only option on headscale 0.29.5). Write access rules as individual source-destination pairs and remove broad identity or tag grants. Remove app connector permissions and tailscale serve forwarding to a Unix socket if you do not need them, and enable node key expiry. Install the update as soon as it becomes available.
This article was originally published in Dutch on MSP Business. Read the original →
