This edition focuses on PHP2Shell: two critical flaws in the PHP runtime itself, for which attack attempts have already been observed and which led Dutch government services such as DigiD and MijnOverheid to go offline as a precaution. In addition, GitLab has fixed a CVSS 10.0 flaw affecting all self-managed versions since 2014, and Palo Alto Networks and Unit 42 report that ransomware groups are using the GlobalProtect flaw in PAN-OS to get through the VPN to vCenter and Veeam.
- PHP2Shell: two critical RCE flaws in the PHP runtime, first attack attempts already seen
- GitLab fixes critical flaw with maximum score: unauthenticated code execution on self-managed servers
- Ransomware groups exploit GlobalProtect flaw in PAN-OS and move on to vCenter and Veeam
PHP2Shell: two critical RCE flaws in the PHP runtime, first attack attempts already seen
| Vulnerability | Two bugs in the PHP runtime itself, not in an application: an out-of-memory bug and a bug relating to session upload progress. They allow unauthenticated remote code execution. Vulnerable versions are PHP 8.5 below 8.5.12, 8.4 below 8.4.27, 8.3 below 8.3.36 and 8.2 below 8.2.35, and according to reports virtually all versions going back to PHP 5.4 |
| CVE number | CVE-2026-109618 and CVE-2026-109619 |
| CVSS score | 9.2 for both (CVSS v4.0, according to PHP) |
| Actively exploited | Attack attempts have been seen: Cloudflare reported attack traffic and watchTowr reported active attempts for both CVEs on 21 October 2026. No confirmed breaches have been reported and the flaws are not yet in the CISA KEV catalogue |
| Patch available | Yes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source code backports have been published for 7.4, 8.0 and 8.1. Distributions patched early and sometimes retain old version numbers |
How can the vulnerability be exploited?
According to The Hacker News, the attack targets the runtime, before any application code runs. With mod_php, a demonstrated exploit shows that a single unauthenticated request is enough. With PHP-FPM, code execution has been demonstrated for the session bug, although this depends on an action in the running application. Even a simple ‘Hello World’ page on a vulnerable version can be a target. The bugs were discovered by Wiz Research, Calif and OpenAI’s Codex Security team. Disclosure did not go to plan: on 20 October the announcement leaked and Calif accidentally posted a video of a working proof of concept, after which PHP brought the release forward to 21 October.
What could the impact be?
Attackers can read the working memory of PHP workers, which may contain passwords, tokens, API keys and certificates from other requests, and in the worst case execute code on the server. In the Netherlands, according to Dutch public broadcaster NOS, MijnOverheid, DigiD and the website of the Dutch House of Representatives were among the services taken offline as a precaution. The Dutch NCSC saw no exploitation. For hosting providers and MSPs with managed web servers, this is a flaw in the layer you are responsible for as an administrator: updating WordPress or Laravel does not update the runtime.
What should IT administrators do now?
Update PHP via the server package, the host or the container image, then restart Apache, PHP-FPM and other long-running workers. For distribution packages, check the changelog for the CVEs rather than the version number. If you cannot patch yet, set session.upload_progress.enabled to 0, set memory_limit to -1 and keep post_max_size low. This does not cover all variants. Look out for signs of an earlier breach: unusual multipart requests followed by memory errors, repeated HTTP 500 errors, unusually large PHPSESSID cookies and unexplained worker restarts. PHP 8.2 reaches end of life on 31 December 2026, so plan your migration.
GitLab fixes critical flaw with maximum score: unauthenticated code execution on self-managed servers
| Vulnerability | Integer overflow when compiling a specially crafted regular expression in Onigmo, the Ruby regex engine that GitLab ships itself. Affects self-managed GitLab from 7.0 up to and including 18.11 (below 18.11.13), 19.0 below 19.0.10, 19.1 below 19.1.9, 19.2 below 19.2.9, 19.3 below 19.3.6, 19.4 below 19.4.3 and 19.5 below 19.5.1 |
| CVE number | CVE-2026-110264 |
| CVSS score | 10.0 |
| Actively exploited | No, GitLab sees no indication of exploitation and the flaw is not in the CISA KEV catalogue as of 22 October 2026 |
| Patch available | Yes, 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. There is no workaround |
How can the vulnerability be exploited?
According to The Hacker News, an unauthenticated attacker can use the overflow to execute code on the server ‘under certain conditions’, which GitLab does not specify. Administrators therefore cannot rule themselves out based on their configuration. It is the fourth code execution bug in GitLab’s regex engine within a month, reported by a researcher going by the name joaxcar, and the first to also affect versions prior to 19.2.
What could the impact be?
A compromised GitLab server provides access to source code, CI/CD secrets, deploy tokens and often the environments they deploy to. For MSPs that host GitLab themselves for clients or use it internally, this is a direct route into client environments. GitLab.com and Dedicated tenants on the patched versions are already safe.
What should IT administrators do now?
Upgrade to the patched version for your branch. If you patched on 12 October and are running 19.2 or later, you are vulnerable again, as that update did not include this fix. Versions 19.4.3 and 19.3.6 include database migrations, so expect downtime on a single-node installation. Until patching is complete, take GitLab off the open internet or put it behind a VPN, and use the two Sigma rules published by GitLab (‘Onigmo native worker crash’ and ‘Org mode render error burst’) to search the application logs.
Ransomware groups exploit GlobalProtect flaw in PAN-OS and move on to vCenter and Veeam
| Vulnerability | Authentication bypass in the GlobalProtect portal and gateway of PAN-OS, allowing attackers to establish a VPN session without valid authentication and bypassing MFA |
| CVE number | CVE-2026-0257 |
| Actively exploited | Yes, in the CISA KEV catalogue since 13 May 2026. On 19 October 2026, Unit 42 reported exploitation by ransomware groups, including Qilin and Inc |
| Patch available | Yes, via a fixed PAN-OS version or the workarounds in Palo Alto Networks’ advisory. Check the advisory for the correct version for each branch |
How has it been exploited?
According to the updated Threat Brief from Unit 42, attackers use the bypass to get onto the VPN, explore the network with legitimate remote monitoring and management tools and move laterally via RDP and SMB. Previously only scanning of GlobalProtect had been reported; Unit 42 now also describes post-access activity. The same groups are known as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc).
What could the impact be?
In one investigated case, attackers jumped from the VPN gateway to a vCenter appliance, disabled security on ESXi hosts and extracted offline credentials from the virtual disk of a domain controller. Some actors combined this with exploitation of Veeam infrastructure (CVE-2023-27532). For MSPs with Palo Alto firewalls at client sites, the chain from VPN to hypervisor to backup is precisely the scenario in which encryption and the loss of backups come together.
What should IT administrators do now?
Patch PAN-OS or apply the workarounds from Palo Alto Networks’ advisory. Search the GlobalProtect logs for successful logins from the IP addresses in the Unit 42 report and for device names such as WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. Check whether GlobalProtect profiles are linked to HTTP/HTTPS services on management interfaces and restrict administrative access with Interface Management profiles. Test externally whether ports 4443 and 3879 on your management address are reachable. If you find a match, activate your incident response process and also check vCenter, ESXi and your Veeam version.
This article was originally published in Dutch on MSP Business. Read the original →
