EN PT-BR
← Voltar ao feed
critical exploit público government critical infrastructure

Recorded Future October 2026 CVE landscape: 82 high-impact flaws, PHP2Shell–Fragnesia root chain, Warlock ransomware and FortiManager data theft

1 fonte(s) · 1 atualização(ões) · publicado 05/11/2026 21:00 · coletado há 1 hora

Insikt Group (Recorded Future) reports 82 high-impact vulnerabilities prioritized for remediation in October 2026, 52 of them rated Very Critical by the Recorded Future Risk Score — a 13% drop from the 94 of September. 36 were surfaced through the CISA KEV catalog, 33 came from validated open sources and 13 exclusively from honeypot data; 69 were assessed as actively exploited or operationally weaponized. The flaws spanned 51 vendors, with Citrix and Microsoft together accounting for about 15%, and 37 of the 82 enabled remote code execution. The month was dominated by the PHP2Shell pair CVE-2026-109618 and CVE-2026-109619, chained with the Linux kernel flaw Fragnesia (CVE-2026-46300) to obtain root on 25 servers, alongside Longlegs (Storm-2603) deploying Warlock ransomware via the SharePoint ToolShell chain and CL-STA-0954 stealing data from Fortinet estates. Public PoCs or scanners existed for 37 of the 82 CVEs, and the most common weakness class was CWE-78 (OS command injection, eight flaws), followed by CWE-287 (seven), CWE-22 and CWE-77 (six each).

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • PHP2Shell chain: Dream Research reported root access on 25 servers, including systems in a US government-affiliated environment. PHP2Shell gave initial access and Fragnesia privilege escalation; the actor deployed web shells, stole configurations, credentials and private keys, kept reverse SSH tunnels into internal networks, decrypted service-account passwords and enumerated Active Directory. Domain-account creation was attempted but not confirmed.
  • PHP2Shell root cause: memory-lifecycle failures allowing unauthenticated RCE, with Apache mod_php the most exposed configuration; several early public PoCs were unvalidated. Reporting from SOCRadar and AkatsukiLegion described actor-staged exploits, prerequisite checks and a memory-leak-to-command-execution chain.
  • Pre-positioning: PHP2Shell tooling was found on an extortion actor's staging server, and CYFIRMA assessed suspected North Korean preparations using 21 compromised nodes to probe 216 hosts, linking the activity to the Lazarus Group with moderate confidence. No successful PHP2Shell compromise was established from these preparations.
  • Botnet activity: Arctic Wolf and Cisco Talos observed probes and payload-download attempts tied to Potassium, a Mirai-derived botnet; Linux bots reported by Joe Security and Nextron Research showed remote-shell, evasion and DoS capability plus PHP2Shell testing, scanning and persistence. Successful malware delivery through PHP2Shell was not confirmed.
  • Separate PHP flaw: CVE-2026-115560, distinct from PHP2Shell, could allow unauthenticated RCE in applications that switch session serializers while session upload progress is enabled. No in-the-wild exploitation was established, and the initial PHP2Shell patches did not fix it.
  • Ransomware and data theft: Longlegs / Storm-2603 exploited CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 (SharePoint Server); Symantec reported lateral movement into critical-infrastructure organizations, privilege changes, credential spraying, remote-access tunnels, disabling of endpoint protection and staging of Warlock binaries in a domain replication path so replication spread them between domain controllers. Longlegs separately abused CVE-2025-1055 (K7 Anti-Malware) through the signed K7RKScan driver to kill protected security processes.
  • PAN-OS: exploitation of CVE-2026-0257 was linked to Qilin, Settra and Tarnished Scorpius, overlapping with activity Recorded Future tracks as INC Ransom, with BloodHound and SharpHound used to map Active Directory.
  • Fortinet: CL-STA-0954 exploited CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS); Unit 42 reported command execution, theft of data tied to more than 500 managed FortiGate firewalls, traffic interception and deployment of PEERSTITCH.
  • Other October activity named includes Integrity Technology Group-enabled espionage, CyberXero AI-assisted exploitation and ClingSTUN deployment. Ten of the 82 flaws were at least five years old, the oldest roughly 16 years.
  • Corroboration of the PHP2Shell timeline: patches were released on October 21, 2026 at 14:00 UTC, exploitation attempts began October 17, and CISA added both CVEs to KEV on October 26 with an FCEB due date of October 29 (socradar.io).

Remediação

  • Prioritize the KEV-listed flaws of the month, patching both the PHP2Shell entry point and the Linux kernel for Fragnesia, and the SharePoint, PAN-OS, FortiManager and FortiOS flaws under active ransomware and espionage exploitation.
  • Pending a separate fix for CVE-2026-115560, PHP recommends disabling session upload progress.
  • Insikt Group published Nuclei templates for the two PHP2Shell CVEs and for CVE-2026-87902 (WordPress) and CVE-2026-86124 (AutoAgent), plus Sigma rules for Linux and Windows detecting web or PHP workers spawning shells (including PowerShell) and Suricata/Snort rules for multipart session-ID and upload-progress requests. Network detection requires visible HTTP bodies, and alerts should be correlated with process creation, worker errors and outbound activity because single matches can be benign.
  • Public PoCs referenced in the report were not tested for accuracy and should be validated before use.

Linha do tempo

  1. recordedfuture.com ↗ · pub. 05/11/2026 21:00 · coletado 06/11 17:00 primeiro registro

    Recorded Future October 2026 CVE landscape: 82 high-impact flaws, PHP2Shell–Fragnesia root chain, Warlock ransomware and FortiManager data theft

    ler a análise desta fonte

    Insikt Group (Recorded Future) reports 82 high-impact vulnerabilities prioritized for remediation in October 2026, 52 of them rated Very Critical by the Recorded Future Risk Score — a 13% drop from the 94 of September. 36 were surfaced through the CISA KEV catalog, 33 came from validated open sources and 13 exclusively from honeypot data; 69 were assessed as actively exploited or operationally weaponized. The flaws spanned 51 vendors, with Citrix and Microsoft together accounting for about 15%, and 37 of the 82 enabled remote code execution. The month was dominated by the PHP2Shell pair CVE-2026-109618 and CVE-2026-109619, chained with the Linux kernel flaw Fragnesia (CVE-2026-46300) to obtain root on 25 servers, alongside Longlegs (Storm-2603) deploying Warlock ransomware via the SharePoint ToolShell chain and CL-STA-0954 stealing data from Fortinet estates. Public PoCs or scanners existed for 37 of the 82 CVEs, and the most common weakness class was CWE-78 (OS command injection, eight flaws), followed by CWE-287 (seven), CWE-22 and CWE-77 (six each).

    Technical Details

    • PHP2Shell chain: Dream Research reported root access on 25 servers, including systems in a US government-affiliated environment. PHP2Shell gave initial access and Fragnesia privilege escalation; the actor deployed web shells, stole configurations, credentials and private keys, kept reverse SSH tunnels into internal networks, decrypted service-account passwords and enumerated Active Directory. Domain-account creation was attempted but not confirmed.
    • PHP2Shell root cause: memory-lifecycle failures allowing unauthenticated RCE, with Apache mod_php the most exposed configuration; several early public PoCs were unvalidated. Reporting from SOCRadar and AkatsukiLegion described actor-staged exploits, prerequisite checks and a memory-leak-to-command-execution chain.
    • Pre-positioning: PHP2Shell tooling was found on an extortion actor's staging server, and CYFIRMA assessed suspected North Korean preparations using 21 compromised nodes to probe 216 hosts, linking the activity to the Lazarus Group with moderate confidence. No successful PHP2Shell compromise was established from these preparations.
    • Botnet activity: Arctic Wolf and Cisco Talos observed probes and payload-download attempts tied to Potassium, a Mirai-derived botnet; Linux bots reported by Joe Security and Nextron Research showed remote-shell, evasion and DoS capability plus PHP2Shell testing, scanning and persistence. Successful malware delivery through PHP2Shell was not confirmed.
    • Separate PHP flaw: CVE-2026-115560, distinct from PHP2Shell, could allow unauthenticated RCE in applications that switch session serializers while session upload progress is enabled. No in-the-wild exploitation was established, and the initial PHP2Shell patches did not fix it.
    • Ransomware and data theft: Longlegs / Storm-2603 exploited CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 (SharePoint Server); Symantec reported lateral movement into critical-infrastructure organizations, privilege changes, credential spraying, remote-access tunnels, disabling of endpoint protection and staging of Warlock binaries in a domain replication path so replication spread them between domain controllers. Longlegs separately abused CVE-2025-1055 (K7 Anti-Malware) through the signed K7RKScan driver to kill protected security processes.
    • PAN-OS: exploitation of CVE-2026-0257 was linked to Qilin, Settra and Tarnished Scorpius, overlapping with activity Recorded Future tracks as INC Ransom, with BloodHound and SharpHound used to map Active Directory.
    • Fortinet: CL-STA-0954 exploited CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS); Unit 42 reported command execution, theft of data tied to more than 500 managed FortiGate firewalls, traffic interception and deployment of PEERSTITCH.
    • Other October activity named includes Integrity Technology Group-enabled espionage, CyberXero AI-assisted exploitation and ClingSTUN deployment. Ten of the 82 flaws were at least five years old, the oldest roughly 16 years.
    • Corroboration of the PHP2Shell timeline: patches were released on October 21, 2026 at 14:00 UTC, exploitation attempts began October 17, and CISA added both CVEs to KEV on October 26 with an FCEB due date of October 29 (socradar.io).

    Remediation

    • Prioritize the KEV-listed flaws of the month, patching both the PHP2Shell entry point and the Linux kernel for Fragnesia, and the SharePoint, PAN-OS, FortiManager and FortiOS flaws under active ransomware and espionage exploitation.
    • Pending a separate fix for CVE-2026-115560, PHP recommends disabling session upload progress.
    • Insikt Group published Nuclei templates for the two PHP2Shell CVEs and for CVE-2026-87902 (WordPress) and CVE-2026-86124 (AutoAgent), plus Sigma rules for Linux and Windows detecting web or PHP workers spawning shells (including PowerShell) and Suricata/Snort rules for multipart session-ID and upload-progress requests. Network detection requires visible HTTP bodies, and alerts should be correlated with process creation, worker errors and outbound activity because single matches can be benign.
    • Public PoCs referenced in the report were not tested for accuracy and should be validated before use.