EN PT-BR
← Voltar ao feed
critical exploit público government technology

Cybersecurity Black October: PHP2Shell exploited and chained with Fragnesia against PAN-OS, Brotli Node2Shell, LiteLLM supply-chain compromise, GitLab RCE and emSign CA failure

2 fonte(s) · 2 atualização(ões) · publicado 28/10/2026 07:33 · coletado há 2 dias

ESET reviews the week ending October 25, 2026, in which defenders faced a simultaneous wave of critical issues: the PHP2Shell memory-safety flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2, PHP 5.4–8.5.11, unauthenticated RCE), unpatched Linux kernel KSMBD vulnerabilities disclosed publicly by Trend Micro ZDI before fixes existed, a LiteLLM release pipeline compromise pushing malicious package 1.107.0 to PyPI and container registries, the Node2Shell/HTTP2Shell Brotli out-of-bounds write (CVE-2026-111497), a GitLab CVSS 10.0 integer overflow RCE (CVE-2026-110264), and the eMudhra/emSign compromised intermediate CA keys affecting Python TLS trust bundles. Government sites in the Netherlands, Germany and France were taken offline as a precaution over PHP2Shell, though ESET and eight other vendors told NBC News on October 22 they had seen no successful attacks despite 200+ public PoCs. AI-assisted research surfaced at least two of the flaws (PHP2Shell and the Brotli bug, the latter reported by OpenAI Codex Security). The article stresses that CVSS scores alone did not predict real exploitability, and that several incidents required containment and credential rotation rather than simple patching.

SentinelOne's Week 44 roundup (sentinelone.com) shows the situation has since escalated to confirmed exploitation. It says mass Log4Shell-style exploitation of PHP2Shell has not materialized, since heap layouts and worker states vary by PHP version, build and SAPI, but targeted compromises have occurred. CISA added both PHP2Shell CVEs to KEV (federal deadline October 29), added the Brotli flaw CVE-2026-111497 on October 27 (deadline November 10), and added the Linux kernel flaw Fragnesia (CVE-2026-46300) under BOD 26-04. Threat actors are chaining PHP2Shell with Fragnesia, and researchers found an operation that rooted 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment (sentinelone.com).

Entenda a falha

A vulnerabilidade

Most severe is GitLab CVE-2026-110264 (CVSS 10.0): an integer overflow when compiling a crafted regular expression gives unauthenticated RCE in versions back to 7.0. It is fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS v4.0 9.2) is two memory-safety bugs in PHP core allowing unauthenticated RCE in PHP 5.4 to 8.5.11, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CVE-2026-111497 (Node2Shell) is an out-of-bounds write in the Brotli decoder (1.0.3 to 1.2.0), fixed in Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4. Fragnesia (CVE-2026-46300) is a local root escalation in Linux kernels released before May 13, 2026. Two KSMBD flaws (ZDI-CAN-33549, ZDI-CAN-33774, CVSS 9.0) allow RCE and had no fixes at disclosure.

Como funciona

In PHP2Shell, a crafted request stream reaches PHP and, in the highest-risk setups, the memory-safety bug can be triggered before application code runs, so application authentication does not help. SentinelOne says attackers must line up memory blocks with crafted request streams before triggering an out-of-memory error, and heap layout varies by PHP version, build and SAPI. In observed attacks, PHP2Shell first implants a web shell, then Fragnesia, a logic defect in the Linux XFRM ESP-in-TCP subsystem that leaves stale page-cache writes exploitable, escalates that shell to root. In Brotli, malformed compressed data arrives through explicit decompression, compressed request bodies or auto-decompressed responses, and invalid stream block switches make the decoder write outside its buffer. In GitLab, a crafted regular expression overflows an integer during compilation. ZDI-CAN-33549 is reached only after SMB Direct is negotiated.

Por que é vulnerável

The articles classify PHP2Shell as memory-safety bugs in PHP core and do not name the missing check. The Brotli bug is an out-of-bounds write on invalid stream block switches, and upstream silently fixed the code on February 27 with no advisory or CVE, so downstream projects stayed exposed until October. Fragnesia is a logic defect, GitLab's is an integer overflow, and KSMBD's are an integer underflow and a race condition. The fixes are new releases; the articles do not detail the code changes.

Onde está

The articles name only components, not files or functions: the SMB Direct path of the Linux KSMBD server, the XFRM ESP-in-TCP subsystem for Fragnesia, the Brotli decoder bundled by Node.js, and regular expression compilation in GitLab.

Como foi descoberta

AI-assisted research helped uncover at least PHP2Shell and the Brotli bug; the story credits the Brotli report to OpenAI Codex Security. PHP2Shell's coordinated disclosure was pushed earlier by a premature leak, and fixes shipped on October 21. Brotli's coordinated disclosure was also October 21, months after the silent upstream fix. On October 21 Trend Micro ZDI sent reports on unpatched kernel flaws to the private security address while copying public lists, drawing criticism from Greg Kroah-Hartman. Exploitation later appeared in the wild: CISA added both PHP2Shell CVEs to KEV (deadline October 29), CVE-2026-111497 on October 27 (deadline November 10) and Fragnesia under BOD 26-04. Researchers found an operation that rooted 25 PAN-OS devices. The articles do not say how the GitLab flaw was found.

PoC pública

More than 200 public PoCs for PHP2Shell were circulating by October 22. Sansec says they did not work against default PHP installs, and ESET and eight other vendors then reported no successful attacks. Since then SentinelOne reports targeted compromises and a campaign with custom weaponized chains pairing PHP2Shell with Fragnesia, for which public PoCs also exist. For Brotli, Aikido reported code execution against unmodified Node.js 24.22.0 on Linux ARM64, not on every attempt, and SentinelOne reports working execution on x86-64 on October 25; FFmpeg research gave only a crash. Mass exploitation has not happened, but CISA KEV listings and the PAN-OS compromises make patching urgent, including the kernel.

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 15:18.

2 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2026-109618, CVE-2026-46300. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA
  2. exploit-db.com · EDB-52591 ↗ · local · linux · pub. 29/05/2026 não verificado

    Linux Kernel - Local Privilege Escalation

    This Exploit-DB entry is a write-up, not exploit code. It describes a local privilege escalation chaining three Linux kernel flaws: the xfrm ESP handling with extended sequence numbers, RxRPC in-place decryption, and ESP-in-TCP fragment coalescing. Together they would let an unprivileged local user write into the page cache and alter a setuid binary such as su to get root. It needs local code execution on an affected kernel with these networking features. Maturity is unclear: only a sample console output is shown, the code is linked externally, and it is unverified.

    CVE-2026-46300 · autor: nu11secur1ty · explicação gerada por IA

Detalhes técnicos

  • PHP2Shell: two memory-safety bugs in PHP core allowing unauthenticated RCE, triggerable before application code runs in the highest-risk configurations. Public PoCs reportedly did not work against default installs (Sansec). Fixes released October 21 in 8.5.12, 8.4.27, 8.3.36, 8.2.35 plus source-only backports for EOL 7.4/8.0/8.1. Disclosure was forced early by a premature leak. Exploitation lacks a universal offset and requires crafted request streams to align memory blocks before triggering the out-of-memory error (sentinelone.com).
  • PHP2Shell + Fragnesia chain (sentinelone.com): actors exploit PHP2Shell to implant a web shell, then use Fragnesia (CVE-2026-46300, a logic defect in the Linux XFRM ESP-in-TCP subsystem leaving stale page-cache writes exploitable) to escalate to root. Public PoCs exist; kernels released before May 13, 2026 are affected. The operation included custom exploit chains, target lists, activity logs and about 40 post-exploitation scripts. PAN-OS web interfaces run on PHP.
  • Linux kernel: ZDI-CAN-33549 (integer underflow in KSMBD SMB Direct path, RCE, CVSS 9.0; requires RDMA-capable interface, writable KSMBD share and SMB Direct negotiation) and ZDI-CAN-33774 (race condition, RCE, CVSS 9.0). Additional local privilege escalation reports in the networking stack and VMware graphics driver, plus info disclosure in NVMET. Reports were copied to public mailing lists without patches, drawing criticism from Greg Kroah-Hartman.
  • LiteLLM: attackers used GitHub CLI credentials of three developers — one a GitHub org owner — to disable branch protections and redirect the release workflow to a lookalike repository. Malicious 1.107.0 lived on PyPI ~2 hours; tags v1.107.0, latest, main-latest, main-stable were affected. Payload combined a credential stealer with a second-stage RAT, persisting via a .pth file so it executed on every Python start, regardless of imports. Second LiteLLM supply-chain compromise of 2026 after malicious 1.82.7/1.82.8 in March.
  • Node2Shell/HTTP2Shell: out-of-bounds write in Google's Brotli decoder bundled by Node.js; Aikido reported demonstrated code execution against unmodified Node.js 24.22.0 on Linux ARM64. Same decoder is compiled into Python Brotli/brotlicffi and other HTTP software. SentinelOne adds: CVSS 9.2, affects Brotli 1.0.3–1.2.0, also called Broccoli2Shell, caused by invalid stream block switches during decompression; upstream silently fixed the code on February 27 with no advisory or CVE; coordinated disclosure October 21; Python registry updates October 22–23, Ruby gem October 24, .NET out-of-band patch October 25; edge providers deployed interim firewall mitigations within hours; FFmpeg research yielded only a reproducible crash (sentinelone.com).
  • GitLab: CVE-2026-110264 integer overflow when compiling a crafted regular expression, unauthenticated RCE, affecting versions back to 7.0; 11 further issues covering credential exposure via internal response headers, OAuth/OIDC discovery cache poisoning, authorization bypass and approval-policy failures.
  • eMudhra/emSign: insecure intermediate CA private keys enabling forged trusted certificates and MITM against TLS, including python.org and pypi.org, because some Python tooling kept trusting the CAs via its own bundles.

Remediação

  • Upgrade PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; hunt for embedded PHP in appliances, network devices and third-party products; isolate unpatched internet-facing systems.
  • Patch both PHP2Shell and the Linux kernel (Fragnesia); fixing the web entry point alone leaves the root escalation path open. Review PAN-OS systems for web shells and root compromise, and meet CISA KEV deadlines (sentinelone.com).
  • Track each ZDI kernel report individually, follow distribution advisories, restrict exposed KSMBD/SMB Direct services, and reboot into the patched kernel rather than only verifying package installation.
  • Treat environments that ran litellm==1.107.0 or the affected container tags as compromised: determine whether the code executed, contain, rebuild from clean sources, rotate all exposed secrets from a clean environment, and review cloud, SCM and CI/CD logs.
  • Update Node.js to 22.23.4 / 24.22.1 / 26.12.1, Bun to 1.4.4+, Brotli to 1.2.1; Node.js 25.x, 23.x, 20.x and earlier are EOL and will not be fixed. Inventory every container, serverless deployment and library bundling the decoder. Upgrade the Brotli library and rebuild applications, since proxy-level filtering does not protect outbound client requests or file-based attack paths (sentinelone.com).
  • Apply GitLab 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13 — note the older backports contain only the critical fix; the other 11 issues are fixed from 19.3.6 onward. Patching does not invalidate stolen credentials or revert unauthorized changes.
  • Upgrade to certifi 2026.10.19, pip 26.2.2, uv 0.13.4 and Python 3.15.2 / 3.14.10 / 3.13.18 / 3.12.16 / 3.11.18; update every host, application and existing virtualenv; rebuild container images with layer caching disabled and verify clients actually reject the compromised trust paths.

Relatos divergentes

  • Exploitation status: ESET and eight other vendors told NBC News on October 22 they had seen no successful PHP2Shell attacks. SentinelOne (sentinelone.com, October 30, more recent) reports targeted compromises, CISA KEV listing and a campaign that rooted 25 PAN-OS devices by chaining PHP2Shell with Fragnesia. The later report is more authoritative on current status.
  • Brotli demonstration platform: Aikido's demonstration was reported against Node.js 24.22.0 on Linux ARM64 (ESET), while SentinelOne describes working code execution on x86-64 against Node.js on October 25.

Linha do tempo

  1. sentinelone.com ↗ · pub. 30/10/2026 14:29 · coletado 30/10 15:00

    PHP2SHELL chained with Fragnesia (CVE-2026-46300) to root 25 PAN-OS devices; Brotli Node2Shell (CVE-2026-111497) added to CISA KEV

    SentinelOne reports active exploitation: PHP2SHELL chained with the Fragnesia Linux kernel flaw (CVE-2026-46300) rooted 25 PAN-OS devices in the US, Japan, Taiwan and South Korea. It also reports CISA KEV additions for PHP2SHELL (deadline October 29), Fragnesia and the Brotli flaw (October 27, deadline November 10), plus a Brotli disclosure and patch timeline including the February 27 silent upstream fix and a .NET out-of-band patch.

    ler a análise desta fonte

    SentinelOne reports active exploitation: PHP2SHELL chained with the Fragnesia Linux kernel flaw (CVE-2026-46300) rooted 25 PAN-OS devices in the US, Japan, Taiwan and South Korea. It also reports CISA KEV additions for PHP2SHELL (deadline October 29), Fragnesia and the Brotli flaw (October 27, deadline November 10), plus a Brotli disclosure and patch timeline including the February 27 silent upstream fix and a .NET out-of-band patch.

    SentinelOne's Week 44 roundup covers the "Black October" vulnerability cluster (PHP2SHELL, Node.js, GitLab, Brotli, a LiteLLM supply chain attack and compromised eMudhra CA keys). Despite PHP2SHELL affecting roughly 70% of websites, Log4Shell-style mass exploitation has not materialized because exploitation needs version-, build- and SAPI-specific heap grooming, although targeted compromises are occurring. CISA added both PHP2SHELL CVEs to the KEV catalog (federal deadline October 29) and added Fragnesia (CVE-2026-46300), a Linux kernel XFRM ESP-in-TCP privilege escalation, which actors are chaining with PHP2SHELL to root PAN-OS firewalls. Researchers found an operation that rooted 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea, including three in a US government-affiliated environment. CISA also added the Brotli flaw CVE-2026-111497 (CVSS 9.2) to KEV on October 27, with a federal deadline of November 10. The roundup also notes law enforcement actions: extradition of Zheng Zhao, a 70-month sentence for Nefilim/Hive affiliate Artem Stryzhak, and the seizure of bulletproof hosting provider Virtualine.

    Technical Details

    • Attack chain: exploit PHP2SHELL RCE to implant a web shell, then use Fragnesia to escalate to root. Fragnesia is a logic defect in the Linux XFRM ESP-in-TCP subsystem leaving stale page-cache writes exploitable. Public PoCs exist, and kernels released before May 13, 2026 are affected. CISA mandated patching under BOD 26-04.
    • Operation artifacts: custom weaponized exploit chains, target lists, activity logs and about 40 post-exploitation scripts. PAN-OS web interfaces run on PHP.
    • Brotli (CVE-2026-111497): out-of-bounds write on invalid stream block switches during decompression, affecting Brotli 1.0.3 to 1.2.0 and reaching Node.js, Python and .NET. Also named Node2Shell, HTTP2Shell and Broccoli2Shell. Upstream silently fixed the code on February 27 with no advisory or CVE. Coordinated disclosure was October 21; Python registry updates came October 22-23, a Ruby gem October 24, and a .NET out-of-band patch October 25, the same day code execution was demonstrated on x86-64 against Node.js. FFmpeg research produced only a reproducible crash.
    • PHP2SHELL exploitation lacks a universal offset; attackers must craft request streams to align memory blocks before triggering the out-of-memory error.

    Remediation

    • Patch both the PHP2SHELL entry point and the kernel (Fragnesia); fixing one leaves the other path open.
    • Upgrade the underlying Brotli library and rebuild affected applications; edge or proxy filtering does not cover outbound client requests or file-based paths.
    • Meet CISA KEV deadlines (PHP2SHELL October 29, Brotli November 10) and review PAN-OS systems for web shells and root compromise.
  2. welivesecurity.com ↗ · pub. 28/10/2026 07:33 · coletado 29/10 10:00 primeiro registro

    Cybersecurity Black Week: PHP2Shell, Linux kernel 0-days, LiteLLM supply-chain compromise, GitLab 10.0 RCE and emSign CA trust failure

    ler a análise desta fonte

    ESET reviews the week ending October 25, 2026, in which defenders faced a simultaneous wave of critical issues: the PHP2Shell memory-safety flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2, PHP 5.4–8.5.11, unauthenticated RCE), unpatched Linux kernel KSMBD vulnerabilities disclosed publicly by Trend Micro ZDI before fixes existed, a LiteLLM release pipeline compromise pushing malicious package 1.107.0 to PyPI and container registries, the Node2Shell/HTTP2Shell Brotli out-of-bounds write (CVE-2026-111497), a GitLab CVSS 10.0 integer overflow RCE (CVE-2026-110264), and the eMudhra/emSign compromised intermediate CA keys affecting Python TLS trust bundles. Government sites in the Netherlands, Germany and France were taken offline as a precaution over PHP2Shell, though ESET and eight other vendors told NBC News on October 22 they had seen no successful attacks despite 200+ public PoCs. AI-assisted research surfaced at least two of the flaws (PHP2Shell and the Brotli bug, the latter reported by OpenAI Codex Security). The article stresses that CVSS scores alone did not predict real exploitability, and that several incidents required containment and credential rotation rather than simple patching.

    Technical Details

    • PHP2Shell: two memory-safety bugs in PHP core allowing unauthenticated RCE, triggerable before application code runs in the highest-risk configurations. Public PoCs reportedly did not work against default installs (Sansec). Fixes released October 21 in 8.5.12, 8.4.27, 8.3.36, 8.2.35 plus source-only backports for EOL 7.4/8.0/8.1. Disclosure was forced early by a premature leak.
    • Linux kernel: ZDI-CAN-33549 (integer underflow in KSMBD SMB Direct path, RCE, CVSS 9.0; requires RDMA-capable interface, writable KSMBD share and SMB Direct negotiation) and ZDI-CAN-33774 (race condition, RCE, CVSS 9.0). Additional local privilege escalation reports in the networking stack and VMware graphics driver, plus info disclosure in NVMET. Reports were copied to public mailing lists without patches, drawing criticism from Greg Kroah-Hartman.
    • LiteLLM: attackers used GitHub CLI credentials of three developers — one a GitHub org owner — to disable branch protections and redirect the release workflow to a lookalike repository. Malicious 1.107.0 lived on PyPI ~2 hours; tags v1.107.0, latest, main-latest, main-stable were affected. Payload combined a credential stealer with a second-stage RAT, persisting via a .pth file so it executed on every Python start, regardless of imports. Second LiteLLM supply-chain compromise of 2026 after malicious 1.82.7/1.82.8 in March.
    • Node2Shell/HTTP2Shell: out-of-bounds write in Google's Brotli decoder bundled by Node.js; Aikido reported demonstrated code execution against unmodified Node.js 24.22.0 on Linux ARM64. Same decoder is compiled into Python Brotli/brotlicffi and other HTTP software.
    • GitLab: CVE-2026-110264 integer overflow when compiling a crafted regular expression, unauthenticated RCE, affecting versions back to 7.0; 11 further issues covering credential exposure via internal response headers, OAuth/OIDC discovery cache poisoning, authorization bypass and approval-policy failures.
    • eMudhra/emSign: insecure intermediate CA private keys enabling forged trusted certificates and MITM against TLS, including python.org and pypi.org, because some Python tooling kept trusting the CAs via its own bundles.

    Remediation

    • Upgrade PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; hunt for embedded PHP in appliances, network devices and third-party products; isolate unpatched internet-facing systems.
    • Track each ZDI kernel report individually, follow distribution advisories, restrict exposed KSMBD/SMB Direct services, and reboot into the patched kernel rather than only verifying package installation.
    • Treat environments that ran litellm==1.107.0 or the affected container tags as compromised: determine whether the code executed, contain, rebuild from clean sources, rotate all exposed secrets from a clean environment, and review cloud, SCM and CI/CD logs.
    • Update Node.js to 22.23.4 / 24.22.1 / 26.12.1, Bun to 1.4.4+, Brotli to 1.2.1; Node.js 25.x, 23.x, 20.x and earlier are EOL and will not be fixed. Inventory every container, serverless deployment and library bundling the decoder.
    • Apply GitLab 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13 — note the older backports contain only the critical fix; the other 11 issues are fixed from 19.3.6 onward. Patching does not invalidate stolen credentials or revert unauthorized changes.
    • Upgrade to certifi 2026.10.19, pip 26.2.2, uv 0.13.4 and Python 3.15.2 / 3.14.10 / 3.13.18 / 3.12.16 / 3.11.18; update every host, application and existing virtualenv; rebuild container images with layer caching disabled and verify clients actually reject the compromised trust paths.