Security Affairs Newsletter Round 601: PHP2Shell PHP RCE flaws, Plex exploitation, OVHcloud CLI and LiteLLM supply chain attacks
The weekly Security Affairs newsletter (Round 601) is a link roundup with no analysis of its own. Headlines cover the exploitation of critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619, "PHP2Shell") and a public proof-of-concept, Plex vulnerabilities exploited in the wild to drop a cryptominer, and supply chain compromises of OVHcloud CLI releases and LiteLLM. Other items include a SafePay ransomware #StopRansomware advisory, a suspected ShinyHunters extortion site operator, the Capcom breach affecting 1 million people, a Lazarus operation ("FlashHole"), Pegasus spyware attacks on Serbian figures, and UK sanctions on Cryptomus.
Entenda a falha
A vulnerabilidade
The newsletter is only a list of headlines, so details are thin. Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), are described as remote code execution bugs. They were exploited before public disclosure, and PHP later warned of another unpatched RCE. Plex Media Server has an unauthenticated RCE ('Plex2Shell') exploited in the wild to drop a cryptominer. CVE-2026-113380 affects RingRTC (Signal): a flooded call event queue blocks the local hang-up. Affected and fixed versions are not given.
Como funciona
The articles do not describe how the PHP or Plex flaws work internally. For RingRTC, the headline says a flood of call events fills the call event queue, so the user's local request to hang up is blocked. For Plex, the headlines only say an unauthenticated attacker can reach code execution and that the flaw was used to deploy a cryptominer.
Por que é vulnerável
The root causes are not explained in the newsletter. The only hint is for CVE-2026-113380, where the call event queue can be flooded and then blocks the local hang-up, which points to missing handling of queue load. For the PHP and Plex flaws, and for what the fixes change, the source gives no information.
Como foi descoberta
Headlines call the PHP flaws 'leaked critical PHP vulnerabilities'. Amazon Threat Intelligence reports seeing PHP2Shell exploitation in its MadPot sensors before public disclosure, and exploit tooling was found on an exposed attacker server. PHP issued emergency patches and, two days later, warned of another unpatched RCE. Plex exploitation in the wild is reported in a separate headline. How each flaw was originally found is not stated.
PoC pública
A headline says a proof-of-concept exploit was released for CVE-2026-109618 and CVE-2026-109619, and exploit tooling was also found on an exposed attacker server. The newsletter does not say who published the PoC, how it works or how mature it is, and gives no link to it. Since exploitation was already seen before disclosure and a PoC is public, patching PHP should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 25/10/2026 10:16.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- PHP2Shell: Amazon Threat Intelligence reports exploitation before public disclosure; exploit tooling was found on an exposed attacker server; PHP warned of another unpatched RCE shortly after emergency patches.
- Plex: unauthenticated RCE ("Plex2Shell") exploited to deploy a cryptominer.
- Supply chain: five OVHcloud CLI releases hijacked to distribute a secret-stealing malware; LiteLLM compromised to deliver a credential stealer and backdoor; GhostAction escalated against GitHub users.
- ConnectWise (SkyKick) vendor credentials abused in M365 attacks; ROMULUS is a new multi-payload ClickFix delivery platform.
- CVE-2026-113380 affects RingRTC (Signal).
Remediação
The newsletter provides no remediation details; consult the linked original articles and vendor advisories.
Linha do tempo
-
Security Affairs Newsletter Round 601: PHP2Shell PHP RCE flaws, Plex exploitation, OVHcloud CLI and LiteLLM supply chain attacks
ler a análise desta fonte ocultar
The weekly Security Affairs newsletter (Round 601) is a link roundup with no analysis of its own. Headlines cover the exploitation of critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619, "PHP2Shell") and a public proof-of-concept, Plex vulnerabilities exploited in the wild to drop a cryptominer, and supply chain compromises of OVHcloud CLI releases and LiteLLM. Other items include a SafePay ransomware #StopRansomware advisory, a suspected ShinyHunters extortion site operator, the Capcom breach affecting 1 million people, a Lazarus operation ("FlashHole"), Pegasus spyware attacks on Serbian figures, and UK sanctions on Cryptomus.
Technical Details
- PHP2Shell: Amazon Threat Intelligence reports exploitation before public disclosure; exploit tooling was found on an exposed attacker server; PHP warned of another unpatched RCE shortly after emergency patches.
- Plex: unauthenticated RCE ("Plex2Shell") exploited to deploy a cryptominer.
- Supply chain: five OVHcloud CLI releases hijacked to distribute a secret-stealing malware; LiteLLM compromised to deliver a credential stealer and backdoor; GhostAction escalated against GitHub users.
- ConnectWise (SkyKick) vendor credentials abused in M365 attacks; ROMULUS is a new multi-payload ClickFix delivery platform.
- CVE-2026-113380 affects RingRTC (Signal).
Remediation
The newsletter provides no remediation details; consult the linked original articles and vendor advisories.