EN PT-BR
← Voltar ao feed
critical exploit público government technology home_users small_office

October 2026 Vulnerability Wave Update: PHP2Shell, Brotli RCE, Plex, GitLab and eMudhra CA Keys Two Weeks Later

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 21:00 · coletado há 1 hora

Hacktron published a two-week retrospective on five major vulnerabilities disclosed between 16–23 October 2026: PHP2Shell (CVE-2026-109618, CVE-2026-109619), a Brotli decoder memory-corruption bug dubbed HTTP2Shell/Node2Shell (CVE-2026-111497), a four-bug chain in Plex Media Server, a CVSS 10.0 GitLab Ruby regex flaw, and eight compromised certificate authority keys at eMudhra. The article confirms active exploitation for most of these: PHP2Shell was exploited before public disclosure (Amazon's MadPot honeypots, 17 October) and is now actively targeted against internet-facing PAN-OS management interfaces, with Dream Research reporting 24 firewalls and a management server rooted across the US, Japan, Taiwan and South Korea by chaining it with a Linux kernel privilege-escalation bug (Fragnesia, CVE-2026-46300). Plex Media Server was hit within a day of disclosure with XMRig crypto-mining payloads despite a fix available since August. The earlier GitLab flaw, CVE-2026-97229, remains under active attack while the newer CVSS 10.0 Ruby regex bug has no reported exploitation. No exploitation has been confirmed for the Brotli bug or the eMudhra CA key exposure, though CISA added both PHP2Shell CVEs and the Brotli CVE to KEV.

Entenda a falha

A vulnerabilidade

The story covers several flaws. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a blind remote memory-corruption bug in PHP, fixed on 21 October in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It is exploited and on CISA's KEV list, including against internet-exposed PAN-OS management interfaces, which run PHP. CVE-2026-111497 is a memory-corruption bug in the Brotli decoder (the Node2Shell/HTTP2Shell bug), also on KEV. It is fixed in Brotli 1.2.1, 1.1.1 and 1.0.10, Node.js 26.12.1, 24.22.1 and 22.23.4, and .NET 8.0.33, 9.0.22 and 10.0.14. It only matters if something decodes attacker-controlled Brotli data. CVE-2026-115560 is a separate PHP remote code execution path via session upload progress. It needs a non-default session serializer that the application switches back with ini_set() before session_start(). It is still unpatched and no exploitation is reported. CVE-2026-97229 is an earlier GitLab flaw, fixed on 12 October and under attack. A newer CVSS 10.0 GitLab bug in the bundled Ruby regex engine was fixed in 19.5.1, 19.4.3 and 19.3.6 with no reported exploitation.

Como funciona

For PHP2Shell, the articles describe only that a crafted request reaches PHP and corrupts memory blindly, without the attacker seeing the result. Memory layout depends on the PHP build, loaded extensions and the application in front of it, so each target needs a tuned exploit. For Brotli, a server or client decodes Brotli-compressed data, such as a request body or a response from an attacker-controlled server. The decoder mishandles that data and corrupts memory, which can lead to code execution. For CVE-2026-115560, an upload request triggers PHP's session upload-progress handling. If the serializer was changed at runtime after being set differently in the server settings, the session data is processed in a way that can lead to code execution. The articles give no finer step-by-step detail.

Por que é vulnerável

PHP2Shell and the Brotli bug are memory-corruption flaws, in PHP and in the Brotli decoder respectively. The articles do not explain the exact coding error behind either one. CVE-2026-115560 comes from a mismatch: a non-default session serializer set at server level is switched back by the application with ini_set() before session_start(). The GitLab regex bug is in the Ruby engine GitLab bundles, not in GitLab's own code, and its fix is a Ruby patch that GitLab applies only in its official packages. That is why Alpine's image, built on standard Ruby, stayed exposed even after upgrading to 19.3.6.

Onde está

The articles name only settings, not code locations: session.upload_progress.enabled and ini_set() before session_start() for CVE-2026-115560, and the bundled Ruby regex engine for the GitLab bug.

Como foi descoberta

PHP2Shell was exploited before disclosure: Amazon's MadPot honeypots recorded an attempt on 17 October, four days before the 21 October fixes, and Amazon says it is unclear how the actor got the details so early. CISA added both CVEs to KEV on 26 October. Dream Research reported the PAN-OS campaign chaining PHP2Shell with Fragnesia (CVE-2026-46300), and Unit 42 says it verified the tooling. CISA added the Brotli CVE to KEV on 27 October, and ELLIO documented an attempt against Node.js 24.22.0 on 26 October. PHP published the advisory for CVE-2026-115560 on 23 October. The articles do not say who originally found the PHP or Brotli flaws.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

Exploits for PHP2Shell are in use in attacks, but the articles point to no published copy. Because the bug is blind memory corruption, a proof of concept built for one target rarely works on another without tuning. Hacktron measured that frontier AI models ported the exploit to a new target in hours, while the open models it tested did not. Wiz has not seen a successful end-to-end exploit in its own telemetry. For Brotli, ELLIO saw an in-the-wild attempt against Node.js 24.22.0, but the final stage failed in all 50 lab replays. Treat PHP2Shell as urgent, especially for internet-facing PAN-OS management interfaces.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 20:17.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • PHP2Shell is a blind remote memory-corruption bug fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 October); a related issue, CVE-2026-115560, remains unpatched and requires a non-default session serializer configuration to be exploitable.
  • Brotli/Node2Shell (CVE-2026-111497) was fixed in Brotli 1.2.1/1.1.1/1.0.10 and Node.js 26.12.1/24.22.1/22.23.4; Microsoft shipped out-of-band .NET patches (8.0.33, 9.0.22, 10.0.14) for the same underlying Brotli flaw, and AWS confirmed impact across Lambda, App Runner and CodeBuild runtimes.
  • ELLIO observed an exploitation attempt against Node.js 24.22.0 tied to a source IP previously linked to PHP2Shell honeypot activity, but the final exploitation stage failed in 50 replay attempts.
  • The new GitLab CVSS 10.0 bug, fixed 21 October in 19.5.1/19.4.3/19.3.6, sits in the bundled Ruby regex engine rather than GitLab's own code; Alpine Linux's GitLab instance, targeted 20–21 October, remained vulnerable after patching because its image used standard Ruby instead of GitLab's packaged Ruby.
  • NCSC-NL was tracking 757 products for PHP2Shell as of 28 October (218 confirmed vulnerable, 144 fixed), and Wiz found internet-exposed vulnerable machines dropped ~67% in the first week but nearly half of originally affected organizations remained vulnerable after a week.
  • eMudhra's board decided on 22 October to exit the global TLS certificate business after Chrome blocked the affected keys within two hours of disclosure.

Remediação

  • Patch PHP, Brotli/Node.js/.NET, Plex Media Server and GitLab to the fixed versions listed, checking bundled/vendored copies (container base images, appliance firmware) that a version scan may miss.
  • Set session.upload_progress.enabled=0 server-wide as a mitigation for the unpatched CVE-2026-115560 until a fix ships.
  • Replace certificates chained to the affected eMudhra root.
  • Hunt for signs of compromise predating patching, particularly on internet-exposed firewall management interfaces, self-hosted Plex servers and GitLab instances.

Linha do tempo

  1. hacktron.ai ↗ · pub. 02/11/2026 21:00 · coletado 04/11 20:00 primeiro registro

    October 2026 Vulnerability Wave Update: PHP2Shell, Brotli RCE, Plex, GitLab and eMudhra CA Keys Two Weeks Later

    ler a análise desta fonte

    Hacktron published a two-week retrospective on five major vulnerabilities disclosed between 16–23 October 2026: PHP2Shell (CVE-2026-109618, CVE-2026-109619), a Brotli decoder memory-corruption bug dubbed HTTP2Shell/Node2Shell (CVE-2026-111497), a four-bug chain in Plex Media Server, a CVSS 10.0 GitLab Ruby regex flaw, and eight compromised certificate authority keys at eMudhra. The article confirms active exploitation for most of these: PHP2Shell was exploited before public disclosure (Amazon's MadPot honeypots, 17 October) and is now actively targeted against internet-facing PAN-OS management interfaces, with Dream Research reporting 24 firewalls and a management server rooted across the US, Japan, Taiwan and South Korea by chaining it with a Linux kernel privilege-escalation bug (Fragnesia, CVE-2026-46300). Plex Media Server was hit within a day of disclosure with XMRig crypto-mining payloads despite a fix available since August. The earlier GitLab flaw, CVE-2026-97229, remains under active attack while the newer CVSS 10.0 Ruby regex bug has no reported exploitation. No exploitation has been confirmed for the Brotli bug or the eMudhra CA key exposure, though CISA added both PHP2Shell CVEs and the Brotli CVE to KEV.

    Technical Details

    • PHP2Shell is a blind remote memory-corruption bug fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 October); a related issue, CVE-2026-115560, remains unpatched and requires a non-default session serializer configuration to be exploitable.
    • Brotli/Node2Shell (CVE-2026-111497) was fixed in Brotli 1.2.1/1.1.1/1.0.10 and Node.js 26.12.1/24.22.1/22.23.4; Microsoft shipped out-of-band .NET patches (8.0.33, 9.0.22, 10.0.14) for the same underlying Brotli flaw, and AWS confirmed impact across Lambda, App Runner and CodeBuild runtimes.
    • ELLIO observed an exploitation attempt against Node.js 24.22.0 tied to a source IP previously linked to PHP2Shell honeypot activity, but the final exploitation stage failed in 50 replay attempts.
    • The new GitLab CVSS 10.0 bug, fixed 21 October in 19.5.1/19.4.3/19.3.6, sits in the bundled Ruby regex engine rather than GitLab's own code; Alpine Linux's GitLab instance, targeted 20–21 October, remained vulnerable after patching because its image used standard Ruby instead of GitLab's packaged Ruby.
    • NCSC-NL was tracking 757 products for PHP2Shell as of 28 October (218 confirmed vulnerable, 144 fixed), and Wiz found internet-exposed vulnerable machines dropped ~67% in the first week but nearly half of originally affected organizations remained vulnerable after a week.
    • eMudhra's board decided on 22 October to exit the global TLS certificate business after Chrome blocked the affected keys within two hours of disclosure.

    Remediation

    • Patch PHP, Brotli/Node.js/.NET, Plex Media Server and GitLab to the fixed versions listed, checking bundled/vendored copies (container base images, appliance firmware) that a version scan may miss.
    • Set session.upload_progress.enabled=0 server-wide as a mitigation for the unpatched CVE-2026-115560 until a fix ships.
    • Replace certificates chained to the affected eMudhra root.
    • Hunt for signs of compromise predating patching, particularly on internet-exposed firewall management interfaces, self-hosted Plex servers and GitLab instances.