PHP2Shell tops 10 new exploited vulns; CISA's PHP deadline is Thursday

PHP

PHP Stale Internal Request-State Vulnerability

Added 2026-10-26 · CISA due 2026-10-29 · EPSS 99.99%

What it is: PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Why it matters: EPSS estimates a 99.99% chance of exploitation activity in the next 30 days, higher than 99.99% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: Pre-auth remote code execution in the PHP engine itself, PHP 5.4 and later. CISA says the PHP2Shell bugs affect all PHP installations serving web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). Arctic Wolf saw widespread scanning and likely-weaponized attempts tied to a Mirai-derived botnet, but its telemetry did not show the payloads being downloaded or run. VulnCheck, quoted by The Record, says many public proofs of concept are nonfunctional against production setups because of ASLR. Palo Alto Networks says the PAN-OS and Panorama management web UI is affected, and is rolling out hotfixes.

Uncertain: Whether this specific CVE has been exploited successfully in the wild. The confirmed honeypot RCE is described as matching CVE-2026-109618, not this one, though CISA lists both as known exploited.

Uncertain: Severity scores disagree: NVD rates this CVE 8.1 (CVSS 3.1) while rating its sibling 9.8. PHP's own CVSS 4.0 score is 9.2 for both.

Fix: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP workers. CISA says systems that can't be updated, or that run unsupported PHP 8.1 or older, should be taken offline until patched. PHP advisory · NVD

Sources: CISA alert · Wiz Research · Arctic Wolf · The Record · Palo Alto Networks

PHP

PHP Memory Corruption Vulnerability

Added 2026-10-26 · CISA due 2026-10-29 · EPSS 99.99%

What it is: PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

Why it matters: EPSS estimates a 99.99% chance of exploitation activity in the next 30 days, higher than 99.99% of all scored CVEs. The federal patch deadline is in 2 days.

Gridwatch notes: The companion PHP2Shell bug, PHP 7.3 and later. BleepingComputer reports confirmed remote code execution on honeypots, running Apache mod_php on PHP 8.4.26 with a single worker, a deliberately favorable setup. PHP says mod_php is the highest-risk setup because exploitation happens before any application code runs. No confirmed real-world victim organization had been reported as of Oct 27.

Uncertain: The honeypot details (35 shells on Oct 24 from two source IPs) come from secondary write-ups of the researcher's report, not the primary report.

Uncertain: Severity scores disagree: NVD rates this CVE 9.8 (CVSS 3.1), PHP rates it 9.2 (CVSS 4.0), and NVD rates its sibling 8.1.

Uncertain: NVD lists Palo Alto WildFire WF-500/WF-500-B as affected, but Palo Alto's corrected advisory says they are not.

Fix: Same releases as CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35), then restart workers. PHP's interim mitigation, which it says is not complete: enforce memory_limit=-1 and restart workers. Watch for multipart requests followed by memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, and PHP worker churn. PHP advisory · NVD

Sources: BleepingComputer · CISA alert · Wiz Research · Palo Alto Networks

Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Added 2026-10-23 · CISA due 2026-10-26 · EPSS 11.6%

What it is: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Why it matters: EPSS estimates a 11.6% chance of exploitation activity in the next 30 days, higher than 96.0% of all scored CVEs. The federal patch deadline passed 1 day ago.

Gridwatch notes: Unauthenticated OS command injection in the Nextcloud app richdocumentscode (Collabora Online Built-in CODE Server), exploitable while the built-in CODE server isn't running, for example after a restart or crash. Admins reported attacks back to Sep 10 that planted PHP webshells and hunted for password databases and crypto wallets. The fix shipped Sep 11, but the CVE and advisory only came Oct 14. Standalone Collabora Online, Docker/RPM/DEB installs and Nextcloud All-in-One are not affected.

Uncertain: Some users told BleepingComputer that ransomware operators are using this flaw. BleepingComputer could not confirm it, and CISA lists ransomware use as unknown.

Uncertain: No threat actor has been named, and Nextcloud said it had not observed widespread exploitation.

Fix: Upgrade richdocumentscode to 26.4.303 or later, or remove the app. Disabling it is not enough. The fixed app needs Nextcloud 30 or later. Look for unexpected PHP files under apps/richdocumentscode/ and proxy.php?status hits since Sep 10, and rotate secrets the web user can read. Collabora advisory · NVD

Sources: BleepingComputer · Nextcloud forum · heise

SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Added 2026-10-20 · CISA due 2026-10-23 · EPSS 2.5%

What it is: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Why it matters: EPSS estimates a 2.5% chance of exploitation activity in the next 30 days, higher than 84.8% of all scored CVEs. The federal patch deadline passed 4 days ago.

Gridwatch notes: A host-based web application firewall is the attack path: command injection in SiteGuard Server Edition's statistics feature (on by default) runs commands as root or SYSTEM. The vendor and JPCERT/CC confirm exploitation, and JPCERT notes the product is widely used in Japan. Attacker, victims and scale have not been disclosed.

Uncertain: The CVSS vectors are local (AV:L, PR:L), while CISA's wording and some press frame it as remote command execution. How attackers reach the local precondition has not been disclosed.

Uncertain: No actor or campaign has been named.

Fix: Update to 8.00 Update 5 (7.00 Update 6 on FreeBSD), or apply the vendor's replacement patch for the statistics files, which also covers end-of-life versions. Before patching, download and keep the Diagnostic information from the web management screen, because updating can erase attack traces. JPCERT workaround: disable the statistics feature. Vendor advisory · NVD

Sources: JVN · JPCERT/CC · BleepingComputer

Plex Media Server

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Added 2026-10-20 · CISA due 2026-10-23 · EPSS 1.9%

What it is: Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and...

Why it matters: EPSS estimates a 1.9% chance of exploitation activity in the next 30 days, higher than 80.1% of all scored CVEs. The federal patch deadline passed 4 days ago.

Gridwatch notes: One link in the four-bug Plex2Shell chain (with CVE-2026-96652, -96655 and -96656) that ends in unauthenticated code execution on Plex Media Server. Per the researcher's write-up, this step lets an attacker who reaches the loopback-trusted plugin API call other plugins' functions. Plex says the chain is actively and widely exploited, and compromised servers ran cryptominers and proxyware.

Uncertain: Plex's description of this CVE differs in wording from NVD's. Treat the mapping of CVEs to chain steps as approximate.

Uncertain: No actor has been named, and the public honeypot data is one operator's partial telemetry.

Fix: Update to Plex Media Server 1.43.3.10861 or later. Plex says any internet-reachable server older than that should be treated as possibly compromised: rebuild or purge the Codecs folder, check the transcoder options in Preferences.xml, sign out all devices, change the Plex password, and avoid forwarding port 32400 unless needed. Plex advisory · NVD

Sources: Researcher write-up · Honeypot write-up · BleepingComputer

Plex Media Server

Plex Media Server External Control of File Name or Path Vulnerability

Added 2026-10-20 · CISA due 2026-10-23 · EPSS 1.8%

What it is: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

Why it matters: EPSS estimates a 1.8% chance of exploitation activity in the next 30 days, higher than 78.2% of all scored CVEs. The federal patch deadline passed 4 days ago.

Gridwatch notes: The step that turns Plex2Shell into code execution: with the owner's token, an attacker sets transcoder options to write a .so file into the Codecs folder, which Plex loads unchecked at startup. On its own it requires admin rights; the earlier steps in the chain supply them.

Uncertain: Treat the mapping of CVEs to chain steps as approximate. No actor has been named.

Fix: Update to Plex Media Server 1.43.3.10861 or later, purge or rebuild the Codecs folder, and check the transcoder options in Preferences.xml. Plex advisory · NVD

Sources: Researcher write-up · Honeypot write-up

Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Added 2026-10-23 · CISA due 2026-10-26 · EPSS 1.0%

What it is: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

Why it matters: EPSS estimates a 1.0% chance of exploitation activity in the next 30 days, higher than 63.4% of all scored CVEs. The federal patch deadline passed 1 day ago.

Gridwatch notes: A zero-day SQL injection in on-prem VeloCloud Orchestrator: any logged-in user, down to the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and act as the local superuser operator. Arista found it itself and says it is actively exploited; hosted VCO is already patched. Arista published two attacking IPs: 74.82.197.86 and 38.54.50.151. BleepingComputer counts this as Arista's fourth exploited zero-day of 2026. Its low EPSS likely lags because the CVE was published Oct 22.

Uncertain: No actor or campaign has been named, and the number of victims is unknown.

Fix: Upgrade to VCO 5.2.3.18, 6.1.3.10, 6.4.2.12 or later. Until then, restrict the VCO web UI to admin networks, block the two IPs, watch for unexpected outbound traffic, webshells and backdoor daemons, and preserve logs before remediation. Arista advisory · NVD

Sources: BleepingComputer · Canadian Centre for Cyber Security · CISA alert

Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Added 2026-10-20 · CISA due 2026-11-03 · EPSS 1.8%

What it is: Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This...

Why it matters: EPSS estimates a 1.8% chance of exploitation activity in the next 30 days, higher than 78.6% of all scored CVEs. The federal patch deadline is in 7 days.

Gridwatch notes: The entry point of the Plex2Shell chain: an SSRF in /player/timeline that accepts any X-Plex-Token value, letting an attacker make the server send requests to its own loopback interface. Plex IOCs include the process names myawesomeproxy, mylovelyminer and x12345, stray .so/.dll files in the Codecs folder, and traffic to proxystream.st.

Uncertain: Treat the mapping of CVEs to chain steps as approximate. No actor has been named.

Fix: Update to Plex Media Server 1.43.3.10861 or later and follow Plex's compromise checks (see CVE-2026-96654 above). Plex advisory · NVD

Sources: Researcher write-up · BleepingComputer

Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Added 2026-10-20 · CISA due 2026-11-03 · EPSS 1.6%

What it is: Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with...

Why it matters: EPSS estimates a 1.6% chance of exploitation activity in the next 30 days, higher than 76.2% of all scored CVEs. The federal patch deadline is in 7 days.

Gridwatch notes: Part of the same Plex2Shell chain. NVD and CISA describe it as an authenticated SSRF in /video/:/transcode/universal.

Uncertain: Sources disagree on what this CVE covers. NVD, CVE.org and CISA describe an authenticated SSRF; Plex's Oct 19 post describes it as disclosure of the server owner's admin token.

Fix: Update to Plex Media Server 1.43.3.10861 or later and follow Plex's compromise checks (see CVE-2026-96654 above). Plex advisory · NVD

Sources: Researcher write-up

Siemens Software Center

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Added 2026-10-20 · CISA due 2026-11-03 · EPSS 1.0%

What it is: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the...

Why it matters: EPSS estimates a 1.0% chance of exploitation activity in the next 30 days, higher than 61.6% of all scored CVEs. The federal patch deadline is in 7 days.

Gridwatch notes: DLL side-loading of a genuine, validly signed Siemens Software Center binary, abused in what Siemens calls the Romulus multi-platform ClickFix campaign. Attackers bundled the signed executable with a malicious archive.dll and distributed it outside Siemens channels; Siemens says none of its systems were breached. Siemens published IOCs including 96.62.218[.]59 and wizardexpensive[.]com.

Uncertain: The Romulus link rests on Siemens' attribution and infrastructure overlap; SecurityWeek notes Siemens Software Center isn't named in the related Huntress or Forescout reports. Who operates Romulus is unknown.

Uncertain: Because attackers bring their own copy of the old signed binary, patching may only partly help, including on machines that never had the software installed. This is our inference from Siemens' description, not a vendor statement.

Fix: Update to Siemens Software Center 4.0.9.8 or later (existing installs auto-update at next launch). Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs launched by msiexec, and the other files and hashes on Siemens' page. Siemens advisory · NVD

Sources: Siemens ProductCERT · SecurityWeek · CISA ICS advisory