Oct 21: PHP Patches RCE Pair, SafePay Advisory
PHP emergency patches for CVE-2026-109618 and -109619. FBI and CISA joint advisory names SafePay in 600-plus critical infrastructure compromises. CISA KEV update.
- PHP issued emergency patches for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), two critical RCEs. Exploitation confirmed before the patch shipped. Updates available for PHP 8.2 through 8.5.
- FBI and CISA joint advisory: SafePay ransomware has compromised over 600 critical infrastructure organizations since 2024. Entry vectors include credential stuffing, phishing, and unpatched vulnerabilities.
- CISA KEV update: four Plex2Shell CVEs (CVE-2026-96651, -96652, -96654, -96655) and a Siemens Software Center flaw added. Plex2Shell chain under mass exploitation.
- eMudhra CA: eight CA private keys compromised. All major browsers pushed revocation updates. CVE-2026-111943 and CVE-2026-113470 assigned.
- FortiSIEM CVE-2026-106173: Horizon3.ai released a public PoC for this CVSS 9.8 unauthenticated RCE. Patches have been available since October 14.
PHP patched CVE-2026-109618 and CVE-2026-109619 October 21. Both critical RCEs, both confirmed exploited before the patch shipped. Updates cover PHP 8.2 through 8.5. Full coverage.
SafePay: FBI and CISA joint advisory
SafePay ransomware has hit 600-plus critical infrastructure organizations since 2024. FBI and CISA published the joint advisory October 21. Entry vectors: credential stuffing, phishing, and unpatched vulnerabilities. No specific CVE cited as the primary entry point.
CISA KEV additions
Four Plex2Shell CVEs and a Siemens Software Center flaw added to KEV October 21. The Plex2Shell chain is under mass exploitation. SiteGuard also listed.
eMudhra CA: eight keys exposed
Eight eMudhra CA certificate private keys were trivially recoverable, per external researcher disclosures. All major browsers pushed revocation updates. CVE-2026-111943 and CVE-2026-113470 assigned. Revocation confirmed.
FortiSIEM CVE-2026-106173: public PoC
Horizon3.ai published a PoC for CVE-2026-106173, a CVSS 9.8 unauthenticated RCE in Fortinet FortiSIEM. Patches have been available since October 14. Wild exploitation: unconfirmed as of October 21.