Cyber Threat Brief — October 26 2026
⚠️ This report is AI-generated. Always validate findings.
1. PHP2Shell-CVE-2026-109618 — PAN-OS 11.1 hotfixes posted
TL;DR: Palo Alto’s 26 October update posts four PAN-OS 11.1 hotfixes that yesterday still listed with an ETA. Install each released build after you see it on the portal, and leave 11.1.7-h12 on the 30 October ETA.
What’s New:
- The 26 October update removes the ETA for 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, and 11.1.13-h16 because those builds are released.
- 11.1.7-h12 still has an ETA of 30 October 2026.
- Unit 42 retracted its 23 October European-government case on 25 October and cannot tie that initial access to these CVEs.
- A BleepingComputer article quotes one PHP 8.4.26 honeypot report. That report is still one origin, so this brief does not treat it as a confirmed compromise.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| PAN-OS 11.1.4-h38 | Fixed build | T1190 | PAN-OS version inventory | On 11.1.4, install 11.1.4-h38 or later. The 26 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.1.6-h40 | Fixed build | T1190 | PAN-OS version inventory | On 11.1.6, install 11.1.6-h40 or later. The 26 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.1.10-h36 | Fixed build | T1190 | PAN-OS version inventory | On 11.1.10, install 11.1.10-h36 or later. The 26 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.1.13-h16 | Fixed build | T1190 | PAN-OS version inventory | On 11.1.13, install 11.1.13-h16 or later. The 26 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.1.7-h12 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.1.7, the floor is 11.1.7-h12. The advisory ETA is still 30 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.1.16-h4 | Fixed build | T1190 | PAN-OS version inventory | On 11.1.16, install 11.1.16-h4 or later. The 25 October update already removed this ETA because the build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.2.10-h16 | Fixed build | T1190 | PAN-OS version inventory | On 11.2.10, install 11.2.10-h16 or later. The 25 October update already removed this ETA because the build is released. Confirm it is on the portal before you install it. |
| PAN-OS 10.2.18-h13 | Fixed build | T1190 | PAN-OS version inventory | On 10.2.18, install 10.2.18-h13 or later. The 25 October update already removed this ETA because the build is released. Confirm it is on the portal before you install it. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — PHP Memory Exhaustion Exploitation Attempt via Multipart Request | Apache or Nginx correlation only; PAN-OS management misses. |
| Elastic | Partial — Potential PHP2Shell Exploitation Attempt | Memory-exhaustion error text only; PAN-OS management misses. |
| Sigma | None — verified | No SigmaHQ rule names this CVE. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules 52ef7a0 (2026-10-24) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Confirm the build on the portal before you install it. Trains missing from this table still have ETAs on the 26 October advisory. Follow the version table. Palo Alto is not aware of malicious exploitation against its products. Unit 42 retracted the 23 October case on 25 October 2026 at 2:15 p.m. PT.
Sources: Palo Alto CVE-2026-109618 · Unit 42, 25 October retraction · BleepingComputer · Amazon MadPot · CISA SIGMA rule · Original PHP brief · 24 October
2. CVE-2026-111497 — .NET, Visual Studio, and PowerShell Brotli floors
TL;DR: Microsoft’s 25 October out-of-band release sets .NET, Visual Studio, and PowerShell floors for CVE-2026-111497. Install the runtime the process actually loads, and rebuild self-contained apps and container images, because no live attacks are established.
What’s New:
- .NET runtimes 8.0.33, 9.0.22, and 10.0.14, plus .NET 11 Release Candidate 3, fix the Brotli decoder.
- Visual Studio 16.11.61, 17.14.43, and 18.11.2 include the same fix.
- PowerShell 7.4.22, 7.5.13, and 7.6.9 are the fixed builds.
- Request decompression and HttpClient Brotli decompression are off by default, and no live attacks are established.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| .NET 8.0.33 | Fixed runtime | T1190 | dotnet --list-runtimes | On .NET 8, install runtime 8.0.33. SDK builds that include it are 8.0.133 and 8.0.427. Restart framework-dependent apps. Rebuild and redeploy self-contained apps and container images. Installing a newer host runtime does not replace a runtime bundled in the app. |
| .NET 9.0.22 | Fixed runtime | T1190 | dotnet --list-runtimes | On .NET 9, install runtime 9.0.22. SDK builds that include it are 9.0.123 and 9.0.320. Restart framework-dependent apps. Rebuild self-contained apps and container images. |
| .NET 10.0.14 | Fixed runtime | T1190 | dotnet --list-runtimes | On .NET 10, install runtime 10.0.14. SDK builds that include it are 10.0.114 and 10.0.403. Restart framework-dependent apps. Rebuild self-contained apps and container images. |
| .NET 11.0.0-rc.3.26522.148 | Fixed runtime, release candidate | T1190 | dotnet --list-runtimes | On .NET 11, install runtime 11.0.0-rc.3.26522.148. The matching SDK is 11.0.100-rc.3.26522.148. Move Release Candidate 2 to this Release Candidate 3. Restart or rebuild the same way as the supported lines. |
| .NET Framework | Not affected | T1190 | Installed .NET Framework inventory | Microsoft says .NET Framework is not affected by CVE-2026-111497. Do not use a .NET Framework patch as a substitute for the runtimes above. |
| PowerShell 7.6.9 | Fixed build | T1203 | pwsh -v | On PowerShell 7.6, install 7.6.9 or later. Versions before 7.6.9 are affected. The advisory applies when Invoke-WebRequest or Invoke-RestMethod calls a site without TLS, or a site you do not control. |
| PowerShell 7.5.13 | Fixed build | T1203 | pwsh -v | On PowerShell 7.5, install 7.5.13 or later. Versions before 7.5.13 are affected. Use the same Invoke-WebRequest and Invoke-RestMethod check as on 7.6. |
| PowerShell 7.4.22 | Fixed build | T1203 | pwsh -v | On PowerShell 7.4, install 7.4.22 or later. Versions before 7.4.22 are affected. Use the same Invoke-WebRequest and Invoke-RestMethod check as on 7.6. |
| Visual Studio 2026 18.11.2 | Fixed build | T1190 | Visual Studio installer inventory | On Visual Studio 2026, install 18.11.2 or later. The 25 October release notes list CVE-2026-111497. |
| Visual Studio 2022 17.14.43 | Fixed build | T1190 | Visual Studio installer inventory | On Visual Studio 2022, install 17.14.43 or later. The 25 October release notes list CVE-2026-111497. |
| Visual Studio 2019 16.11.61 | Fixed build | T1190 | Visual Studio installer inventory | On Visual Studio 2019, install 16.11.61 or later. The 25 October release notes list CVE-2026-111497. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names Brotli or CVE-2026-111497. |
| Elastic | None — verified | In-process .NET and PowerShell decode misses. |
| Sigma | None — verified | No rule names Brotli or CVE-2026-111497. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules 52ef7a0 (2026-10-24) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run dotnet --list-runtimes and pwsh -v first. Request decompression and HttpClient Brotli decompression are off by default. If br is already enabled, remove it until the runtime is updated. Node.js 22.23.4, 24.22.1, and 26.12.1, Bun 1.4.4, and the Envoy floors are unchanged from the 24 October brief.
Sources: .NET out-of-band post · .NET advisory 494 · PowerShell advisory · Visual Studio 2026 18.11.2 · Visual Studio 2022 17.14.43 · Visual Studio 2019 16.11.61 · SecurityWeek · 24 October brief
Status Updates
- eMudhra-CVE-2026-111943 (Bottlerocket): AWS bulletin 2026-150-AWS still targets updated AMIs for 2026-10-26. AMI v1.67.0 and older stay affected until those AMIs land. AMI parameters in commercial regions are targeted for 2026-10-28. Apply the interim per-node override from the bulletin. Do not copy the certificates out of the bulletin into a ticket. 23 October.
- eMudhra-CVE-2026-111943 (CloudFront): The same bulletin is removing the three roots from the CloudFront edge CA bundle, target 2026-10-28. An origin whose certificate chains to one of those roots can fail TLS.
- eMudhra-CVE-2026-111943 (Application Load Balancer): Replace an identity-provider certificate that chains to one of the three roots by 2026-10-28 when the load balancer uses OIDC or JWT. Existing load balancers update from 2026-10-29 through 2026-10-31. New load balancers are protected by 2026-11-02.
- CVE-2026-114625 (VeloCloud Orchestrator): KEV due date is 2026-10-26. Catalog 2026.10.23 is unchanged. Fixed builds remain 5.2.3.18, 6.1.3.10, and 6.4.2.12. Block 74.82.197.86 and 38.54.50.151. BOD 26-04 forensic triage is required. No new IOC set. Original brief. KEV catalog.
- CVE-2026-110447 (Collabora Online built-in CODE server): KEV due date is 2026-10-26. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Disabling the app leavesproxy.phpreachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. Standalone Collabora Online is not affected. This CVE has not had its own section. BOD 26-04 forensic triage is required. Original brief. KEV catalog. - Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 were KEV due 2026-10-23 and are overdue. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. BOD 26-04 forensic triage is required on the overdue entries. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due 2026-10-23 is overdue. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). BOD 26-04 forensic triage is required. KEV catalog · EG Secure.
- CVE-2026-0257 (PAN-OS GlobalProtect): KEV due 2026-06-01 remains overdue. No new fixed build or IOC set was confirmed in this run. Original brief.
- Retired from watch: CVE-2026-102764 (last update 2026-10-17), CVE-2025-61624 (last update 2026-10-17), CyberXero-2026-10 (last update 2026-10-12). BeyondTrust BT26-05 still shows updated on 15 October 2026, with the same BT26-05-RS patch. BeyondTrust brief. FortiOS FG-IR-26-122 still shows the 14 April 2026 initial publication and no newer fixed build. FortiOS brief. The SOCRadar CyberXero article was last modified 6 October 2026. CyberXero brief.
- Watching (no change): TimeSmuggler-NetScaler-2026-10 (10-23); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); CVE-2026-102255 (10-15); CVE-2026-85097 (10-09); CVE-2026-107406 (10-09); GhostAction-2026-10 (10-10); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-110264 (10-22); CVE-2026-97229 (10-13); Ruby-Onigmo-2026-10-23 (10-24).