Cyber Threat Brief — October 27 2026
⚠️ This report is AI-generated. Always validate findings.
1. PHP2Shell-CVE-2026-109618 — KEV due 29 October
TL;DR: CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on 26 October, due 29 October 2026. Palo Alto’s 27 October update posts four more PAN-OS hotfixes, so install the build for your train after you see it on the portal.
What’s New:
- CISA’s 26 October alert update adds both CVEs to KEV and tells defenders to watch PHP workers that launch shells or download tools.
- The catalog entry requires BOD 26-04 forensic triage. CISA has not published what it saw.
- The 27 October PAN-OS advisory removes the ETA for 12.2.4-h1, 12.1.7-h11, 10.2.16-h12, and 10.2.13-h27 because those builds are released.
- Palo Alto is still not aware of malicious exploitation against its products, and CVE-2026-115560 is not part of this KEV add.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| PAN-OS 12.2.4-h1 | Fixed build | T1190 | PAN-OS version inventory | On 12.2, install 12.2.4-h1 or later. The 27 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 12.1.7-h11 | Fixed build | T1190 | PAN-OS version inventory | On 12.1.7, install 12.1.7-h11 or later. The 27 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 10.2.16-h12 | Fixed build | T1190 | PAN-OS version inventory | On 10.2.16, install 10.2.16-h12 or later. The 27 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 10.2.13-h27 | Fixed build | T1190 | PAN-OS version inventory | On 10.2.13, install 10.2.13-h27 or later. The 27 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 12.1.10-h3 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 12.1.10, the floor is 12.1.10-h3. The advisory ETA is still 30 October 2026. Wait until the build is on the portal. |
| PAN-OS 12.1.4-h13 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 12.1.4, the floor is 12.1.4-h13. The advisory ETA is still 29 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.16-h1 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.16, the floor is 11.2.16-h1. The advisory ETA is still 28 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.13-h4 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.13, the floor is 11.2.13-h4. The advisory ETA is still 27 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.7-h23 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.7, the floor is 11.2.7-h23. The advisory ETA is still 29 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.4-h23 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.4, the floor is 11.2.4-h23. The advisory ETA is still 30 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.1.7-h12 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.1.7, the floor is 11.1.7-h12. The advisory ETA is still 30 October 2026. Wait until the build is on the portal. |
| PAN-OS 10.2.10-h42 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 10.2.10, the floor is 10.2.10-h42. The advisory ETA is still 29 October 2026. Wait until the build is on the portal. |
| PAN-OS 10.2.7-h39 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 10.2.7, the floor is 10.2.7-h39. The advisory ETA is still 30 October 2026. Wait until the build is on the portal. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — PHP Memory Exhaustion Exploitation Attempt via Multipart Request | Apache or Nginx correlation only; PAN-OS management misses. |
| Elastic | Partial — Potential PHP2Shell Exploitation Attempt | Memory-exhaustion error text only; PAN-OS management misses. |
| Sigma | None — verified | No SigmaHQ rule names this CVE. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules eb500af (2026-10-26) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Confirm the build on the portal before you install it. Builds already released are in the 26 October brief. Hunt a shell whose parent is php-fpm, php-cgi, or httpd. Palo Alto is not aware of malicious exploitation against its products. CVE-2026-115560 stays separate.
Sources: CISA alert, updated 26 October · KEV catalog · Palo Alto CVE-2026-109618 · BleepingComputer · SecurityWeek · 26 October brief · 21 October brief
2. CVE-2026-111497 — PAN-OS and PHP Windows Brotli floors
TL;DR: Palo Alto’s 27 October portfolio page posts Brotli floors for PAN-OS, and PHP rebuilt its Windows packages with Brotli 1.2.1 on 26 October. Install the released build for your train, and disable Brotli inspection while a train still shows an ETA.
What’s New:
- The 27 October changelog removes the ETA for 11.2.10-h17, 12.1.7-h11, and 12.2.4-h1 because those builds are released.
- 11.2.10-h16 fixes the PHP bugs only. Brotli on the 11.2.10 train needs 11.2.10-h17.
- PAN-OS 11.1, PAN-OS 10.2, and Panorama are not affected; exposure on 11.2.4 and later also needs Brotli inspection and TLS decryption.
- PHP’s 26 October Windows rebuilds are 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, with cURL decompression off by default and no live attacks established.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| PAN-OS 11.2.10-h17 | Fixed build | T1190 | PAN-OS version inventory | On 11.2.10, install 11.2.10-h17 or later for CVE-2026-111497. 11.2.10-h16 is the PHP floor only. The 27 October portfolio page removed the ETA for 11.2.10-h17 because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 12.2.4-h1 | Fixed build | T1190 | PAN-OS version inventory | On 12.2, install 12.2.4-h1 or later. The 27 October Brotli page removed the ETA because this build is released. The same hotfix covers the PHP bugs. Confirm it is on the portal before you install it. |
| PAN-OS 12.1.7-h11 | Fixed build | T1190 | PAN-OS version inventory | On 12.1.7, install 12.1.7-h11 or later. The 27 October Brotli page removed the ETA because this build is released. The same hotfix covers the PHP bugs. Confirm it is on the portal before you install it. |
| PAN-OS 12.1.10-h3 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 12.1.10, the Brotli floor is 12.1.10-h3. The portfolio ETA is still 30 October 2026. Wait until the build is on the portal. |
| PAN-OS 12.1.4-h13 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 12.1.4, the Brotli floor is 12.1.4-h13. The portfolio ETA is still 29 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.16-h1 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.16, the Brotli floor is 11.2.16-h1. The portfolio ETA is still 28 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.13-h4 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.13, the Brotli floor is 11.2.13-h4. The portfolio ETA is still 27 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.7-h23 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.7, the Brotli floor is 11.2.7-h23. The portfolio ETA is still 29 October 2026. Wait until the build is on the portal. |
| PAN-OS 11.2.4-h23 | Fixed build, ETA | T1190 | PAN-OS version inventory | On 11.2.4, the Brotli floor is 11.2.4-h23. The portfolio ETA is still 30 October 2026. Wait until the build is on the portal. |
| set system setting brotli-encoding disable | Workaround | T1190 | PAN-OS CLI | On PAN-OS 11.2.4 or later, run set system setting brotli-encoding disable until the floor for that train is installed. Confirm with show system setting brotli that the output shows Enabled: no. |
| PAN-OS 11.1 | Not affected | T1190 | PAN-OS version inventory | PAN-OS 11.1 has no Brotli inspection. No Brotli hotfix applies on this train. |
| PAN-OS 10.2 | Not affected | T1190 | PAN-OS version inventory | PAN-OS 10.2 has no Brotli inspection. No Brotli hotfix applies on this train. |
| Panorama | Not affected | T1190 | Panorama version inventory | Panorama, virtual and M-series, is not affected by CVE-2026-111497. |
| PHP 8.5.12-1 | Fixed Windows package | T1190 | Windows PHP package inventory | On Windows PHP 8.5, install package 8.5.12-1 or later. The 26 October PHP note says this rebuild includes Brotli 1.2.1. The PHP runtime version stays 8.5.12. cURL automatic decompression is off by default. |
| PHP 8.4.27-1 | Fixed Windows package | T1190 | Windows PHP package inventory | On Windows PHP 8.4, install package 8.4.27-1 or later. The 26 October PHP note says this rebuild includes Brotli 1.2.1. The PHP runtime version stays 8.4.27. cURL automatic decompression is off by default. |
| PHP 8.3.36-1 | Fixed Windows package | T1190 | Windows PHP package inventory | On Windows PHP 8.3, install package 8.3.36-1 or later. The 26 October PHP note says this rebuild includes Brotli 1.2.1. The PHP runtime version stays 8.3.36. cURL automatic decompression is off by default. |
| PHP 8.2.35-1 | Fixed Windows package | T1190 | Windows PHP package inventory | On Windows PHP 8.2, install package 8.2.35-1 or later. The 26 October PHP note says this rebuild includes Brotli 1.2.1. The PHP runtime version stays 8.2.35. cURL automatic decompression is off by default. |
| Prisma Cloud Application Security Transporter Client 0.2.9 | Fixed build | T1190 | Transporter client inventory | On Prisma Cloud Application Security Transporter Client, install 0.2.9 or later. Versions from 0.2.0 before 0.2.9 are in the affected range on the portfolio page. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names Brotli or CVE-2026-111497. |
| Elastic | None — verified | In-process decode and PAN-OS dataplane miss. |
| Sigma | None — verified | No rule names Brotli or CVE-2026-111497. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules eb500af (2026-10-26) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: On PAN-OS 11.2.4 or later, run show system setting brotli. If it prints Enabled: yes, disable Brotli inspection until the floor for that train is installed. Palo Alto is not aware of malicious exploitation of this issue. Other Brotli floors are in the 26 October brief and the 24 October brief.
Sources: Palo Alto CVE-2026-111497 · PHP news archive, 26 October · 26 October brief · 24 October brief
3. Tailworm — Tailscale SSH privilege escalation
TL;DR: Tailscale says an already-authorized Tailscale SSH user can act beyond the configured local user, and it is targeting a patched client by the end of 27 October. Set TS_SSH_DISABLE_FORWARDING=1 and restart tailscaled until that numbered build is published.
What’s New:
- Tailscale’s 26 October update calls the privilege-escalation issues serious, and it is not telling every customer to turn Tailscale SSH off.
- No CVE and no numbered fixed release are on the security bulletins page. The target is the end of 27 October, subject to testing.
- The researcher report, updated 27 October, says fixes are on
mainfor clients at or below v1.104.2 and headscale at or below v0.29.6, and the interim steps still apply. - The report’s root demonstrations are lab tests on unmodified releases. Tailscale has not confirmed each technique in that report.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TS_SSH_DISABLE_FORWARDING=1 | Service environment | T1068 | tailscaled service environment | Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart tailscaled. Tailscale says this disables SSH forwarding without disabling Tailscale SSH and mitigates several of the more serious findings. Set it on every node that serves Tailscale SSH, including nodes that use headscale. |
| tailscale v1.104.2 | Affected client, no numbered fix | T1068 | tailscale version | On clients at or below v1.104.2, no numbered fixed release is published yet. Install the patched client when Tailscale lists the version on the download page. A commit on main is the upstream fix in progress, and it is not the release you install. |
| headscale v0.29.6 | Affected control server, no numbered fix | T1068 | headscale version | On headscale at or below v0.29.6, the researcher report says no numbered fix has shipped. On v0.29.5, policy cannot turn forwarding off, so treat every SSH grant as root-equivalent until TS_SSH_DISABLE_FORWARDING=1 is set or a fixed build ships. Tailscale has not published a headscale bulletin for this issue. |
| tag-wide or identity-wide Tailscale SSH accept rule | SSH policy | T1068 | tailnet policy file | Replace a tag-wide or identity-wide ssh accept rule with one source and one destination, limited to the users and devices that need access. The researcher report says a single source-to-destination pair stopped the lab spread. Tailscale’s customer update says to limit SSH to the users and devices that need it. |
| unix:/run/tailscale/tailscaled.sock | Serve target | T1078 | node serve configuration | If tailscale serve forwards TCP to unix:/run/tailscale/tailscaled.sock, remove that forward. The 27 October report says main refuses this target in PR 21966, and no numbered release contains that refusal yet. Tailscale’s customer update does not mention serve. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | RMM process-name rules miss SSH forwarding. |
| Elastic | None — verified | Tailscaled SOCKS-flag rule misses SSH forwarding. |
| Sigma | None — verified | DNS lookup for tailscale.com misses SSH forwarding. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules eb500af (2026-10-26) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run tailscale version and confirm the tailscaled service environment contains TS_SSH_DISABLE_FORWARDING=1, then restart the service. In the tailnet policy, change a broad ssh accept rule to one source and one destination. Remove a serve forward whose target is a Unix socket. If a node is compromised, delete it in the control plane. Reimaging the host does not revoke a key that was copied off the node. These sources describe lab findings and Tailscale’s own investigation, and they do not describe a customer incident.
Sources: Tailscale SSH investigation update · Tailworm report · The Hacker News · Tailscale security bulletins
Status Updates
- eMudhra-CVE-2026-111943 (Chrome): Google’s Chrome root post says emSign ECC Root CA – G3 is removed from the Chrome Root Store, and that this removal is expected to reach devices Tuesday morning 27 October 2026 PDT. Fetches at 05:40 PDT, 05:54 PDT, and 05:57 PDT still used the word expected. Website operators with a certificate that chains to that root need a certificate from another hierarchy in the Chrome Root Store. 23 October. 26 October.
- eMudhra-CVE-2026-111943 (Bottlerocket): AWS bulletin 2026-150-AWS, last updated 26 October 2026 at 1:30 p.m. PDT, still targets updated AMIs for 2026-10-26 and does not say those AMIs have shipped. AMI v1.67.0 and older stay affected. AMI parameters in commercial regions are still targeted for 2026-10-28. Apply the interim per-node override from the bulletin. Do not copy the certificates out of the bulletin into a ticket. 23 October.
- eMudhra-CVE-2026-111943 (CloudFront): The same bulletin is removing the three roots from the CloudFront edge CA bundle, target 2026-10-28. An origin whose certificate chains to one of those roots can fail TLS.
- eMudhra-CVE-2026-111943 (Application Load Balancer): Replace an identity-provider certificate that chains to one of the three roots by 2026-10-28 when the load balancer uses OIDC or JWT. Existing load balancers update from 2026-10-29 through 2026-10-31. New load balancers are protected by 2026-11-02.
- eMudhra-CVE-2026-111943 (Lambda): The same bulletin targets Lambda patch images in the Amazon ECR Public Gallery by 2026-10-27. Managed runtimes used by ZIP packages are targeted for all regions by 2026-10-30.
- CVE-2026-114625 (VeloCloud Orchestrator): KEV due 2026-10-26 is now overdue. Fixed builds remain 5.2.3.18, 6.1.3.10, and 6.4.2.12. Block 74.82.197.86 and 38.54.50.151. BOD 26-04 forensic triage is required. No new IOC set. Original brief. KEV catalog.
- CVE-2026-110447 (Collabora Online built-in CODE server): KEV due 2026-10-26 is now overdue. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Disabling the app leavesproxy.phpreachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. Standalone Collabora Online is not affected. This CVE has not had its own section. BOD 26-04 forensic triage is required. Original brief. KEV catalog. - Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 were KEV due 2026-10-23 and are overdue. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. BOD 26-04 forensic triage is required on the overdue entries. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due 2026-10-23 is overdue. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). BOD 26-04 forensic triage is required. KEV catalog · EG Secure.
- CVE-2026-0257 (PAN-OS GlobalProtect): KEV due 2026-06-01 remains overdue. No new fixed build or IOC set was confirmed in this run. Last material update 2026-10-21 is inside seven days, so this CVE stays on watch. Original brief.
- LiteLLM-1.107.0-2026-10: Elastic detection-rules
eb500af(26 October) adds Package Runtime Secret File Access Followed by IMDS Request. The query sequences a package runtime that opens a developer secret and then connects to an IMDS address on port 80 within one minute, on macOS or Windows. It does not matchcook.pthby name, and Elastic Defend file-open events do not cover Linux. Original brief. - Retired from watch: CVE-2026-85097 (last update 2026-10-13), CVE-2026-107406 (last update 2026-10-13). No KEV entry for either CVE. The Patchstack entry still lists the fix as 3.1.8.10 (published 7 October 2026), and this run’s candidate feed had no newer Bricksforge item. CTX697191 still lists the same floors, 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, and 13.1.37.283, with visible dates of 2026-10-08. Bricksforge brief. NetScaler brief.
- Watching (no change): TimeSmuggler-NetScaler-2026-10 (10-23); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); CVE-2026-102255 (10-15); GhostAction-2026-10 (10-10); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); CVE-2026-110264 (10-22); CVE-2026-97229 (10-24, original 10-13); Ruby-Onigmo-2026-10-23 (10-24).