Cyber Threat Brief — October 28 2026
⚠️ This report is AI-generated. Always validate findings.
1. PHP2Shell — CVE-2026-109618
TL;DR: Palo Alto’s advisory, updated 28 October, says active exploitation has been observed against the management interface exposed to the internet. KEV is still due 29 October 2026, and 11.2.7-h23, 11.2.13-h4, and 11.2.16-h1 are now released.
What’s New:
- Palo Alto’s 28 October advisory says active exploitation has been observed against the management interface exposed to the internet.
- The KEV due date for CVE-2026-109618 and CVE-2026-109619 is still 29 October 2026, and BOD 26-04 forensic triage still applies.
- The 28 October changelog marks 11.2.7-h23, 11.2.13-h4, and 11.2.16-h1 as released.
- Synology-SA-26:14 publishes PHP package floors for the same CVEs, and it says the built-in DSM PHP has no external attack surface.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| PAN-OS management interface exposed to the internet | Exposure | T1190 | PAN-OS interface inventory | Palo Alto’s 28 October advisory says active exploitation has been observed against the management interface exposed to the internet. Remove that interface from the internet, then install the released build for the train. |
| PAN-OS 11.2.16-h1 | Fixed build | T1190 | PAN-OS version inventory | On 11.2.16, install 11.2.16-h1 or later. The 28 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.2.13-h4 | Fixed build | T1190 | PAN-OS version inventory | On 11.2.13, install 11.2.13-h4 or later. The 28 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| PAN-OS 11.2.7-h23 | Fixed build | T1190 | PAN-OS version inventory | On 11.2.7, install 11.2.7-h23 or later. The 28 October advisory removed the ETA because this build is released. Confirm it is on the portal before you install it. |
| Synology PHP 8.4.27-0051 | Fixed package | T1190 | Synology Package Center | On Synology PHP 8.4, install 8.4.27-0051 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 8.3.36-0051 | Fixed package | T1190 | Synology Package Center | On Synology PHP 8.3, install 8.3.36-0051 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 8.2.35-0171 | Fixed package | T1190 | Synology Package Center | On Synology PHP 8.2, install 8.2.35-0171 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 8.1.34-0120 | Fixed package | T1190 | Synology Package Center | On Synology PHP 8.1, install 8.1.34-0120 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 8.0.30-0122 | Fixed package | T1190 | Synology Package Center | On Synology PHP 8.0, install 8.0.30-0122 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 7.4.33-0131 | Fixed package | T1190 | Synology Package Center | On Synology PHP 7.4, install 7.4.33-0131 or above. Synology-SA-26:14 maps this package to CVE-2026-109618 and CVE-2026-109619. |
| Synology PHP 7.3 | No fix | T1190 | Synology Package Center | Synology PHP 7.3 has no fix. The advisory says this version is end of life. Disable the PHP-dependent package or move off PHP 7.3. |
| Synology Calendar 3.0.4-21435 | Fixed package | T1190 | Synology Package Center | On Synology Calendar, install 3.0.4-21435 or above. Synology-SA-26:14 lists Calendar as an affected package for these CVEs. |
| Synology Mail Station 30000002.3.19-20333 | Fixed package | T1190 | Synology Package Center | On Synology Mail Station, install 30000002.3.19-20333 or above. Synology-SA-26:14 lists Mail Station as an affected package for these CVEs. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — PHP Memory Exhaustion Exploitation Attempt via Multipart Request | Apache or Nginx correlation only; PAN-OS management misses. |
| Elastic | Partial — Potential PHP2Shell Exploitation Attempt | Apache or Nginx error text only; PAN-OS management misses. |
| Sigma | None — verified | No SigmaHQ rule names CVE-2026-109618. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Confirm the build on the portal before you install it. Trains that still show an ETA are in the 27 October brief. Hunt a shell whose parent is php-fpm, php-cgi, or httpd. On Synology, update PHP in Package Center, then let the dependent package restart. CVE-2026-115560 stays separate.
Sources: Palo Alto CVE-2026-109618 · KEV catalog · Synology-SA-26:14 · 27 October brief · 26 October brief
2. PolyShell — CVE-2026-48356
TL;DR: CISA added CVE-2026-48356 to KEV on 27 October, due 10 November 2026. Install the July APSB26-73 package for your Adobe Commerce or Magento Open Source line, then look for files under pub/media/custom_options/quote/.
What’s New:
- CISA’s 27 October alert adds CVE-2026-48356 and sets the KEV due date at 10 November 2026.
- The KEV note points at Adobe bulletin APSB26-73. That bulletin, last updated 11 August 2026, says Adobe is not aware of any exploits.
- Sansec’s research says the guest-cart REST API writes the upload to
pub/media/custom_options/quote/with no login. - Installing the July package does not delete a file that is already on disk.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Adobe Commerce 2.4.9-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.9, install 2.4.9-2026-jul. APSB26-73 lists 2.4.9 as affected and this July package as the fix line. |
| Adobe Commerce 2.4.8-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.8-p5 and earlier, install 2.4.8-2026-jul. APSB26-73 lists that line as affected. |
| Adobe Commerce 2.4.7-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.7-p10 and earlier, install 2.4.7-2026-jul. APSB26-73 lists that line as affected. |
| Adobe Commerce 2.4.6-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.6-p15 and earlier, install 2.4.6-2026-jul. APSB26-73 lists that line as affected. |
| Adobe Commerce 2.4.5-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.5-p17 and earlier, install 2.4.5-2026-jul. APSB26-73 lists that line as affected. |
| Adobe Commerce 2.4.4-2026-jul | Fixed package | T1190 | Magento version inventory | On Adobe Commerce 2.4.4-p18 and earlier, install 2.4.4-2026-jul. APSB26-73 lists that line as affected. |
| Magento Open Source 2.4.9-2026-jul | Fixed package | T1190 | Magento version inventory | On Magento Open Source 2.4.9, install 2.4.9-2026-jul. APSB26-73 lists 2.4.9 as affected and this July package as the fix line. |
| Magento Open Source 2.4.8-2026-jul | Fixed package | T1190 | Magento version inventory | On Magento Open Source 2.4.8-p5 and earlier, install 2.4.8-2026-jul. APSB26-73 lists that line as affected. |
| Magento Open Source 2.4.7-2026-jul | Fixed package | T1190 | Magento version inventory | On Magento Open Source 2.4.7-p10 and earlier, install 2.4.7-2026-jul. APSB26-73 lists that line as affected. |
| Magento Open Source 2.4.6-2026-jul | Fixed package | T1190 | Magento version inventory | On Magento Open Source 2.4.6-p15 and earlier, install 2.4.6-2026-jul. APSB26-73 lists that line as affected. |
| pub/media/custom_options/quote/ | Upload path | T1505.003 | Web server file inventory | On the store host, list pub/media/custom_options/quote/. Treat a .php, .phtml, or .phar file there as a webshell candidate. The July package does not remove a file already written. |
| POST /V1/guest-carts/:cartId/items | Request path | T1190 | Web server access log | In the web access log, review POST /V1/guest-carts/ item requests that carry a file upload. Sansec says this guest-cart route needs no login. GraphQL is a different code path. |
| location ~* ^/pub/media/custom_options/ | Web server deny | T1190 | Nginx or Apache config | Deny web access to pub/media/custom_options/ before any PHP handler. Sansec says a deny does not stop the API from writing the file. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No current Magento rule names CVE-2026-48356. |
| Elastic | Not checked | Code search was rate-limited before a Magento query. |
| Sigma | None — verified | No rule names CVE-2026-48356 or custom_options. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Inventory the Commerce or Magento version. Install the July package for that line. List pub/media/custom_options/quote/. Review guest-cart POSTs. B2B packages are also listed in APSB26-73. This CVE is not CVE-2026-103849.
Sources: CISA alert, 27 October · KEV catalog · Adobe APSB26-73 · Sansec PolyShell
3. Tailscale SSH — v1.104.4
TL;DR: Tailscale shipped v1.104.4 on 28 October for TS-2026-014 through TS-2026-017. Upgrade nodes that run Tailscale SSH, and keep TS_SSH_DISABLE_FORWARDING=1 until that build is installed.
What’s New:
- v1.104.4, published 28 October, fixes TS-2026-014, TS-2026-015, TS-2026-016, and TS-2026-017.
- An attacker still needs an authorized Tailscale SSH peer. Tailscale says this is not a self-replicating worm.
- The same release fixes three Serve and Funnel bugs. Two other Serve findings are behavior Tailscale says is intended.
- The 28 October bulletins do not list a headscale build.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| tailscale v1.104.4 | Fixed build | T1068 | tailscale version | On nodes that run Tailscale SSH or Tailscale Serve, install v1.104.4 or later. That build is the fix for TS-2026-014, TS-2026-015, TS-2026-016, and TS-2026-017. |
| TS_SSH_DISABLE_FORWARDING=1 | Service environment | T1068 | tailscaled service environment | Until v1.104.4 is installed, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart tailscaled. TS-2026-014 says this disables SSH forwarding without disabling Tailscale SSH. |
| unix:/run/tailscale/tailscaled.sock | Serve target | T1078 | node serve configuration | If tailscale serve forwards TCP to unix:/run/tailscale/tailscaled.sock, remove that forward. TS-2026-016 says a Unix-socket backend could reach the tailscaled local API. v1.104.4 restricts that forward. |
| tag-wide or identity-wide Tailscale SSH accept rule | SSH policy | T1068 | tailnet policy file | Replace a tag-wide or identity-wide ssh accept rule with one source and one destination. Tailscale’s 28 October post says to limit SSH to the users and devices that need it. |
| headscale v0.29.5 | No numbered fix in these bulletins | T1068 | headscale version | The 28 October bulletins do not list a headscale build. The Hacker News, citing the researcher report, says headscale v0.29.5 (13 October) does not include these fixes, and headscale policy cannot turn SSH forwarding off. Treat an SSH grant there as root-equivalent until a fixed headscale build ships. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Image name tailscale misses SSH socket forwarding. |
| Elastic | None — verified | SOCKS and HTTP proxy flags miss SSH socket forwarding. |
| Sigma | None — verified | DNS lookup for tailscale.com misses SSH socket forwarding. |
Detection index: ESCU a3f6523 (2026-10-23) · elastic detection-rules abc8111 (2026-10-27) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run tailscale version and confirm v1.104.4 or later. If it is older, set TS_SSH_DISABLE_FORWARDING=1 and restart tailscaled. Narrow a tag-wide or identity-wide ssh accept rule to one source and one destination. If a node may already be compromised, delete it in the control plane.
Sources: Tailscale SSH findings and fixes · Tailscale security bulletins · The Hacker News · 27 October brief
Status Updates
- CVE-2026-111497 (Brotli / Node.js): CISA added CVE-2026-111497 on 27 October, due 10 November 2026. Confirm Node.js with
node -vat 22.23.4, 24.22.1, or 26.12.1. The October security note lists those three lines, and it says end-of-life lines stay affected. The 28 October PAN-OS portfolio page still says Palo Alto is not aware of malicious exploitation of this issue, and it marks 11.2.7-h23, 11.2.13-h4, and 11.2.16-h1 as released. 27 October brief. KEV catalog. Palo Alto CVE-2026-111497. - eMudhra-CVE-2026-111943 (Chrome): A fetch on 28 October of Google’s Chrome root post still says removal of emSign ECC Root CA – G3 from the Chrome Root Store is expected Tuesday morning 27 October 2026 PDT. Website operators with a certificate that chains to that root need a certificate from another hierarchy in the Chrome Root Store. 23 October. 27 October.
- eMudhra-CVE-2026-111943 (Windows): Microsoft’s MSRC post, updated 27 October, says an out-of-band Windows update on 26 October removes seven certificates from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. This was not a compromise of Microsoft systems. Let the Disallowed Certificate Trust List update reach the device.
- eMudhra-CVE-2026-111943 (Edge): The same 27 October update says Microsoft removed those seven certificates from the Microsoft Edge trust list. The Edge CRLSet update is a component update and does not require a new browser version.
- eMudhra-CVE-2026-111943 (CloudFront): AWS bulletin 2026-150-AWS, last updated 27 October 2026 at 2:30 p.m. PDT, still says CloudFront is deploying root removal from the edge CA bundle by the target date 2026-10-28. An origin whose certificate chains to one of the three roots can fail TLS.
- eMudhra-CVE-2026-111943 (Application Load Balancer): The same bulletin says to replace an identity-provider certificate that chains to one of the three roots by 2026-10-28 when the load balancer uses OIDC or JWT. Existing load balancers update from 2026-10-29 through 2026-10-31. New load balancers are protected by 2026-11-02.
- eMudhra-CVE-2026-111943 (Bottlerocket): The same bulletin still targets updated AMI parameters in commercial regions for 2026-10-28. AMI v1.67.0 and older stay affected until those AMIs ship. Apply the interim per-node override from the bulletin. Do not copy the certificates out of the bulletin into a ticket.
- CVE-2026-114625 (VeloCloud Orchestrator): KEV due 2026-10-26 remains overdue. Fixed builds remain 5.2.3.18, 6.1.3.10, and 6.4.2.12. Block 74.82.197.86 and 38.54.50.151. BOD 26-04 forensic triage is required. No new IOC set. Original brief. KEV catalog.
- CVE-2026-110447 (Collabora Online built-in CODE server): KEV due 2026-10-26 remains overdue. Update
richdocumentscodeto 26.4.303 or remove it withocc app:remove richdocumentscode. Disabling the app leavesproxy.phpreachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. Standalone Collabora Online is not affected. This CVE has not had its own section. BOD 26-04 forensic triage is required. Original brief. KEV catalog. - Plex2Shell-CVE-2026-96652: CVE-2026-96654 and CVE-2026-96656 were KEV due 2026-10-23 and remain overdue. CVE-2026-96652 and CVE-2026-96655 are due 2026-11-03. Fixed build remains 1.43.3.10861. BOD 26-04 forensic triage is required on the overdue entries. Original brief.
- SiteGuard-CVE-2026-106931: KEV added 2026-10-20, not yet briefed. KEV due 2026-10-23 remains overdue. Fixed in Ver8.00 Update5 (Apache, Nginx, IIS) and Ver7.00 Update6 (FreeBSD). BOD 26-04 forensic triage is required. KEV catalog · EG Secure.
- Retired from watch: CVE-2026-0257 (last update 2026-10-21). KEV due 2026-06-01 is more than seven days past, and this run found no new fixed build or IOC set. Original brief.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-110264 (10-22); CVE-2026-97229 (10-24, original 10-13); CVE-2026-105192 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); CVE-2026-102255 (10-15); GhostAction-2026-10 (10-10); Danfoss-AKSM-FROMAGEGATE-2026-10 (10-13); UNC7017-AOMEI-2026-10 (10-17); Candiru-AdFection-DiscoverTech-2026-10 (10-18); InfinityCore-2026-10 (10-18); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); TimeSmuggler-NetScaler-2026-10 (10-23); Ruby-Onigmo-2026-10-23 (10-24).