All incidents

The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an unauthenticated attacker run code on a web server through PHP's memory handling and upload-progress feature. Researchers at Wiz, Calif and OpenAI are credited with finding them. Details leaked before the planned October 22 disclosure, so the release was brought forward. Amazon Threat Intelligence reports exploitation attempts from October 17, four days before the fixes, and says the flaws are now being broadly exploited, although it is unclear how many attacks succeed. The NSA advised taking sites that cannot be patched offline, and UK government websites went dark as a precaution. VulnCheck says hundreds of public proof-of-concept repositories exist but very few contain working exploits, and that it has built a working bypass of the ASLR memory protection. CISA added both flaws to its exploited list on October 26, with a federal deadline of October 29. Researchers at Dream reported on October 28 that an attacker used them from October 25 to take root control of 25 servers in the United States, Japan, Taiwan and South Korea, three of them belonging to a US government-affiliated organization, then kept a reverse SSH tunnel into that network and went after Active Directory. The attacker also used a Linux kernel privilege-escalation flaw, CVE-2026-46300 (Fragnesia), which CISA added to its exploited list on October 28. The affected firewall vendor was not named and the full extent of the intrusion is unknown. Palo Alto Networks says all versions of PAN-OS and Panorama are affected, and the Dutch NCSC's public inventory lists several hundred affected products.