Weekly AppSec Threat Digest: PHP2Shell RCE, VeloCloud Zero-Day, Plex2Shell & GitLab

This was the week PHP itself became the vulnerability. Two memory-safety flaws in PHP core, collectively named PHP2Shell, give an unauthenticated attacker a path to remote code execution through nothing more than crafted HTTP requests — on PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed alike. Technical details leaked a day before the coordinated fix, and exploitation attempts hit honeypots and edge networks before most teams had a patch to deploy.

Elsewhere, Arista confirmed an exploited SQL injection in on-premises VeloCloud Orchestrator, CISA added the four-bug Plex2Shell chain and a host-based WAF to its Known Exploited Vulnerabilities (KEV) catalog, GitLab shipped a second CVSS 10.0 regex-compiler RCE in two weeks, Laravel patched an authentication bypass in its token guard, and a compromised LiteLLM release spent roughly two hours on PyPI and Docker Hub stealing AI provider keys and cloud credentials.

Lead story: PHP2Shell (CVE-2026-109618, CVE-2026-109619)

PHP shipped emergency releases on October 21 — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — for two flaws found by researchers from Calif, OpenAI and Wiz. Both stem from the same root problem: when a request is aborted abnormally (most notably by an out-of-memory error, which PHP handles by unwinding with longjmp()), request state is left half-initialized or dangling, and later cleanup code — or the next request on the same worker — trusts it.

• CVE-2026-109618 — out-of-memory handling during request processing (for example multipart parsing) leaves corrupted memory that request shutdown treats as valid, leading to code execution as the web worker account. NVD scores it 9.8 (CVSS v3.1).
• CVE-2026-109619 — request-owned global state survives being freed and is reused across requests, giving an unauthenticated heap use-after-free, cross-request memory disclosure, and RCE. Confirmed triggers include session upload progress (enabled by default) and, on PHP 8.5, fatal-error backtraces.

PHP scores both 9.2 under CVSS v4.0 with high attack complexity: success depends on allocator layout and worker scheduling. The PHP team considers mod_php the highest-risk deployment because cleanup runs even when request startup fails — before any application code, framework, or authentication layer is involved. Wiz demonstrated unauthenticated RCE against stock WordPress, Drupal and Joomla containers.

Crafted multipart request

No authentication

↓→

Abnormal abort

OOM / fatal error

↓→

Stale or corrupt state

UAF, memory leak

↓→

Code execution

As the web worker

Exploitation status. Details and a proof-of-concept leaked on October 20, ahead of the planned release. Cloudflare said it was already seeing early attacks before patches shipped and deployed temporary WAF rules; Amazon reported a probe on its honeypots from October 17 and proof-of-concept attempts from early October 21; watchTowr observed in-the-wild exploitation attempts against both CVEs. Rapid7 notes that public PoCs only work on specific OS, PHP and web-server combinations and, at the time of writing, had not confirmed successful exploitation. PHP2Shell was not in CISA's KEV catalog as of the October 21 feed.

Remediation: upgrade to a fixed release and restart every FPM pool and Apache worker — and verify the version your web server actually loads, not just the CLI's php -v. Branches 8.1 and older receive no upstream releases; source backports exist for 7.4, 8.0 and 8.1, and distributions are shipping their own. Interim, partial mitigations must be set at server level (ini_set() and .user.ini apply too late): session.upload_progress.enabled=0, fatal_error_backtraces=0 on 8.5, a low post_max_size, and request-size limits at the proxy. Then hunt: preserve logs and look for large or deeply nested multipart requests followed by memory-limit errors, bursts of empty 500s, oversized PHPSESSID cookies, and new web shells. See the PHP advisory, Wiz's research, watchTowr and Rapid7.

Actively exploited this week

CVE-2026-114625 — Arista VeloCloud Orchestrator On-Prem (CVSS 9.9, zero-day)

Arista's Security Advisory 0199 (October 22) describes a SQL injection (CWE-89) that lets any authenticated user — down to the Enterprise Read Only role, the lowest built-in tenant role — gain operator privileges and impersonate the local superuser operator, reaching internal-only functionality on the SD-WAN orchestrator. Arista states the flaw is known to be actively exploited and that no configuration prevents exposure. Affected: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. Hosted and Dedicated instances are already patched. This is a different bug from the VeloCloud flaw exploited in July.

Read-only tenant login

Lowest built-in role

↓→

CVE-2026-114625

SQL injection

↓→

Operator impersonation

Superuser operator

↓→

Orchestrator compromise

Managed SD-WAN estate

Remediation: upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Until then, restrict the VCO web interface to trusted admin networks, block and monitor the published source IPs (74.82.197.86, 38.54.50.151), review web logs for encoded characters or references to internal services, and check for web shells and unexpected outbound traffic. Read Arista Security Advisory 0199 and BleepingComputer's coverage.

Plex2Shell — four Plex Media Server CVEs chained to unauthenticated RCE (KEV)

Researcher Zach Main reported the chain to Plex in July and published the write-up and a PoC on October 16; exploitation began the next day. No single bug is critical on its own, which is exactly the point:

• CVE-2026-96652 — unauthenticated SSRF via /player/timeline.
• CVE-2026-96654 — improper URL neutralization in searchOne, letting an attacker call other plugins' functions and obtain the owner's admin token.
• CVE-2026-96655 — authenticated SSRF via /video/:/transcode/universal.
• CVE-2026-96656 (CVSS v4 8.6) — a transcoder preference write that drops a shared object into the Codecs directory, where it is loaded and executed.

Unauthenticated SSRF

CVE-2026-96652

↓→

Admin token leak

CVE-2026-96654

↓→

Codec path write

CVE-2026-96656

↓→

Miner + proxy backdoor

Seen from Oct 17

Honeypots captured XMRig miners and a Linux backdoor/reverse proxy dubbed myawesomeproxy, and CISA added all four CVEs to KEV on October 20. The fix has been available since August in Plex Media Server 1.43.3.10861. Remediation: upgrade, then treat older internet-facing servers as potentially compromised — look for unknown .so/.dll files in the Codecs folder and transcoder options you did not set in Preferences.xml, rotate the Plex account password, and stop forwarding port 32400 directly. Plex2Shell is a home-lab story with an enterprise lesson: SSRF that looks “medium” in isolation is often the first link in a critical chain. See Plex's security notice and The Hacker News.

CVE-2026-106931 — SiteGuard Server Edition host WAF (KEV)

An OS command injection (CWE-78) in the statistics function of EG Secure Solutions' SiteGuard Server Edition — a host-based WAF for Apache, Nginx and IIS that is popular in Japan — runs commands as root or SYSTEM. JPCERT/CC scores it 8.5 (CVSS v4) with a local, low-privilege vector, but the vendor confirmed abuse and CISA added it to KEV on October 20 with an October 23 deadline. Fixed in 8.00 Update 5 (7.00 Update 6 on FreeBSD), with a file-replacement patch for end-of-life versions. Collect the vendor's diagnostic data before patching — the update can erase attack traces. See BleepingComputer.

CISA also added CVE-2026-110936, a DLL search-order hijack in Siemens Software Center (before V4.0.9.8), on October 20 — local and outside our usual web scope, but linked to ClickFix-style delivery.

Critical web application CVEs

CVE-2026-110264 — GitLab CE/EE (CVSS 10.0)

For the second time in two weeks, GitLab fixed a maximum-severity integer overflow in its regular-expression compiler: under certain conditions an unauthenticated user can execute code on the server when a crafted regex is compiled. This is a new bug — last week's 19.4.2 release does not fix it. Every version from 7.0 is affected. The same October 21 release fixes an LDAP account takeover when OmniAuth SAML and LDAP auto-linking are both enabled (CVE-2026-15723, CVSS 8.2) and an unauthenticated OAuth/OIDC discovery-document cache poisoning (CVE-2026-112212, CVSS 7.5). No exploitation has been reported.

Remediation: upgrade self-managed instances to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab.com and Dedicated are patched; there is no workaround. See the GitLab 19.5.1 patch release.

CVE-2026-114509 — Laravel TokenGuard authentication bypass (CVSS v4 9.2)

Laravel's built-in TokenGuard passed a non-string credential (for example an array submitted as the API token) into the user lookup. On MySQL or MariaDB, under certain configurations, the resulting query matches an unintended user record instead of failing — so an unauthenticated attacker can sign in as an existing user. Only applications using the token guard driver are in scope; the advisory lists no workaround. It is a clean example of a type-confusion bug that ordinary string-based fuzzing misses: test authentication parameters with arrays, objects and numbers, not just strings.

Remediation: upgrade laravel/framework to 12.68.0 or 13.29.0, which add an is_string() check. Read GHSA-f9x3-7vq9-cph6 and Laravel News.

Node.js October security releases — Brotli RCE and TLS hostname bypasses

Node.js 26.12.1, 24.22.1 and 22.23.4 (October 21) fix four High-severity issues: an out-of-bounds write in the Brotli decoder that the project says permits remote code execution (CVE-2026-111497), two TLS certificate hostname-verification bypasses (CVE-2026-105483, CVE-2026-106069), and NUL truncation in dns.resolve (CVE-2026-105482). Any service that decompresses untrusted Brotli input — request bodies, proxied responses, uploaded archives — should treat this as urgent. The release also pulls in Undici, c-ares and OpenSSL fixes and removes a compromised eMudhra intermediate CA. See the Node.js advisory.

Oracle October 2026 Critical Patch Update

Oracle's October 20 CPU ships 1,295 patches. None is flagged as exploited, but the web-facing criticals are the kind attackers historically reverse-engineer quickly:

• WebLogic Server — CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3/IIOP), both CVSS 9.8 and exploitable without authentication.
• E-Business Suite 12.2.3–12.2.15 — CVE-2026-101809 (Workflow Notification Mailer, CVSS 10.0) and CVE-2026-101767 (Application Object Library, 9.8), both unauthenticated over HTTP.
• Access Manager, SOA Suite, APEX — CVE-2026-87337 (10.0), CVE-2026-91231 (10.0) and CVE-2026-101521 (9.8), all unauthenticated.

Remediation: prioritise internet-facing WebLogic and EBS, and block T3/IIOP at the perimeter. Use the Oracle CPU risk matrices for exact affected versions; see also SecurityWeek.

Supply chain: the LiteLLM 1.107.0 compromise

On October 21 an attacker published a malicious litellm==1.107.0 to PyPI (live 11:39–~13:23 UTC) and repointed the Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable (until 14:20 and 13:51 UTC respectively). The GitHub source tag was clean. The payload drops cook.pth and sitecustomize.py, which run on every Python start — even if LiteLLM is never imported — and steal what an AI gateway concentrates: every provider key in the proxy database, master and virtual keys, the DATABASE_URL password, the instance IAM role and environment secrets.

LiteLLM's preliminary root cause is a reminder that CI hardening is only as strong as developer tokens: GitHub CLI OAuth tokens appear to have leaked into logs on an internet-exposed internal deployment, and privileged credentials were then used to disable branch protection, run the release workflow against a lookalike repository, and satisfy the production approval gate with a second developer's credentials.

Remediation: pin to 1.106.2. Do not run pip install first on an affected host (Python start-up re-runs the payload); delete the payload files, kill the daemon holding /tmp/remote_code_loader.lock, rebuild from scratch, rotate every credential the host could reach, and check CloudTrail for GetCallerIdentity calls around install time. Read LiteLLM's incident report.

Web application security research worth your time

High-fidelity PHP2Shell detection — Searchlight Cyber, October 22

Searchlight Cyber's Assetnote team argues that version banners are a poor signal for PHP2Shell and that many public scanners model the mod_php and PHP-FPM conditions incorrectly. Their open-source scanner works in tiers: first try to trigger a PHP memory-exhaustion error, then look for the empty HTTP 500 that signals an FPM worker failure, and only fall back to the advertised version last. Practical takeaway: the check deliberately causes out-of-memory conditions and can crash workers, so schedule it on production with care. Read the Searchlight Cyber write-up.

h3fuzz: content discovery over HTTP/3 — Searchlight Cyber, October 20

h3fuzz is an open-source fork of ffuf that adds HTTP/3 (QUIC), sending each request on its own stream across an adaptive connection pool, and confirming HTTP/3 support with a real QUIC handshake rather than trusting Alt-Svc. The headline 100k requests per second came from a local harness and is rarely reachable against real servers; the authors see the main value in timing (TOCTOU) attacks and discovery fuzzing. Practical takeaway: make sure WAF rate limits and logging cover HTTP/3, not just TCP. Read Introducing h3fuzz.

Unauthenticated pickle RCE in Xorbits Xoscar — VulnCheck, October 16

VulnCheck's Valentin Lobstein documented CVE-2026-49950 in Xoscar, the actor RPC layer under the Xinference model-serving framework: every inbound message is passed to cloudpickle.loads() before its type is checked, with no authentication. All versions are affected and no fix exists. Practical takeaway: AI serving stacks keep shipping internal RPC that assumes a trusted network — keep actor-pool ports off anything untrusted. Read the VulnCheck write-up.

Bug bounty highlights

Back-to-back CVSS 10 GitLab RCEs from one HackerOne researcher

Both of this month's GitLab regex-compiler RCEs (CVE-2026-97229 and CVE-2026-110264) are credited to researcher joaxcar through GitLab's HackerOne program. Bounty amounts were not disclosed. The pattern is worth noting for hunters: a fix for one integer overflow in a native parsing component rarely means the component is clean, and variant analysis on freshly patched code remains one of the highest-yield techniques in bug bounty.

HackerOne opens its own program to missed PHP2Shell instances

HackerOne says it has patched every known vulnerable PHP instance in infrastructure it operates, and that researchers who find an exploitable instance it missed are eligible for a reward under its own bug bounty program. It also expects an uptick in PHP2Shell submissions across customer programs and is tracking them on its Hacktivity CVE page. Read HackerOne's response.

Five years of CISA's federal VDP platform — Bugcrowd

Bugcrowd published figures for CISA's vulnerability disclosure platform as of June 2026: 44,493 submissions, more than 5,700 valid disclosures and over 5,300 fixes across 60+ agencies and roughly 10,000 researchers, plus 15 bug bounty events that paid $1.3M for 532 vulnerabilities. Read Bugcrowd's post.

The pattern: the platform under your platform

Last week the exploited zero-days were edge appliances. This week the most important bug sat one layer below most web applications — in the language runtime — and it reached code execution before any framework, router or authentication check ran. Add a Node.js decompression RCE and a poisoned AI-gateway package, and the message is the same: your exposure includes the runtime, the native libraries and the packages beneath your code, and your inventory has to know exact versions of all three.

The other recurring theme is chaining. Plex2Shell is four medium-to-high bugs that become critical together; Laravel's bypass is a type check that “did not matter” until the database layer interpreted an array. Severity scores rate bugs one at a time, while attackers combine them, so a single exploitable path is what you need to verify.

What to do first: October 16–23 action matrix

Sources and further reading

• PHP2Shell — PHP security release announcement, Wiz Research, watchTowr, BleepingComputer, SecurityWeek
• Arista VeloCloud (CVE-2026-114625) — Arista Security Advisory 0199
• Plex2Shell — BleepingComputer: CISA warns of Plex2Shell attacks
• CISA — Known Exploited Vulnerabilities catalog
• GitLab (CVE-2026-110264) — BleepingComputer: GitLab warns of new max-severity RCE
• Laravel (CVE-2026-114509) — GitHub Security Advisory
• Node.js — October 2026 security releases
• Oracle — Critical Patch Update Advisory, October 2026
• LiteLLM — Security incident, October 21, 2026
• Research — Searchlight Cyber: PHP2Shell detection, h3fuzz, VulnCheck: Xoscar cloudpickle RCE
• Bug bounty — HackerOne PHP2Shell response, Bugcrowd: five years of CISA's VDP platform