Weekly AppSec Threat Digest: PHP2Shell Hits KEV, Cisco ASA Zero-Day, GitLab & Drupal Exploited

Last week PHP2Shell was a race between a leaked proof-of-concept and a patch. This week it became a confirmed, chained, government-tracked campaign. CISA added both PHP CVEs to its Known Exploited Vulnerabilities (KEV) catalog, Palo Alto Networks confirmed exploitation against internet-exposed PAN-OS management interfaces, and CISA then added a Linux kernel flaw, Fragnesia, that attackers chain with PHP2Shell to turn a web-worker shell into root.

The rest of the KEV feed read like an AppSec team's asset inventory: a Cisco Secure Firewall SSL VPN zero-day, the GitLab CI regex RCE (with a public post-incident write-up from Alpine Linux), the Brotli decoder flaw now joined by emergency .NET patches, an Adobe Commerce file-upload bug, and a Collabora Online command injection hitting Nextcloud. Drupal flagged an actively exploited access bypass in Commerce Core. And SVG kept turning up as an XSS vector: in PortSwigger's sanitizer research, in a Cloudflare image-endpoint chain, and in an exploited webmail bug.

Lead story: PHP2Shell escalates to KEV, PAN-OS and root

We covered the two PHP core flaws (CVE-2026-109618, CVE-2026-109619; CVSS v4 9.2) in last week's digest. Three things changed in the last seven days:

• KEV listing. CISA added both CVEs on October 26 with a three-day federal deadline (October 29) — formal confirmation that exploitation moved beyond honeypot probes.
• Appliances that embed PHP. Palo Alto Networks' advisory for the same CVEs now states that active exploitation has been observed against the PAN-OS management interface exposed to the internet. PAN-OS and Panorama 10.2, 11.1, 11.2, 12.1 and 12.2 are affected, with fixes shipping as hotfix builds per release train. Your PHP inventory has to include the vendor appliances that bundle PHP, not just your own web servers.
• The root chain. On October 28 CISA added CVE-2026-46300 (“Fragnesia”), a Linux kernel local privilege escalation in the XFRM ESP-in-TCP code, noting that it can be chained with the PHP2Shell CVEs to implant PHP web shells and run commands as root. Researchers at Dream Security attribute a campaign that rooted 25 servers across the US, Japan, Taiwan and South Korea to a suspected China-nexus actor; that attribution is contested, so treat it as a lead, not a fact.

Crafted HTTP request

PHP2Shell, no auth

↓→

Web shell

As the PHP worker

↓→

CVE-2026-46300

Fragnesia kernel LPE

↓→

Root on the host

Persistence, pivot

Remediation: patch PHP (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or your distribution's backport) and restart every worker; apply your distribution's kernel fix for CVE-2026-46300 — it is not included in the earlier “Dirty Frag” patches — and on internet-facing hosts that do not terminate IPsec, consider unloading the esp4/esp6 modules. On PAN-OS, restrict the management interface to trusted IPs or a jump host and install the hotfix for your train. If you suspect compromise, capture memory before rebooting. See the Palo Alto Networks advisory, BleepingComputer and CSO Online.

Actively exploited this week

CVE-2026-76418 — Cisco Secure Firewall ASA / FTD SSL VPN (CVSS 8.6, zero-day)

Cisco disclosed a NULL pointer dereference in the SSL remote-access VPN of Secure Firewall ASA and FTD software on October 28. An unauthenticated attacker sends a crafted request during VPN connection setup and the device reloads. Devices are only vulnerable when webvpn is enabled and secondary authentication is configured on a tunnel group (including DefaultWEBVPNGroup). Cisco PSIRT is aware of exploitation in October 2026, and CISA added it to KEV on October 29 with a November 1 deadline. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN endpoints.

SSL VPN connect

No credentials

↓→

Secondary auth path

Crafted request

↓→

NULL dereference

CVE-2026-76418

↓→

Device reload

Remote access down

Denial of service on a perimeter VPN is more than an outage: repeated reloads are a classic way to force failover, wipe volatile evidence, or push users to a less-protected path. Remediation: upgrade to a fixed release (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1). There is no workaround; Cisco lists interim mitigations that remove secondary authentication or the tunnel-group list, both of which weaken VPN security. See Cisco's advisory and BleepingComputer.

CVE-2026-97229 — GitLab CI regex RCE (CVSS 10.0, KEV) and the Alpine incident

This is the first of October's two GitLab regex-compiler RCEs: an integer overflow in Onigmo, Ruby's regular-expression engine, reached through crafted regular expressions in CI/CD configuration. Rapid7 notes the attacker needs permission to push a branch to a project, and code runs as the git user. GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8; CISA added it to KEV on October 29.

The most useful document this week is Alpine Linux's incident report. A registered account sent crafted CI configurations to Alpine's instance, crashing GitLab workers eight times; Alpine rebuilt the instance and reset all passwords. The operational lesson: the fix lives in Ruby, not GitLab's Rails code. GitLab patches the Ruby it bundles in Omnibus packages and images; an installation built against a standard system Ruby stays vulnerable even on a “fixed” GitLab version until Ruby itself is upgraded (3.3.13, 3.4.12 or 4.0.9, released October 23). Remediation: upgrade GitLab, verify which Ruby your instance actually runs, restrict open sign-up, and review CI pipelines created by new accounts. See the GitLab 19.4.2 patch release.

CVE-2026-111497 — Brotli decoder (KEV) and emergency .NET patches

The Brotli out-of-bounds write we flagged last week through the Node.js releases is a library-level bug, and this week the rest of the ecosystem caught up. CISA added it to KEV on October 27, and Microsoft shipped out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 on October 26. .NET applications are exposed when they use ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs on untrusted input. Fixed builds also exist for libbrotli (1.0.10 / 1.1.1 / 1.2.1), Python Brotli 1.2.1, Bun 1.4.4, Envoy, Istio and the Go andybalholm/brotli port (v1.2.7).

Remediation: patch runtimes, rebuild anything that vendors its own Brotli copy (containers, static binaries, language wheels), and until then reject or stop decoding Content-Encoding: br request bodies at the proxy. See BleepingComputer, Wiz's analysis and Rapid7.

CVE-2026-48356 — Adobe Commerce / Magento file upload (CVSS 9.6, KEV)

An unrestricted file upload (CWE-434) that Adobe fixed in July's APSB26-73 joined KEV on October 27. It needs no authentication, and affects Adobe Commerce 2.4.4-p18 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9. Adobe's bulletin still says it is not aware of exploits, but that statement predates the KEV listing. Remediation: apply APSB26-73, then hunt for uploaded web shells and injected CMS blocks or payment skimmers — a store unpatched since July should be treated as possibly compromised. See APSB26-73 and CISA's alert.

CVE-2026-118539 — Drupal Commerce Core access bypass (exploited)

Drupal's SA-CONTRIB-2026-254 (October 28, risk score 21/25, “Highly critical”) describes missing access checks on certain routes and entity fields in Commerce Core that let unauthenticated users bypass access control — with direct financial impact on the store. The Drupal Security Team states the flaw is being actively exploited. Remediation: upgrade to Commerce Core 3.3.13 (or 8.x-2.41 on the old branch) and audit orders for inconsistencies, as the advisory recommends. See SA-CONTRIB-2026-254.

CVE-2026-110447 — Collabora Online built-in CODE server (CVSS v4 9.2, KEV)

A pre-authentication OS command injection in the proxy.php of the built-in CODE server (the Nextcloud richdocumentscode app) runs commands as the web-server user. It is only reachable while the CODE server is not running — for example after a restart, upgrade or crash — which is exactly the window admins do not watch. Administrators reported attacks since September 10, with PHP web shells used to hunt for password stores and crypto wallets; CISA added it to KEV on October 23. Remediation: upgrade to 26.4.303 or remove the app (disabling it is not enough), then look for unexpected PHP files under apps/richdocumentscode/. See the GitHub advisory.

CVE-2026-112353 — Kerio Connect webmail stored XSS via SVG (exploited)

VulnCheck's October 27 advisory describes a stored XSS in GFI Kerio Connect webmail: a crafted SVG attachment bypasses event-handler sanitization and runs JavaScript in the victim's session. VulnCheck scores it CVSS v4 6.2, but Proofpoint observed it being used in the wild as a credential and mailbox stealer — a reminder that a “medium” XSS in webmail is a full account takeover in practice. Fixed in 10.0.8 Patch 2. See VulnCheck's advisory.

Critical web application CVEs (no exploitation reported)

Adobe Campaign Classic — APSB26-162, eight critical CVEs

Adobe's October 27 bulletin fixes eight critical flaws in Campaign Classic v7 (7.4.4 build 9402 and earlier): code injection (CVE-2026-104351, 9.9), OS command injection (CVE-2026-104353, 9.9), incorrect authorization (CVE-2026-105780, 9.9), four SQL injections (CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, CVE-2026-105779; 9.1–9.9) and a reflected XSS (CVE-2026-104350, 9.3). Adobe is not aware of exploits. Upgrade to build 9403. See APSB26-162.

CVE-2026-108142 — Veeam Backup & Replication (CVSS v4 9.1)

An unauthenticated authorization bypass in the CDP Coordinator service affects B&R 13.1 (through 13.1.1.18) and 13.0 (through 13.0.2.29) on Windows and the Software Appliance; 12.x is not affected. Backup servers are a favorite ransomware pre-stage, so treat this as urgent even without exploitation. Upgrade to 13.1.2.57 or 13.0.3.63. See Veeam KB4948.

CVE-2026-103409 — Juniper Session Smart Router (CVSS 9.8)

Crafted URL parameters to an internal endpoint running as root grant administrative privileges without authentication — but only before the device is onboarded to Mist or a Conductor. Fixed in 7.0.5, 7.1.7 and 7.2.3 (JSA112183). Make sure staging and freshly-imaged routers are never reachable from untrusted networks. See the CVE record.

Libraries and AI platforms: jackson-databind, MLflow, Eclipse Che, Langflow

• jackson-databind CVE-2026-110879 (CVSS 9.8) — a PolymorphicTypeValidator bypass via generic and array type arguments, an incomplete fix for CVE-2026-54512. Upgrade to 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. (GHSA-m8xf-2cr7-77ph)
• MLflow CVE-2026-116692 (CVSS 9.8) — unauthenticated RCE through third-party scorer deserialization in 3.12.0rc0 to 3.16.x. Upgrade to 3.17.0 and keep tracking servers off the internet. (GHSA-26p8-2jq9-3vq9)
• Eclipse Che che-machine-exec CVE-2026-114278 (CVSS 9.8) — unauthenticated command injection through the /exec/init username, with authentication off by default in 7.0.0–7.122.0. (CVE record)
• Langflow — Metasploit added six Langflow modules on October 23, four of them unauthenticated (including the CVE-2026-93680 auth bypass and CVE-2026-10134 public-flow build RCE). Langflow is already under active attack; weaponized modules in a mainstream framework widen the attacker pool. (Rapid7 Metasploit wrap-up)

Supply chain: worms and stolen tokens in GitHub

The “testmetest” npm worm and 42 hijacked GitHub repositories — JFrog

JFrog traced a worm across 42 repositories from 11 owners and 25 npm package names. Early versions executed through a command expansion in binding.gyp rather than an install script — so --ignore-scripts does not save you — and later versions shipped a native .node addon that decrypts a hidden payload with anti-CI and anti-debugging checks. In the hijacked repositories it planted session-start hooks for AI coding agents and editors that run a 13 MB .github/init.js, too large for GitHub code search to index, and hidden chore/ci-* branches that swap an Actions OIDC token for an npm publish token. It also carries a wiper that fires when tokens are revoked: remove its persistence before you rotate credentials. See JFrog's research.

Gheist: scaled abuse of stolen GitHub tokens — Wiz

Wiz found more than 13,500 ci-sync-xxxxxx branches across 850+ accounts, created with tokens harvested from infostealer logs and earlier supply-chain compromises. A sync-check.yml workflow base32-encodes the secrets context (defeating log masking), walks deployment environments, and deletes the run within seconds; a newer variant mounts the host through the Docker socket on self-hosted runners. GitHub's approval hold stopped every public-repository run Wiz checked, but it does not apply to private repositories or GitHub Enterprise Server. Deleting the branch or run does not undo the exposure — rotate every reachable secret. See Wiz's write-up, and its companion piece on the gaps left in GitHub's 2026 “pwn request” protections ahead of GitHub enforcing its pull_request_target default policy on December 2.

Web application security research worth your time

Scalable Vector Grief — PortSwigger Research, October 27

Gareth Heyes tested eight popular SVG sanitizers and bypassed six. The techniques are worth adding to every upload test plan: namespace confusion that renders XHTML iframe/frame JavaScript URLs inside SVG, a differently-cased foreignObject that slips past case-sensitive checks, animate elements that set an href to a JavaScript URL, XSLT loaded through an xml-stylesheet processing instruction, a Firefox-only Link response header that applies a stylesheet to harmless XML, and a Safari-only use import of an SVG-bearing GIF. DOMPurify and darylldoyle/svg-sanitizer held up. If you accept SVG uploads, use a well-maintained sanitizer and serve user SVG from a sandboxed, cookieless origin. See the research.

Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/ — Searchlight Cyber, October 28

A three-part chain worth studying as a model of modern XSS: a namespace-URI escaping bug in the svg-hush re-serializer injects markup; Chromium's handling of Cache-Control: no-cache="header" lets a source-controlled header strip the CSP from the cached copy, so a back/forward navigation loads the body without it; and an open redirect in an Access logout endpoint pointed the image fetcher at attacker content, yielding XSS on www.cloudflare.com. The same header tricks extend to other image CDNs and to signed object-storage URLs that let callers override response headers. Image optimizers and storage endpoints on your origin are XSS surface. See Searchlight Cyber.

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft — ZDI, October 27

Bobby Gould shows how the PeopleSoft Integration Gateway's HTTP connectors forward attacker-supplied URLs and bodies to loopback, satisfying PSEMHUB's default localhost-friendly allowedhosts check, and then turns that SSRF into code execution either by writing a JSP web shell or, more quietly, by dropping XML that XMLDecoder deserializes at servlet start. ZDI reported three bugs; Oracle fixed them under one CVE. It is a clean illustration of why “SSRF to localhost only” is never low severity. See ZDI's write-up.

ElectroNG goes open source — Doyensec, October 27

Doyensec released ElectroNG, its Electron SAST tool, under Apache 2.0: around 60 checks plus a database of 650+ known Electron vulnerabilities. Doyensec itself cautions that some checks lag modern Electron, so treat findings as leads to verify. See the announcement.

Bug bounty and disclosure notes

A quiet week for headline payouts. Two things are worth a hunter's attention. HackerOne's “Measuring the Fix” benchmark, built from 1,000+ tests drawn from fixed HackerOne reports (about 40% of which contain no real vulnerability), found that the choice of LLM judge moved remediation scores more than the choice of model, and that judges graded their own model family more generously — useful context as AI-generated fixes arrive in your triage queue. And the Searchlight and PortSwigger research above is effectively a free methodology update: SVG upload handlers, image-resizing endpoints and response-header overrides are under-tested attack surface on most programs.

The pattern: one bug is a foothold, the chain is the incident

Every major story this week was a chain. PHP2Shell gave a worker shell and Fragnesia gave root; a sanitizer bug, a caching quirk and an open redirect gave Cloudflare XSS; an SSRF and a file write gave PeopleSoft RCE; a stolen token and an encoded log gave CI secrets. Severity scores rate bugs one at a time, while attackers combine them. Prioritize by exploitable path, and verify that path end to end.

The second pattern is that the patch is not where you think. GitLab's fix lives in Ruby, the Brotli fix lives in every runtime and container that vendors the library, and PHP2Shell reaches firewalls that bundle PHP. “We upgraded the application” is not the same as “the vulnerable code is gone” — check the version that actually loads.

What to do first: October 23–30 action matrix

Sources and further reading

• PHP2Shell and Fragnesia — Palo Alto Networks advisory, BleepingComputer, CSO Online, Help Net Security
• CISA — Known Exploited Vulnerabilities catalog, October 27 KEV alert
• Cisco (CVE-2026-76418) — Cisco Security Advisory, The Hacker News
• GitLab (CVE-2026-97229) — Alpine Linux incident report, GitLab 19.4.2 patch release
• Brotli (CVE-2026-111497) — BleepingComputer: .NET emergency patches, Wiz
• Adobe — APSB26-73 (Commerce), APSB26-162 (Campaign Classic)
• Drupal — SA-CONTRIB-2026-254 · Collabora — BleepingComputer · Kerio — VulnCheck
• Veeam — KB4948 · Juniper — CVE-2026-103409
• Supply chain — JFrog: testmetest, Wiz: Gheist, Wiz: The Pwn Request Reckoning
• Research — PortSwigger: Scalable Vector Grief, Searchlight Cyber: Cache Me If You Can, ZDI: PeopleSoft SSRF to RCE, Doyensec: ElectroNG
• Bug bounty — HackerOne: Measuring the Fix