The final week of October brought considerable turbulence to the foundations of web services and network management systems. Reviewing early warnings mid-week made it clear that Linux server administrators and security engineers faced a demanding weekend. Two critical vulnerabilities discovered in the PHP language interpreter core, dubbed PHP2Shell, immediately drew heavy botnet and scanner traffic. Simultaneously, network hardware vendors including Cisco, Palo Alto, and Fortinet issued official advisories addressing downstream impact.
At the network perimeter, the situation is equally severe. Arista Networks is patching an actively exploited zero-day in VeloCloud SD-WAN orchestrators that entered CISA’s KEV catalog on Friday. Cisco released a critical fix for Expressway platforms where a database service flaw allows unauthenticated remote root takeover. In backend ecosystems, researchers published a working Node2Shell exploit leveraging a Brotli decoder buffer overflow in Node.js, while a public PoC emerged for Fortinet FortiSIEM. Below are the key technical facts and remediation steps.
1. PHP2Shell: Critical Remote Code Execution in PHP Core (CVE-2026-109618, CVE-2026-109619)
The PHP Foundation published emergency security releases addressing two vulnerabilities in the PHP language core. Vulnerability CVE-2026-109618 received a maximum CVSS 3.1 score of 9.8 (9.2 CVSS 4.0), while accompanying flaw CVE-2026-109619 is rated 8.1. Threat monitoring teams recorded honeypot scanning prior to public disclosure, and Mirai botnet operators quickly integrated working exploits bypassing ASLR protections.
The root cause lies in HTTP request handling and memory management within PHP worker processes. CVE-2026-109618 involves improper longjmp() handling during out-of-memory (OOM) conditions during request initialization, leading the cleanup routine to reference uninitialized pointers. CVE-2026-109619 represents a use-after-free condition where global state points to deallocated memory blocks, allowing subsequent requests handled by the same worker to trigger code execution.
- Identifiers: CVE-2026-109618, CVE-2026-109619 (PHP2Shell)
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active attacks, Mirai botnet telemetry
- Affected Systems: PHP interpreter versions 8.1.x, 8.2.x, 8.3.x, and downstream vendor products (Cisco, Palo Alto, Fortinet)
- Mitigation: Upgrade PHP to 8.1.31, 8.2.25, or 8.3.13
- Source: PHP Foundation Advisory
2. Arista VeloCloud Orchestrator: Zero-Day SQL Injection in SD-WAN (CVE-2026-114625)
Arista Networks published an urgent security advisory addressing a zero-day vulnerability in VeloCloud Orchestrator (VCO) used for enterprise SD-WAN management. Vulnerability CVE-2026-114625 carries a CVSS 3.1 score of 9.9. On Friday, October 23, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. This marks the third VCO zero-day reported in four months.
The defect is a SQL injection (CWE-89) in on-premise orchestrator query processing logic. An authenticated remote user with read-only privileges can craft database queries to escalate privileges to superuser, granting access to internal management interfaces.
- Identifier: CVE-2026-114625
- Base Score: CVSS 9.9 (Critical)
- Exploitation Status: Active in-the-wild exploitation, CISA KEV listed
- Affected Systems: VeloCloud Orchestrator On-Prem branches 5.2, 6.1, and 6.4
- Mitigation: Upgrade VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12; isolate management interfaces from public networks
- Source: Arista Security Advisory 0199
3. Cisco Expressway Series: Database Service Remote Root (CVE-2026-76466)
Cisco disclosed a critical vulnerability in Cisco Expressway Series gateways, designated CVE-2026-76466 with a CVSS 3.1 score of 9.8 (Critical). The flaw permits an unauthenticated network attacker to execute arbitrary OS commands with root privileges.
The defect resides in the database service utilized for cluster configuration synchronization. It stems from predictable persistent session cookies and missing client certificate verification within cluster communications even when TLS verification mode is explicitly enabled. Attackers possessing session parameters can connect to the database port and invoke RPC routines to run root commands.
- Identifier: CVE-2026-76466
- Base Score: CVSS 9.8 (Critical)
- Affected Systems: Cisco Expressway-C and Expressway-E appliances
- Mitigation: Install official Cisco PSIRT patches (no workarounds available)
- Source: Cisco PSIRT Advisory
4. Node2Shell: Brotli Decoder Buffer Overflow in Node.js (CVE-2026-111497)
The Node.js project released emergency security updates across all active release lines (22.x, 24.x, and 26.x), accompanied by Imperva research detailing Node2Shell, a proof-of-concept demonstrating unauthenticated RCE on official Node.js Linux containers. Vulnerability CVE-2026-111497 carries a CVSS score of 9.2.
The root cause is a buffer overflow in Google Brotli library versions 1.0.3 through 1.2.0. Impacted ecosystems include Bun, Python brotli/brotlicffi packages, and Envoy proxy deployments. Maliciously crafted Brotli compression streams corrupt heap memory and hijack application threads.
- Identifier: CVE-2026-111497 (Node2Shell)
- Base Score: CVSS 9.2 (Critical)
- Affected Systems: Node.js (22.x, 24.x, 26.x), Google Brotli 1.0.3–1.2.0, Bun, Envoy proxy
- Mitigation: Upgrade Node.js to 22.14.1, 24.22.1, or 26.1.1 and rebuild container images
- Source: Node.js Security Blog
5. Fortinet FortiSIEM: Public gRPC Exploit (CVE-2026-106173) and Advisories
Researchers published a functional exploit for vulnerability CVE-2026-106173 in Fortinet FortiSIEM (Advisory FG-IR-26-180), carrying a CVSS score of 9.4. The Path Traversal defect in the grpc phQueryMaster daemon permits unauthenticated remote file writes and service-level RCE. Additionally, urgent maintenance patches were issued across FortiOS and FortiManager lines.
- Identifier: CVE-2026-106173
- Base Score: CVSS 9.4 (Critical)
- Exploitation Status: Public gRPC exploit available
- Affected Systems: Fortinet FortiSIEM
- Mitigation: Upgrade FortiSIEM and restrict gRPC network exposure
- Source: FortiGuard Advisory FG-IR-26-180
Action Items for Today
- PHP: Upgrade PHP interpreter packages to 8.1.31, 8.2.25, or 8.3.13 to neutralize PHP2Shell.
- Arista VeloCloud: Apply patches 5.2.3.18, 6.1.3.10, or 6.4.2.12 to on-premise SD-WAN orchestrators.
- Cisco Expressway: Install official Cisco PSIRT patches for Expressway-C and Expressway-E (CVE-2026-76466).
- Node.js & Brotli: Upgrade Node.js runtimes to 22.14.1, 24.22.1, or 26.1.1 and rebuild container images.
- Fortinet: Secure FortiSIEM deployments and review FortiOS/FortiManager patches.
