Stolen UpdraftCentral keys used to backdoor WordPress sites

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs. Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leaked ahead of a planned October 22 disclosure. Researchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4. Who Is Affected Every PHP installation that serves web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP security advisory. Because the flaws are in the engine rather than in any site's code, even a simple "Hello World" page on a vulnerable PHP version can be attacked. The advisory singles out mod_php as the highest risk, with a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs. PHP-FPM behaves differently, because it shuts the worker down when a request fails early in setup. For one of the two flaws, PHP's own analysis supports that FPM is susceptible but says no complete FPM exploit has been shown; the second flaw was shown to reach code execution on both mod_php and PHP-FPM, though the FPM path there depends on an operation inside the running application. An attacker can also read memory from the PHP worker process, which may hold passwords, authentication tokens, API keys, and certificates belonging to other requests, without first gaining code execution. The researchers demonstrated this reading of live worker memory against applications they did not control, making it independent of the application running on top of PHP. What to Install Update the PHP runtime that serves web requests, then restart Apache, PHP-FPM, and any long-running PHP workers. Updating an application such as WordPress or Laravel does not update the PHP runtime beneath it; that comes from the server package, the host, or the container image. PHP 8.1 and older no longer receive updates from the PHP project, and PHP 8.2 reaches end of life on December 31, 2026. For the older branches, the PHP security team has published source backports for PHP 7.4, 8.0, and 8.1 to help people building from source or waiting on a vendor. Linux distributions and long-term-support vendors received the patches in advance, so a distribution package can carry the fix under an old-looking version number; check the package changelog for the CVE, as Debian advises, not the version string. If You Cannot Update Yet Only updating is a complete fix. The measures below reduce exposure to specific attack paths and do not make a server safe, according to the advisory. For CVE-2026-109618, set memory_limit=-1 so applications cannot override it, keep post_max_size low, and enforce request-size limits at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA as a substitute, because PHP warns they can trigger the same vulnerable path. For CVE-2026-109619, set session.upload_progress.enabled=0 and restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0. Turning off session upload progress blocks the confirmed session paths but not other variants, and no configuration change fully mitigates this flaw short of updating. That setting is the one circulated as a workaround before the patch, and the release confirms it was never a complete fix. Session upload progress is turned on by default and can reach session handling before PHP finishes setting up a request, which is why it takes part in one confirmed attack path for CVE-2026-109619 and why turning it off does nothing for CVE-2026-109618. "The only thing I can say is that the only mitigation is patching/upgrading PHP. I sadly know too much," PHP core developer Gina Peter Banyard wrote before the release, replying to someone who suggested the setting might be enough. After updating, review your memory settings. The fix adds a new hard memory limit, and reaching it ends the process and stops shutdown handlers from running, so check memory_limit and post_max_size against what your application needs. If you already patched but suspect an earlier break-in, the researchers suggest watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oddly large PHPSESSID response cookies, and unexplained restarts of PHP workers. Is It Being Attacked Before the patch shipped, Cloudflare said it was seeing early attempts to exploit the flaws. "We are seeing early attacks emerging and are updating mitigations as new vectors show up," Cloudflare CTO Dane Knecht said, calling the firewall rules Cloudflare deployed a stopgap and urging administrators to patch. No source has confirmed a successful break-in. watchTowr, which reproduced CVE-2026-109618, reported no exploitation in the wild as of 11:26 UTC on October 21, and neither flaw was in CISA's Known Exploited Vulnerabilities catalog at that time. Some organizations took services offline as a precaution rather than in response to any break-in. BambooHR took its service offline across the United States, Canada and Ireland, warned that payroll would be interrupted, and said it did not yet have a restoration time. In the Netherlands, MijnOverheid, DigiD, the lower house of parliament's site, the national cyber-security center and several education systems went offline, the broadcaster NOS reported; the centre said it had not seen the flaw abused but urged everyone to patch. How It Came Out A leak pulled the release forward. On October 20, as The Hacker News reported, a post on Hacker News said two PHP remote code execution flaws, with the two CVE identifiers, were set for disclosure on October 22, on no more than a trusted tip. PHP posted an advance notice that evening and moved the release to October 21. The leak's claim of a CVSS 10.0 score was not PHP's; PHP rates both flaws 9.2. The flaws were found by Wiz Research, Calif, and OpenAI's Codex Security team, working with the PHP security team and Google's Gemini team on the fix. The underlying code had been in PHP for more than a decade. The researchers say AI models helped turn these long-standing flaws into working exploits, letting one researcher do in about a week what they say would otherwise have taken a team months. Calif, which traced the bug's lineage to PHP research from 2004, says knowing the target's history still mattered, and that current models do not reliably start from obscure, twenty-year-old primitives on their own. Update: watchTowr Reports Exploitation Attempts, Still No Confirmed Break-In watchTowr, which earlier in the day reported seeing none, said in a new advisory at 14:19 UTC on October 21 that it is observing "active exploitation attempts" of both CVE-2026-109618 and CVE-2026-109619. Cloudflare said it saw attack traffic against its customers and watched attackers change their payloads to get around its firewall rules, which it had switched on by default at 03:02 UTC, before the patch. No source has reported a confirmed break-in of a specific server as of this update. The PHP Foundation said the coordinated disclosure came apart before the release. Around 20:00 UTC on October 20, the research firm Calif mistakenly posted a video of its working proof of concept, and at 07:41 UTC on October 21, about six hours before the fix shipped, the vendor Chainguard published built images containing the patch, letting anyone study the fix while other users waited to update. Update: PHP Foundation Says a 2024 Audit Found the First Signs of the Flaw In the same post, the PHP Foundation said a core developer first found signs of the out-of-memory flaw behind CVE-2026-109618 during PHP's 2024 external audit, but a working attack was only theorized and no concrete route to code execution was found then. Competing fixes each risked breaking compatibility, opening denial-of-service paths, or forcing changes on third-party extensions, and a small team struggled to agree, so work on a fix stalled for months. The Foundation called the delay "a structural failure" of its decision process and its resources. The 2026 reports from Calif, OpenAI and Wiz, which used AI tools, established the working exploit that made the flaw's full impact clear and moved the fix to the top of the queue. The Foundation said it has since changed how it makes security decisions and added staff and tooling to catch similar problems sooner. (The story was updated after publication on October 21, 2026, to add later reports of exploitation attempts and the PHP Foundation's account of the flaw's history.)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. The three security issues were added separately last week and have severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, existed in the Linux kernel for 14 years. CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today. The three vulnerabilities are: CVE-2025-39964: a race condition in the kernel’s AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. CVE-2026-53266: an out-of-bounds write vulnerability in the Linux kernel’s ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable. CVE-2025-39682: a Linux kernel TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use. CISA says [1, 2] the vulnerabilities have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors. Offensive security company STAR Labs found CVE-2025-39964, saying that its researchers found the issue with no help from an AI system. They demonstrated the vulnerability by achieving privilege escalation and container escape in Google’s kernelCTF. For CVE-2025-39682, there are public exploits available, as also confirmed by Red Hat in its security bulletin. Red Hat also confirmed a known exploit available for CVE-2026-53266. Researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory. However, the researcher notes that the proposed exploitation chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code. CISA has marked all three flaws as requiring “forensic triage.” This means that for every affected asset, federal agencies need to examine it for signs that exploitation already occurred. Currently, none of the three flaws is flagged as exploited by ransomware groups. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat

Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday. The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries. CVE-2026-7273 exploitation is part of an unfolding operation The Zyxel GS1900 Series is a line of Gigabit Ethernet switches aimed at small and mid-sized business networks. They are typically deployed at small offices, schools, hotels, and retail shops. CVE-2026-7273 is a stack-based buffer overflow vulnerability affecting Zyxel GS1900 switches running firmware versions 2.90(XXXX.1)C0 and earlier. It allows a LAN-based, unauthenticated attacker to execute OS commands on the device via a specially crafted HTTP request. The privately reported vulnerability was fixed in June 2026, when Zyxel released new firmware versions with the patch. The attacks exploiting CVE-2026-7273 happened on or about 17 August, GreyNoise said, and the threat actor grabbed compromised devices’ configuration, networking information, and hashed root level credentials. (According to GreyNoise, 564 of these victims had factory default credentials.) “The exploit code was contained within a Python script which was heavily obfuscated by the commercial obfuscation tool PyArmor,” the researchers shared. After deobfuscating it, they discovered it explicitly targets firmware versions 2.10 through 2.90 of the GS1900-24, but “it does provide command line options (e.g. libc base address, global offsets), for targeting other firmware in scope for the vulnerability.” GreyNoise tied this exploitation activity to a threat actor that is related or the same one that, earlier this year, targeted WordPress setups through CVE-2026-63030 and CVE-2026-60137 (the WP2Shell” exploit chain), and compromised Internet-facing Gitea instances via CVE-2026-60004. After breaching WordPress installations of 49 organizations across 29 countries, in at least one instance the threat actor deployed a custom web shell, stole WP administrator accounts, credentials, exfiltrated data from SQL databases, and added a new admin account. After successfully targeting Gitea instances, the threat actor exfiltrated source code, credentials, established persistent access, and leveraged it for lateral movement. CISA added CVE-2026-7273 – the Zyxel flaw – to its Known Exploited Vulnerabilities catalog, and ordered US civilian federal agencies to address it by September 24, 2026 and check for indicators of compromise. GreyNoise has shared a list of them, though one IP address involved in the exploitation remains redacted. “We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update,” the company said. Also under attack: Veeam Agent for Windows In other “active exploitation” news, Arctic Wolf says that attackers are exploiting CVE-2026-32996, a local privilege escalation vulnerability in Veeam (backup) Agent for Microsoft Windows, but has not shared details about the attacks. “Arctic Wolf recommends prioritising remediation on shared workstations, servers, administrator workstations, and systems where local user access is available, or where compromise of a low-privileged account could lead to endpoint takeover,” they advised. “Upgrade Veeam Backup & Replication to 13.0.2.29 or later. This will also update the Veeam Agent for Windows to build 13.0.3.1220, which contains the fix.” We’ve reached out to Arctic Wolf for more information, and we’ll update this article when we hear back from them. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Welcome back to PWNED, the weekly column where we highlight some of the lowlights in corporate security. This week, we’ll talk about two scenarios, one that ended in tragedy and another that shows the power of a good defense over dedicated phishing attacks. Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected]. Anonymity is available upon request. Both stories come courtesy of Dave Hatter, a cybersecurity and compliance consultant with Intrust IT. In his many years of experience with the company, Hatter has had to work for a variety of small companies that needed help with their security, whether they knew it or not. One time several years ago, the new CFO at a small construction company phoned Intrust and expressed interest in hiring them. However, the proposal was vetoed by the owner of the company, an older gentleman who thought his business was too small to interest hackers and that his existing, one-person IT staff was all he could afford. “We got a guy, my brother’s uncle’s cousin does my IT, don’t need you guys,” Hatter quotes the owner as saying. “We hear this all the time. Thanks for shopping. You’re too expensive.” Three weeks later, Hatter got a call from a local accountant friend who begged him to help a client who'd been hit with a ransomware attack. Hatter said he couldn’t really give more than general guidance, but would talk to the victim anyway. As soon as he called the number, Hatter realized that the ransomware victim was actually the same construction company that had turned down his services a few weeks earlier. The business had an old unpatched Windows server that contained all its most important data. There was a backup drive, but it was connected to the same server, so both devices were encrypted by the ransomware. “Their entire backup is this external drive, which, of course, is now encrypted,” Hatter said. “So, literally, they can't pay their employees. They don't know who owes them money.” Hatter could not help the company, and he never found out whether it paid the ransom. However, the org, which had been around for years, went out of business within months. This sad story shows the importance of having real backups that are off-site or in the cloud and patching whatever servers you have. You can never assume that your company is too small to be attacked because ransomware gangs want your money and they are just as happy to take on small businesses as large ones, which are likely to be harder targets. The other incident involved two companies in the landscaping and construction business. Somebody broke into an executive’s email account at company one and started sending phishing emails to company number two. The miscreants had also set up email filtering rules in the first company’s account so that the messages from the phishing campaign were routed to buried folders where the real-life account holder would never see them. The phishing mails took the form of RFPs (requests for proposal) – a perfect lure, because who wouldn't want new business? They were perfectly crafted, with no grammar errors or obvious tells, and the return address matched company one's. However, instead of attaching the RFP as a PDF or PowerPoint file, it had a button for the user to click to download it. “If I can get in your email and send out emails as you, the recipients, especially if they've interacted with me before, aren't going to have any guard up,” Hatter said. “Especially if there's no crazy language or crazy requests in there because they've got an email from me before.” Upon clicking the download button, the user was transported to a Microsoft 365 login screen that looked identical to the real one but was not on the microsoft.com domain. The user was then invited to put in their email address and password to gain access to the desired file. Because the user had 2FA, this fake page also asked them for their limited-time 2FA code. Behind the scenes, the threat actors were transmitting the login to Microsoft so that Microsoft itself would send an SMS message to the victim at company number two. Then the victim would pass along the one-time passcode via the fake login site. A classic man-in-the-middle attack. It worked, and the threat actors now had access to the Microsoft 365 account and email for the victim at company number two. This could've allowed them to do almost anything using that person’s email. If the victim had access to bank accounts or customer data, the attackers could have initiated password resets from the account, then conducted fraudulent money transfers, or stolen personal information. At the very least, they could've used the victim's account to phish other contacts. Fortunately, Hatter's client had installed a piece of software his company made called TarBot, which runs in the Microsoft 365 environment and uses Entra ID P2 to help customers identify suspicious logins. “It throws off a bunch of telemetry, statistics, metrics, whatever you want to call it, that allows our software to say, this is an anomalous login, revoke the token, and make the user log in again,” Hatter said. He said his company is not the only one to make apps like TarBot that detect suspicious logins. So the bad guys were kicked out after just a few minutes. But Hatter says the better way to stop these attacks is to use phishing-resistant MFA, such as hardware keys (like the YubiKey line) or passkeys. With today’s AI-assisted phishing, telltale signs such as bad grammar or obviously fake login pages are becoming few and far between. ®