Nine stories shaped the week of 19 to 25 October 2026. Attackers were seen at work in five of them, and CISA issued an alert, advisory or catalog entry for four. This post ranks the nine and gives you one move for each.
We ranked by four things: evidence that attackers are using the flaw, how many systems it reaches, whether a government agency has acted, and how widely defenders discussed it. Every fact comes from the vendor, agency or researcher page linked in the story. Where a page changed after we first wrote about it, we use the newer state and date it.
Free PHP2Shell CheckerSee which PHP version your site shows to the outside world and whether it falls in the CVE-2026-109618 and CVE-2026-109619 range. Passive check, no account, no exploit traffic.Check Your Site →
Story Reference Attacks reported First move PHP2Shell CVE-2026-109618 and CVE-2026-109619 Attempts seen before disclosure (Amazon) Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 Brotli decoder CVE-2026-111497 Not reported by Node.js Update Node.js, then find other Brotli users Tailworm in Tailscale and headscale 11 findings, no CVE yet Lab results only (researcher) Review Tailscale SSH and deny forwarding in each rule Storm-0940 and ConnectWise Microsoft report, 21 October Yes, activity in customer tenants Keep the ConnectWise app connections off and save logs SafePay ransomware Advisory AA26-293A Yes, at least 600 victims Require MFA on VPNs and patch five known flaws Plex Media Server chain Four Plex Media Server CVEs Yes, widely (Plex) Update to build 1.43.3.10861 or later VeloCloud Orchestrator CVE-2026-114625 Yes (Arista) Patch, and limit the web interface to admin networks GitLab CVE-2026-110264 Not reported by GitLab Update to the fixed version for your branch eMudhra CA keys Google Chrome statement None in CT logs before the block (Google) Replace certificates that chain to the affected root
1. PHP2Shell: Two Critical PHP Flaws, Probed Before the Fix Was Public
What happened: On 21 October the PHP project fixed CVE-2026-109618 and CVE-2026-109619. It calls both critical and says they can allow unauthenticated remote code execution. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says the risk is highest for Apache with mod_php, where a demonstrated exploit lets one unauthenticated request trigger the attack before any application code runs.
Why it matters: PHP sits behind many websites and is bundled inside other software. CISA’s alert of 21 October tells organisations to inventory every system that runs PHP, including bundled copies. CISA had not seen successful exploitation when it published.
Attack signs: Amazon Threat Intelligence saw the first attempt on 17 October in its honeypot data, four days before disclosure. It says it is unclear whether any attempt would have worked on a real system.
This week: Update PHP and put internet-facing systems first. CISA says systems that cannot be updated, or that run PHP 8.1 or earlier, should go offline until they are. PHP’s interim step for CVE-2026-109619 is to set session.upload_progress.enabled to 0 and restart the workers. On 23 October PHP advised keeping it at 0 until the next regular bugfix release, even after updating, to block an unlikely separate RCE path (CVE-2026-115560).
Palo Alto: Palo Alto Networks lists PAN-OS and Panorama as affected through the management web interface. On 26 October it showed seven hotfixes as released and the rest due 27 to 30 October. It says it is not aware of malicious exploitation, and advises limiting management access to trusted internal addresses.
To see which PHP version your site shows to the outside world, run our free PHP2Shell checker on Atlas. It sends one ordinary request to your homepage, reads the version from the response headers and never sends exploit traffic. If it shows no version, the site may simply hide it, and that does not make it safe.
Our PHP2Shell analysis, the guide on how to defend against PHP2Shell and the Palo Alto product status and hotfix dates have the detail.
2. The Brotli Decoder Flaw Behind Node2Shell and HTTP2Shell
What happened: On 21 October Node.js released 22.23.4, 24.22.1 and 26.12.1 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles. Node.js rates it High. An attacker needs the application to decompress malformed Brotli data, for example with node:zlib. The result can be a crash, memory disclosure or remote code execution.
Why it matters: The CVE record lists Brotli 1.0.3 through 1.2.0 as affected, and Google’s Brotli 1.2.1 release is one of three fixes, with 1.0.10 and 1.1.1. Other software carries its own copy of the decoder, so each copy needs its own update. The nicknames Node2Shell and HTTP2Shell, used on social media, point to this one CVE. Node.js’s page does not say the flaw is exploited.
Firewall rules: Microsoft says rule 920450 in DRS 2.2 of Azure WAF blocks the crafted requests it analysed by default. Azure WAF inspects only inbound requests, Microsoft says, so apps that fetch and decompress Brotli responses must still be patched.
This week: Update Node.js, then list other software that decompresses Brotli from untrusted senders and check each vendor’s advisory. For the severity, KEV status and fixed versions, see the Atlas vulnerability brief. Our HTTP2Shell fixed-versions table, the Node2Shell analysis and the CVE-2026-111497 page track the stacks.
3. Tailworm: 11 Findings in Tailscale and headscale, and No Fix Yet
What happened: The researcher Erica Windisch of Cyberdione Labs has published Tailworm, a report with 11 findings in Tailscale and the open-source headscale server. She tested tailscale 1.104.2 and headscale 0.29.5 in a lab between 22 and 24 October. The report reached Hacker News on 25 October without coordinated disclosure.
Why it matters: As of 26 October Tailscale has published no security bulletin, CVE or fixed version, and has not confirmed the findings. Its public code repository has new commits in areas the report covers, but none is in a release. A merged commit is not a shipped fix.
This week: If you run Tailscale, review Tailscale SSH first and deny forwarding in each rule, as the researcher advises. If you run headscale, set memory limits and put rate limiting in front of the server. Our post on how to audit your tailnet has six checks, and our Tailworm news post tracks what Tailscale says.
4. Storm-0940 Uses an AI Tool to Reach Microsoft 365 Through ConnectWise Apps
What happened: On 21 October Microsoft said the China state-aligned actor Storm-0940 was behind the compromise of a ConnectWise multi-tenant application. The actor used ARTEX, an open-source AI penetration testing framework that can run a test from reconnaissance to data theft with little human input. Microsoft saw sign-in attempts against more than 2,250 tenants.
Why it matters: Microsoft saw follow-on activity through Microsoft Graph in several customer environments, including changes to application credentials. It says several attacks reached privileged cloud access, some within three hours of first targeting, and that the actor read secrets at scale in multiple Azure Key Vaults. Microsoft states its own systems were not compromised. It adds that an affected app does not by itself prove data was taken.
This week: If your tenant trusted ConnectWise cloud apps, keep those connections disabled until ConnectWise gives formal restore steps. Save the app configuration and logs before deleting anything. Review service principal sign-ins and audit logs from 15 October, and from 1 October where records exist. Our Storm-0940 and ConnectWise checklist lists what to look for.
5. Six Agencies Warn About SafePay Ransomware and Five Known Flaws
What happened: On 20 October the FBI, CISA, the US Secret Service, a German state criminal police office and two UK agencies published advisory AA26-293A. It says SafePay ransomware has been active since August 2024 and has at least 600 separate victims across critical infrastructure sectors.
Why it matters: The advisory names five exploited flaws: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. CISA’s KEV catalog ties them to Cisco ASA and FTD, Veeam Backup and Replication, and SonicWall SonicOS, with known ransomware use. Flaws are only one way in. The advisory also names stolen or guessed passwords, brute force, and VPN access with phished account profiles.
This week: Check whether you run any of the five products and compare versions with the table in our SafePay joint advisory post. Require MFA on VPN and webmail accounts. Keep offline, encrypted, immutable backups and test a restore. Our SafePay ransomware profile describes the group.
To follow ransomware groups, their claimed victims and attack patterns, use our free Ransomware Tracker on Atlas. A claim on a group’s site is not proof of a breach.
6. Four Plex Flaws Chain Into Remote Code Execution, and Attacks Are Widespread
What happened: On 19 October Plex said four flaws in Plex Media Server are being actively and widely exploited. Chained together in what we call Plex2Shell, they let an unauthenticated remote attacker run code with the privileges of the server process. A public proof of concept appeared on 16 October. CISA added all four CVEs to its KEV catalog on 20 October.
Why it matters: Plex says the attacks hit internet-facing servers that were not updated. Compromised servers ran cryptocurrency miners and proxy software. Its advice is blunt: a server older than the fixed build and reachable from the internet should be treated as possibly compromised.
This week: Update to build 1.43.3.10861 or later and check the version under Settings, then General. Turn off remote access if you do not need it, and do not forward port 32400 directly. If compromise is possible, Plex says to rebuild from a clean installation. Our Plex2Shell post maps the four CVEs.
7. A Third Exploited VeloCloud Orchestrator Flaw Joins CISA’s KEV List in 88 Days
What happened: On 22 October Arista published advisory 0199 for CVE-2026-114625, a SQL injection flaw in VeloCloud Orchestrator On-Prem. Arista says it detected the issue and that it is known to be actively exploited. CISA added the flaw to KEV on 23 October.
Why it matters: It is the third VeloCloud Orchestrator flaw CISA has listed. The first went in on 27 July and the second on 22 September, which makes 88 days from the first listing to the third. Any authenticated user, even with the Enterprise Read Only role, can gain operator privileges. Arista says the product is exposed by default and no configuration prevents the exposure.
This week: Upgrade On-Prem orchestrators to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later in your train. Until then, limit the web interface to trusted administrative networks and look for backdoor daemons and webshells. Arista says Hosted and Dedicated instances are already patched. Our VeloCloud timeline covers all three advisories.
8. GitLab Ships a CVSS 10 Fix for Unauthenticated Code Execution
What happened: On 21 October GitLab released critical patch versions for CVE-2026-110264, rated CVSS 10.0. It says an unauthenticated user could run arbitrary code on the server under certain conditions. The cause is an integer overflow when GitLab compiles a crafted regular expression. GitLab.com and GitLab Dedicated are already patched.
Why it matters: Self-managed installs are the ones left to fix, and the affected range starts at version 7.0. Each branch has its own fixed version, so a server on 19.4.2 or 19.3.5 still needs this update. GitLab’s page does not report exploitation. The flaw was not in CISA’s KEV catalog in its 23 October release.
This week: Upgrade to the fixed version for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. Our post on what to do about the GitLab critical flaw has the version table and the order to patch in.
9. Weak Keys Force Chrome to Distrust an eMudhra Certificate Chain
What happened: A researcher reported on 17 October that private keys for eight eMudhra subordinate CA certificates were compromised, according to Google. The keys were generated with insufficient randomness. Against clients that still trusted them, anyone could forge certificates for any website. Chrome blocked the affected CAs that evening, and Android followed through a Google Play Services update.
Why it matters: Google says no certificates chaining to the affected CAs were logged to Certificate Transparency before the block. So none could have been used against CT-enforcing clients such as Chrome. Chrome is removing the root that signed them, emSign ECC Root CA – G3, from its Root Store. Google expects that on Tuesday 27 October.
This week: If a TLS certificate of yours chains to that root, Google says to install a new one from another CA in the Chrome Root Store now. Otherwise it will stop working in Chrome. Our post on what Python, uv and container teams must update covers the details.
The Week in Dates
Six days carried most of the news. The timeline shows when each item landed, using the dates in the sources.
- 19 OctPlex reports wide exploitationPlex Media Server, four chained flaws.
- 20 OctSafePay advisory and Plex KEV listingSix agencies publish AA26-293A. CISA adds the four Plex CVEs to KEV.
- 21 OctPHP, Node.js and GitLab fixes landMicrosoft names Storm-0940 and CISA publishes its PHP alert the same day.
- 22 OctArista advisory 0199CVE-2026-114625 is known to be actively exploited.
- 23 OctCISA lists the VeloCloud flawThe third VeloCloud Orchestrator flaw in the KEV catalog.
- 25 OctTailworm reaches Hacker News11 findings in Tailscale and headscale, with no fix or CVE yet.
Six Moves Before Friday
If you only have an afternoon, work through this list in order. It covers the stories where attackers are active first.
- Update PHP everywhereInclude software that bundles PHP, and start with systems facing the internet.
- Patch Plex, VeloCloud Orchestrator and GitLab if you run themRead the version first, then compare it with the fixed one.
- Require MFA on every VPN and webmail accountThe SafePay advisory asks for MFA on all services, particularly webmail and VPNs.
- Check ConnectWise app connections in Microsoft 365Review audit logs from 15 October.
- Check Tailscale SSH if you run TailscaleDeny forwarding in each rule and follow the six-check tailnet audit; no fix exists yet.
- Update Node.js and replace certificates under the affected eMudhra rootChrome expects to remove that root on 27 October.
We update our deeper pages as vendors publish new facts. Browse more in Security News, or read earlier weekly recaps from 2022 and 2023 in the Weekly Security News Archive.