CyberSIXT Search
Original

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks

Part of the CVE-2026-109618 story · 40 articles · 16 outlets · since 21 Oct

The Hacker News’s weekly recap for 26 October 2026 highlights a surge in critical remote code execution bugs and related supply‑chain and AI‑driven abuses. In Threat of the Week, PHP2Shell encompasses two PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, prompting patches from the PHP Foundation. Cloudflare reports millions of exploitation attempts since public disclosure, though no successful exploit has yet been observed. The report also notes a broader pattern of rapid exploitation windows for new flaws and several sites going offline as a precaution.

Top News covers multiple high‑severity developments: a critical Node2Shell style issue in the Brotli decoder (CVE-2026-111497) affecting Node.js and related stacks; two CVSS 9.0 Linux ksmbd RCE flaws disclosed ahead of fixes (no CVEs assigned in the piece); and GitLab’s patch for CVE-2026-110264 (score 10.0) tied to an integer overflow that could allow unauthenticated code execution under certain conditions.

The recap also cites the LiteLLM master‑key leak leading to a supply‑chain compromise, suspected AI‑driven abuse in financial services, and a large number of ransomware incidents in Q3 2026. The story attributes the allegations to sources including CISA, Cloudflare, Rapid7, Nord Security, and various security researchers and outlets, with warnings that attackers are increasingly weaponising AI, automation and trusted software ecosystems.

How the story developed

All 40 articles

40 articles from 16 outlets over 7 days. This was the 40th report, 6 days after the first.

40 articles from 16 outlets since 21 Oct; 40 in the last 7 days.

CVE-2026-109618: coverage over time40 articles from 16 outlets. First report 21 Oct by SecurityOnline. Busiest day: 17 articles, 21 Oct. 40 in the last 7 days. CVE-2026-109618: coverage over time40 articles from 16 outlets. First report 21 Oct by SecurityOnline. Busiest day: 17 articles, 21 Oct. 40 in the last 7 days.
  • Article
  • First report
  • Official notice
Show as table
CVE-2026-109618: articles
Published (UTC)OutletHeadline
Mon 26 Oct · 15:31 UTCThe Hacker NewsWeekly recap tracks PHP and Node.js RCE flaws and supply chain attacks
Mon 26 Oct · 15:31 UTCSecurityWeekIndustrial Vendors Assess Products Affected by PHP2Shell Flaws
Mon 26 Oct · 14:00 UTCSecurityWeekPHP2Shell Flaws Used to Gain Shells on Honeypot Servers
Mon 26 Oct · 11:30 UTCSecurity AffairsCyfirma links PHP flaw scans to a North Korean campaign
Mon 26 Oct · 10:01 UTCInfosecurityPHP warns of rare RCE flaw and advises disabling upload progress
Mon 26 Oct · 03:20 UTCSecurityOnlineWeekly report flags PHP and FortiSIEM flaws under attack
Mon 26 Oct · 01:30 UTCSecurityOnlinePHP2Shell flaws put products running PHP at risk of remote code execution
Sun 25 Oct · 19:00 UTCThe Hacker NewsPHP2Shell attackers target a European government entity
Fri 23 Oct · 20:59 UTCDark ReadingAttackers Exploit PHP2Shell Faster Than Organisations Can Patch It
Fri 23 Oct · 13:13 UTCSecurityWeekMirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In
Fri 23 Oct · 12:35 UTCSecurity AffairsCritical PHP Flaws Trigger Millions of Exploit Attempts in Days
Fri 23 Oct · 12:00 UTCThe Hacker NewsPHP Warns of Unpatched RCE Risk in Rare Session Configurations
Fri 23 Oct · 08:36 UTCThe Hacker NewsAttackers exploit PHP2Shell flaws to build a Mirai derived botnet
Fri 23 Oct · 04:30 UTCSecurityOnlineOkta fixes critical Access Gateway flaws enabling remote code execution
Fri 23 Oct · 00:23 UTCDarktracePHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches
Thu 22 Oct · 16:01 UTCSOCRadarExposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable
Thu 22 Oct · 16:01 UTCSecurity AffairsAWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed
Thu 22 Oct · 15:23 UTCSecurityOnlineGcore Offers Free Web Protection to Governments After PHP Attacks
Thu 22 Oct · 13:29 UTCSecurityOnlinecPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting
Thu 22 Oct · 12:52 UTCSecurityWeekAttackers Target Critical PHP Flaws Before Patches Were Released
Thu 22 Oct · 11:38 UTCSecurityOnlineQNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable
Thu 22 Oct · 10:14 UTCSecurityWeekOver a Million PHP Systems Face Exploitation After RCE Flaws Go Public
Thu 22 Oct · 09:24 UTCThe Hacker NewsAmazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot
Wed 21 Oct · 19:59 UTCDark ReadingCritical PHP Flaws Enable Unauthenticated Code Execution on Servers
Wed 21 Oct · 18:01 UTCRapid7Critical PHP Flaws Enable Remote Code Execution Without Login
Wed 21 Oct · 18:01 UTCSecurityOnlinePHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs
Wed 21 Oct · 17:54 UTCSANS ISCCritical PHP flaws enable remote code execution as exploit PoCs emerge
Wed 21 Oct · 17:11 UTCMalwarebytesCritical PHP Flaws Trigger Emergency Patches as Attacks Begin
Wed 21 Oct · 17:08 UTCSecurityWeekPHP Patches PHP2Shell Flaws After Attack Attempts Target Servers
Wed 21 Oct · 16:00 UTCKrebs on SecurityPHP Zero Days Put Millions of Websites at Risk of Remote Takeover
Wed 21 Oct · 15:23 UTCSecurelistCritical PHP flaws enable unauthenticated remote code execution across versions 5 to 8
Wed 21 Oct · 15:23 UTCThe Hacker NewsPHP Patches Critical Unauthenticated Flaws That Expose Web Servers
Wed 21 Oct · 14:06 UTCUnit 42Critical PHP Flaws Enable Remote Code Execution Across Web Servers
Wed 21 Oct · 11:00 UTCSOCRadarPHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution
Wed 21 Oct · 11:00 UTCInfosecurityPHP2Shell flaws threaten remote code execution across PHP websites
Wed 21 Oct · 10:52 UTCNCSCNCSC urges PHP users to patch flaws that could enable server takeover
Wed 21 Oct · 07:15 UTCSecurityWeekCritical PHP2Shell flaws could expose servers to remote code execution
Wed 21 Oct · 06:00 UTCThe Hacker NewsPHP Prepares Emergency Fixes for Two Critical RCE Flaws
Wed 21 Oct · 02:31 UTCArs TechnicaPHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts
Wed 21 Oct · 00:58 UTCSecurityOnlinePHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm

Who reported 16 outlets

  • SecurityOnline8
  • The Hacker News7
  • SecurityWeek7
  • Security Affairs3
  • Infosecurity2
  • SOCRadar2
  • Others11
See the full timeline

Sources

Original articlethehackernews.com

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device