Briefing · Tuesday 27 October 2026 · 07:00 UTC
CISA adds two exploited PHP flaws to its catalogue
By CyberSIXT Briefing · from 70 reports by 13 outlets · Editorial policy
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on 26 October, setting a 29 October remediation deadline for federal agencies.CISAThe Hacker News Both flaws allow unauthenticated remote code execution, and The Hacker News reported successful exploitation against honeypots before the catalogue update.The Hacker News CISA confirmed active exploitation, while use in ransomware campaigns remains unknown.CISA
CISA adds two actively exploited PHP flaws to KEV#
CISA’s Known Exploited Vulnerabilities catalogue lists CVE-2026-109618, the PHP Memory Corruption Vulnerability, and CVE-2026-109619, the PHP Stale Internal Request-State Vulnerability, as added on 26 October 2026, with a federal remediation deadline of 29 October.CISAThe Hacker News The Hacker News reported that Perplexity detection and response lead Adel Karimi observed successful remote code execution against honeypots on 24 October, including a payload with a decoded cookie dump and a function address derived from the data.The Hacker News
The PHP Foundation’s fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October, The Hacker News reported.The Hacker News CISA’s catalogue entry says CVE-2026-109619 enables unauthenticated remote code execution and that ransomware use is unknown.CISA
AnalysisThe Hacker News reported that both CVEs were added after active exploitation was confirmed, while CISA’s individual entry gives further details for CVE-2026-109619.CISAThe Hacker News
Apple patches 304 flaws including an exploited CoreGraphics bug#
Apple’s October 2026 updates address 304 vulnerabilities across its platforms, including CVE-2026-86950 in CoreGraphics, which Apple said may have been exploited in an attack against targeted individuals using older iOS versions.SANS ISC Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October to fix the flaw on older devices, SecurityOnline reported.SecurityOnline
The issue is an out-of-bounds write that could allow arbitrary code execution when processing a maliciously crafted file, SecurityOnline reported.SecurityOnline The wider update also includes a camera-access flaw and a local attack that could expose Keychain items, according to SANS ISC.SANS ISC
Wiz links stolen GitHub tokens to Gheist secret theft#
Wiz researchers linked the Gheist campaign to stolen GitHub access tokens used to create malicious workflow branches across more than 13,500 branches and over 850 compromised accounts.InfosecurityDark Reading The workflows printed repository secrets into their logs, which attackers retrieved through GitHub’s API before deleting the runs, Infosecurity reported.Infosecurity
Wiz found that GitHub’s approval control kept the public runs it examined in an action_required state, but that protection did not apply to private repositories or GitHub Enterprise Server.Infosecurity In enterprise environments, the researchers also observed cloud credentials from the same organisations being used hours later to enumerate AWS Secrets Manager.Infosecurity
Cloudflare discloses cross-customer data exposure in GLM-5.3#
Cloudflare said a cross-request KV cache exposure in its GLM-5.3 Workers AI model affected users from 27 August 2026, with responses to prompts longer than 681,280 tokens containing data from other customers’ sessions.Cloudflare The company counted 155 affected responses before taking the model offline, deploying a corrected configuration and restoring service on 9 September.Cloudflare
Cloudflare said the problem combined an inference-engine misconfiguration with a bug in handling over-length requests, and that no other Workers AI models were affected.Cloudflare After excluding its own tests and the researcher’s data, Cloudflare said the observed requests aligned with normal long-context usage rather than deliberate exploitation.Cloudflare
Also
- Node.js. Rapid7 said CVE-2026-111497 in the Brotli decoder can cause memory corruption when applications decompress attacker-supplied data, with possible outcomes including a crash, memory disclosure or remote code execution; it reported no known in-the-wild exploitation as of 26 October.Rapid7
- Mautic. Mautic released versions 7.2.2, 6.0.10 and 5.2.12 to address nine vulnerabilities, including CVE-2026-115188, an authenticated remote code execution flaw tied to unrestricted file uploads.SecurityOnline
- Consul. HashiCorp patched CVE-2026-110720, a cross-namespace authorisation bypass affecting consul-k8s versions from 0.42.0 and earlier; the advisory reported no confirmed exploitation in the wild.SecurityOnline
- CERT-UA. CERT-UA reported unauthorised access to Dahua cameras and DVRs in Ukraine, including altered configurations and newly created accounts, and described a campaign said to have compromised over 14,530 cameras between 17 June and 22 July 2026.The Hacker News
Watching
CISA set 29 October 2026 as the remediation deadline for federal agencies affected by the two PHP vulnerabilities.CISAThe Hacker News