Attackers can break into a vulnerable system remotely without a password, and CISA has ordered civilian federal agencies to fix their systems within three days.
PHP's maintainers released patches less than a week before the warning, and CISA did not say who is behind the attacks.
Source: TechCrunch.
The worst, CVE-2026-114595, is an integer overflow rated 9.8 on CVSS v3.1 that could allow out-of-bounds memory writes and potentially remote code execution, while the other three are rated high.
Version 7.0.11 includes fixes for all of them.
Source: The Register.
CISA has confirmed that attackers are exploiting both PHP2Shell vulnerabilities, each rated 9.2 on CVSS and usable without logging in to run code on vulnerable PHP servers, and has given federal agencies three days to patch. Patches were released on October 21, but AWS says it saw exploitation attempts as early as October 17. Researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php, tied the activity to CVE-2026-109618, and found no evidence the second flaw was involved. Source: The Register.
CVE-2026-97631 is a critical flaw, rated 9.5 out of 10, in TianoCore EDK II, the open source code used to build UEFI firmware. The 16-year-old buffer overflow in the PXE Base Code driver lets an attacker run code with the highest CPU privilege before the operating system and defenses such as Secure Boot load. A fix is available and public through an AMI pull request and a TianoCore advisory, though updating firmware across millions of devices is slow, and AMI, Insyde, Phoenix and Microsoft's Project Mu fork all use EDK2. Source: Ars Technica.
Check Point says it is using OpenAI's Daybreak, through the OpenAI Daybreak Defense Network, to cut its vulnerability research workflow from hours to minutes. CTO Jonathan Zanger says the models can analyze vulnerabilities and scan code and configurations for gaps, which helps the team turn findings into security signatures or indicators of compromise. The item describes no specific vulnerability, severity rating or patch. Source: OpenAI.