Security news 44/2026

PHP

Improper state handling on out-of-memory (OOM) conditions leaves request memory uninitialized, which can be triggered repeatedly to achieve unauthenticated remote code execution (RCE). The flaw is part of the PHP2Shell attacks, in which attackers gained root on servers as well as Palo Alto (PAN-OS) firewalls.

What to do: Update PHP immediately on all servers and hosting nodes per vendor guidance and check for available PAN-OS fixes.

PHP

PHP global state may continue to reference invalid memory after request memory is freed, which subsequent requests then read, leading to remote code execution. It is exploited together with CVE-2026-109618 in the PHP2Shell campaign.

What to do: Update PHP together with the fix for CVE-2026-109618 and check servers for signs of compromise.

GitLab CE/EE

Insufficient validation of regular expressions in CI/CD configuration allows an unauthenticated attacker to execute arbitrary code on the GitLab server (CVSS 10). The flaw is already being exploited; attacks have hit Alpine Linux among others.

What to do: Update GitLab to 19.2.8, 19.3.5 or 19.4.2 or later and restrict internet access to the instance.

Google Brotli (and dependent products)

A buffer overflow in the Brotli decoder (Broccoli2Shell) allows a crafted compressed stream to corrupt memory, read sensitive data, crash the service or potentially execute code. The library is used by Node.js, .NET, Envoy, Istio and Debian, among others; attack traffic has already been observed.

What to do: Update Brotli libraries and binaries to versions 1.0.10, 1.1.1 or 1.2.1 and apply fixes for dependent products and distributions.

Linux kernel (RHEL, OpenShift and others)

The shared-memory flag is lost when network packets are coalesced, so IPsec (ESP) decryption can overwrite data in the page cache. A local authenticated attacker can thereby gain full privileges on the system.

What to do: Install the patched kernel for your distribution and reboot servers.

Cisco Secure Firewall ASA / FTD

A logic error in the Remote Access SSL VPN service with secondary authentication configured allows an unauthenticated attacker to reload the device with a crafted request (DoS).

What to do: Update ASA/FTD per Cisco's advisory and consider restricting access to SSL VPN in the meantime.

Ivanti Connect Secure

The dsinvoked service trusts DSCache configuration data, enabling privilege escalation to root. Attackers chain it with other flaws to gain root without authentication.

What to do: Update Ivanti Connect Secure per vendor guidance and check the gateway for signs of compromise.

Adobe Commerce (Magento)

Unrestricted upload of dangerous files allows code execution and account or session takeover if the victim opens a crafted URL. Hundreds of online stores were compromised this way in the PolyShell campaign.

What to do: Update Adobe Commerce per vendor guidance and check hosted online stores for suspicious uploaded files.

VMware ESXi / vSphere / Cloud Foundation

Insufficient logging allows a malicious administrator to perform certain operations without them being recorded. The flaw itself has a low rating but is being exploited to conceal activity.

What to do: Update ESXi per VMware guidance and restrict and audit administrator accounts.

PHP2Shell: attackers gained root on 25 servers and Palo Alto firewalls

Attackers suspected of ties to China built a custom exploit for the PHP flaws and gained root on 25 servers; they likely still have access to a network linked to the US government. The attacks have been running for over a week, also hit Palo Alto firewalls, and over 22.6 million exposed instances are potentially at risk. They have not yet succeeded against WordPress, but PHP must still be updated immediately.

New RCE flaw in WordPress core: 63,000 attack attempts in 24 hours

Attackers are attempting to exploit a race condition in WordPress core 4.7 through 7.1.3 that leads to unauthenticated remote code execution (CVSS 8.1, no CVE). Nearly 63,000 attempts were recorded within 24 hours of the fixes being released. Hosting providers should verify that customer websites are running an updated WordPress.

Attackers exploit critical flaw in Drupal Commerce Core

Drupal warns of active exploitation of a missing authorization flaw in the Commerce Core module in versions up to 2.41 and 3.0.0–3.3.13 (CVE-2026-118539). It affects online stores built on Drupal; the module must be updated per Drupal's security advisory.

APT group exploits Cisco SD-WAN to deploy KeyDrift malware

The newly tracked group UAT-11473 exploits an authentication bypass in Cisco Catalyst SD-WAN Controllers (CVE-2026-20127) and deploys its custom KeyDrift malware. SD-WAN administrators should verify patch status and check controllers for signs of compromise.

Chaining three Ivanti Connect Secure flaws gives attackers unauthenticated root

Attackers combine three Ivanti Connect Secure flaws, including CVE-2026-111357 and CVE-2026-118527, to gain root access to the VPN gateway without authentication. Operators of these gateways should update and check devices for signs of intrusion.

PolyShell campaign compromised hundreds of Adobe Commerce stores

PolyShell attacks exploiting CVE-2026-48356 have compromised hundreds of stores on Adobe Commerce/Magento. At the same time, attack traffic targeting the flaw in the Brotli library is emerging. Hosting providers with Magento stores should check updates and uploaded files.

CSIRT.CZ: critical Linux kernel flaw threatens Ubuntu, RHEL and others

The use-after-free vulnerability CVE-2026-98432 (CVSS 9.8) occurs when establishing TCP connections over IPv4. According to Anthropic researchers, it allows an unauthenticated attacker to execute commands as root on servers with a listening Multipath TCP (MPTCP) socket. Linux server administrators should monitor for and deploy patched kernels from their distribution.

CSIRT.CZ: Broccoli2Shell flaw in the Brotli library threatens HTTP applications

The flaw CVE-2026-111497 in the Brotli compression library may allow remote code execution via crafted compressed data. It affects applications and proxies that use Brotli; both the library and dependent products need to be updated.

Fortinet FortiSandbox / FortiSandbox PaaS

Authentication bypass via an alternate path allows an attacker to execute unauthorized code or commands with crafted HTTP requests. Affects versions 5.0.0–5.0.6, 4.4.0–4.4.9 and all 4.2 releases.

What to do: Update FortiSandbox per Fortinet guidance and restrict access to its web interface.

AjaxLoadMore Cache

Unauthenticated remote code execution in versions up to 3.1.1 (CVSS 10); an attacker can take over the website.

What to do: Search hosted websites for this extension and update it per vendor guidance, or deactivate it.

Progress WS_FTP Server (Windows)

OS command injection allows arbitrary commands to be executed on the server under certain configurations; the related CVE-2026-90865 allows execution with elevated privileges.

What to do: Update WS_FTP Server to 2024.0.7 or 2025.0.4 or later.

Dell PowerProtect Data Domain

Improper authentication allows an unauthenticated remote attacker to execute commands as root and take over the backup system. A number of other flaws were fixed at the same time, e.g. the stack overflow CVE-2026-103780.

What to do: Update Data Domain as soon as possible per Dell's advisory and restrict network access to management.

Yamaha NWR100 (Wi-Fi router)

OS command injection allows an unauthenticated attacker to execute arbitrary commands on the router via a crafted request.

What to do: Update firmware per vendor guidance and do not expose router management to the internet.

TOTOLINK A950RG

Command injection via the MAC address parameter allows remote command execution on the router; a public exploit is available. The same model has further critical flaws (CVE-2026-116504, CVE-2026-116506).

What to do: If you operate these routers at customer sites, block remote management and monitor for a vendor fix.

Juniper Session Smart Router / Conductor

OS command injection in AccessManager allows an attacker with configuration write privileges to execute commands as root; the related CVE-2026-103403 allows file deletion and command execution.

What to do: Update per Juniper guidance and review who has permission to change the configuration.

Asterisk

When the res_config_ldap LDAP realtime driver is used, an LDAP filter can be injected via the SIP username to read LDAP information without authentication. The module is not enabled by default.

What to do: Update to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 or Certified 20.7-cert11/22.8-cert3.

Dolibarr ERP CRM

An authenticated administrator can bypass the export command allowlist and execute system commands under the web server account.

What to do: Update Dolibarr to version 24.0.0 or later.

OnCell G3150A-LTE

With SMS management enabled, an attacker with the necessary privileges can execute arbitrary commands on the device.

What to do: Update firmware per vendor guidance and disable SMS management if not needed.