Cyber Roundup: Week of October 19

Voici les principales actualités que vous avez manquées la semaine dernière.

1. PHP: php2shell lands as an unauthenticated RCE in PHP core, affecting 2.24M internet-facing hosts

Le titre : On October 21, 2026, the PHP security team shipped an emergency release covering CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution flaws in PHP core rated CVSS v4.0 9.2 each. The release landed 25 minutes ahead of schedule after a Hacker News leak broke the embargo the previous day. Researchers named the flaws “php2shell.” Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Ce que nous sommes en train de regarder : The sequence compressed the normal patch window to zero. Cloudflare’s CTO reported early attacks at 07:43 UTC on October 21, hours before the release. Sansec warned of mass exploitation within 15 minutes of the release. The flaws affect every PHP installation serving web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed) and are present in every PHP version since PHP 5.

CybelAngel’s Leah Koonthamattam published a dedicated deep-dive covering CybelAngel’s exposure scan of 1.3 million internet-facing assets. Among sites that reveal their PHP version, 54% run an end-of-life branch. Shodan banner counts put the broader figure at 2.24 million internet-facing PHP hosts, with 59% on a branch that has no official release. PHP 5.6 and 7.2 alone account for roughly 371,000 hosts for which PHP publishes no fix. The deep-dive has the full timeline, country breakdown, and the CybelAngel free PHP exposure checker.

La question du RSSI : Does your organization have a current inventory of every internet-facing PHP service, including those run by hosting providers, agencies, and appliance vendors you do not directly operate, and can you confirm each one is now on a patched build?

2. Plex: Plex2Shell exploit chain weaponized within hours of PoC release, dropping XMRig and proxy malware

Le titre : On October 17, 2026, attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The exploitation began the day after researcher Zach Main published technical details and a working proof-of-concept on October 16. CISA added all four CVEs to its KEV catalog on October 20 with a federal remediation deadline of October 23. Plex originally patched the issues in Plex Media Server 1.43.3.10861, released August 3, 2026, and asked server owners to upgrade on September 1.

Ce que nous sommes en train de regarder : The chain combines unauthenticated SSRF, token theft, and an arbitrary file write to achieve full unauthenticated RCE on Plex servers running version 1.43.2 or earlier. A researcher operating an internet-facing honeypot recorded the first successful compromise in the early hours of October 17. Attackers dropped a Docker-based XMRig cryptocurrency miner and a residential proxy tool called myawesomeproxy that routes traffic through the compromised server’s home IP.

The gap between PoC publication and first observed exploitation was under 24 hours. Approximately 36,000 Plex servers remained exposed to the internet as of September 2026.

La question du RSSI : Does your organization have visibility into consumer-grade or self-hosted media servers running on employee or contractor home networks, and does your supply chain assessment include questions about personal infrastructure that may expose the broader network through residential proxy software?

3. Siemens: Software Center DLL side-loading flaw exploited by the Romulus ClickFix delivery platform

Le titre : On October 19, 2026, Siemens confirmed active exploitation of CVE-2026-110936, a CVSS v4.0 8.4 DLL side-loading vulnerability in Siemens Software Center. Siemens attributed the activity to a multi-platform ClickFix campaign called Romulus, which Forescout’s Vedere Labs identified the previous week as a new multi-payload delivery panel. CISA added the CVE to its KEV catalog on October 20 with a federal remediation deadline of October 23. The fix landed in Siemens Software Center version 4.0.9.8.

Ce que nous sommes en train de regarder : The attack is operationally elegant. Attackers use a genuine, digitally signed copy of Siemens Software Center and place a crafted DLL named archive.dll next to the legitimate executable. When Software Center loads helper files from its own folder without checking them, the attacker’s DLL executes with the privileges of the trusted application. The initial lure uses ClickFix social engineering, with some campaigns leveraging malicious ChatGPT Custom GPTs to direct victims to fake URLs serving the ClickFix prompt.

Romulus is the forward signal. Forescout assesses it may be a privately operated panel, a commercial delivery service, an affiliate framework, or software copied between operators. It has previously delivered Legion Loader and other remote access trojans. The combination of signed-binary abuse, ClickFix social engineering, and a shared delivery platform is the current state of the mass commodity-malware supply chain.

La question du RSSI : For every digitally signed vendor application your organization deploys, do your endpoint controls distinguish between the signed executable and the DLLs it loads from the same directory, and does your user training reach the workflows that ClickFix prompts specifically target?

4. EG Secure: SiteGuard Server Edition flaw CVE-2026-106931 lands on CISA KEV with 3-day federal deadline

Le titre : On October 20, 2026, CISA added CVE-2026-106931 to its KEV catalog with a federal remediation deadline of October 23. The flaw is a CWE-78 OS command injection vulnerability in the statistics feature of EG Secure Solutions SiteGuard Server Edition, a Japanese web application firewall product deployed with Apache httpd, Nginx, and IIS. The vendor and JVN had previously confirmed active exploitation in the wild.

Ce que nous sommes en train de regarder : The affected product is a security tool. SiteGuard Server Edition is a web application firewall marketed to protect downstream web applications from attack, and the exploited flaw gives attackers root or SYSTEM command execution on the WAF appliance itself depending on the host operating system. An attacker who compromises SiteGuard then holds the control plane that was supposed to inspect traffic to every protected application behind it. The affected versions are Ver2.20 and later before Ver8.00 Update 5 on Apache, Nginx and IIS, and Ver2.20 and later before Ver7.00 Update 6 on the FreeBSD variant.

The three-day federal deadline is the shortest timeline CISA has issued for a KEV entry this quarter. BOD 26-04 requires forensic triage on affected systems, not just patching, which signals CISA assesses the flaw is being used for post-exploitation access rather than purely scanning.

La question du RSSI : If your Japanese operations or supply chain run SiteGuard Server Edition, has that estate been inventoried for affected versions, and does your incident response cover WAF appliances where the primary vendor documentation is not in English?

5. Palo Alto: Qilin and Inc ransomware operators continue exploiting PAN-OS GlobalProtect CVE-2026-0257

Le titre : On October 19 and 20, 2026, Palo Alto Networks’ Unit 42 updated its threat brief on CVE-2026-0257, the PAN-OS GlobalProtect authentication bypass flaw first weaponized in May, confirming continued active exploitation by multiple ransomware operators. Unit 42 named Spikey Scorpius (also tracked as Qilin) and Tarnished Scorpius (also tracked as Inc) as the groups driving the current activity. Unit 42 tracks the broader campaign as Lunar Peak.

Ce que nous sommes en train de regarder : Five months after disclosure, PAN-OS GlobalProtect remains an active ransomware target because the exposed population has not been fully remediated. Unit 42 continues to observe a recurring misconfiguration during incident response that leads to critical unintended exposure. The exploited population includes customers who believed they had patched the flaw but had not fully closed the exposure path.

The Qilin and Inc attribution matters because both groups are among the most active ransomware ecosystems of Q4. Qilin accepted Settra as a parallel GlobalProtect operator in September, and Inc has consistently targeted perimeter infrastructure in 2026. The pattern is well-established: a VPN appliance flaw gets patched, the broader exposed population stays vulnerable, ransomware operators cycle through exposed targets for months.

La question du RSSI : For your PAN-OS GlobalProtect deployments, have you verified that both the patched version is installed and the specific session-persistence conditions Unit 42 flagged during Lunar Peak incident response have been eliminated from your environment?

The three main trends from the above

These three patterns taken together signal that the operational tempo of attack has moved faster than the operational tempo of defence, with exploitation now routinely preceding patch availability and extending months beyond vendor advisories. Security teams who still measure response in days rather than hours should treat last week as the moment to recalibrate.

That’s it for this week’s roundup.