Security Bulletin

❓What:

• PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Public reporting calls the vulnerabilities PHP2Shell. patchstacksecurityweek

• They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical (CVSS v4.0 9.2). patchstack

• Details leaked online on October 20, before coordinated disclosure and before patches were available. PHP moved the release up from October 22 in response. huntressrescana

• PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix both flaws. huntress

❓What:

• The FBI and US Secret Service issued a warning on October 6 that the FortiBleed campaign against Fortinet FortiGate firewalls and SSL VPN gateways is still ongoing. infosecurity-magazine

• The notice cites SOCRadar figures of 86,644 compromised devices across 194 countries. infosecurity-magazine

• The advisory cites no CVE. Fortinet believes attackers are reusing previously stolen credentials and brute-forcing devices with weak passwords and no MFA. dailysecurityreviewcybersecuritydive

• Attackers create new accounts and, in some cases, delete existing ones to block organizations from their own devices. helpnetsecurity

❓What:

• Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb

• CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb

• CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb

• Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity

❓What:

• F5 Labs disclosed an automated mass-scanning campaign, observed in August 2026, exploiting CVE-2026-39364 (CVSS 8.2), a high-severity Vite vulnerability

• The flaw lets an unauthenticated attacker bypass Vite's server.fs.deny protections using query parameter manipulation (e.g., ?raw, ?import&raw, ?import&url&inline) appended to /@fs/ requests

• Exploitation requires three conditions: the dev server is exposed to the network (via --host or server.host), the target file exists within server.fs.allow directories, and it's a file normally blocked by server.fs.deny

• Under default config, Vite binds to localhost only — exposure typically results from developers passing --host, setting server.host, or misconfigured Docker port mappings