This is the security briefing for Tuesday the 27th of October 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one, with eighteen stories to get through — let's start with the CISA alerts.
CISA have added the PHP2Shell vulnerability pair to the Known Exploited Vulnerabilities catalogue. CVE-2026-109619 is a critical use-after-free flaw in PHP versions 8.2 through 8.5 that's being actively exploited for unauthenticated remote code execution — attackers are deploying Mirai variants and using AI platforms for post-exploitation. Patched versions are available, but if you can't patch immediately, disabling session upload progress is a temporary mitigation worth considering.
And the second half of that pair, CVE-2026-109618, hits virtually all PHP web-serving configurations including PHP-FPM and mod_php. Public proof-of-concept code is circulating, and it's already integrated into automated mass-exploitation tooling. CISA are advising organisations to treat all unpatched internet-facing PHP servers as potentially compromised — worth flagging if you're running any PHP infrastructure.
ESET have written up MythicRatatoskr, a Go-based backdoor deployed by UAC-0099 working alongside Sandworm. The campaign targeted a Ukrainian grain logistics company via spearphishing, and what's particularly notable here is the use of Yggdrasil mesh networking for command and control — it's designed to evade traditional network security monitoring by using decentralised routing.
Tracebit tested nine 'context bomb' deception techniques against seven autonomous AI agents powered by advanced language models. The defensive strategy successfully misdirected the agents during reconnaissance and exploitation — reducing objective completion by ninety-one percent, increasing attack costs twenty-three-fold, and significantly slowing progress through techniques like fake pentest reports and decoy APIs. One for defenders interested in AI-targeted deception.
Binding Hook have documented a clever approach for law enforcement to disrupt criminal bulletproof hosting infrastructure without compromising internet registry neutrality. The technique uses RPKI AS0 records published by a court-appointed custodian to signal that no network is authorised to announce the seized IP prefix — major transit providers drop the traffic, and the infrastructure goes offline without damaging the broader routing system. Useful background if you're tracking takedown operations.
Blevene Security cover Node2Shell, also known as Broccoli — CVE-2026-111497. It's a critical out-of-bounds write in the Brotli decompression library affecting Node.js, Python, Bun, Envoy, and web infrastructure like Nginx and Apache. Researchers demonstrated remote code execution in lab environments on Node arm64, though denial-of-service crashes are more common in the wild. Not yet on CISA's catalogue as of today, but worth watching.
Quentin Kaiser disclosed WPSplinter, a critical vulnerability in Broadcom's legacy WPS Monitor implementation. An unauthenticated attacker in proximity can achieve arbitrary code execution through malformed EAP-WPS fragments — it affects both eCos and Linux-based platforms, often running with root privileges, and remains exploitable even when WPS is disabled via the web interface. We've seen Broadcom appear in this context before — there was a related WiFi access point fingerprinting tool released a few days ago.
Cyberdione Labs discovered high-severity vulnerabilities in Tailscale mesh networking software that enable wormable propagation across entire networks. The flaws allow attackers with a single compromised device to achieve fleet-wide privilege escalation through implicit device trust, Unix socket forwarding as root, and unrestricted network discovery without triggering alerts — which is concerning given how widely Tailscale is deployed in zero-trust architectures.
A researcher has released WHFB-PinCapture, a proof-of-concept that captures Windows Hello for Business PINs in memory during user login by injecting code into LogonUI and using CPU hardware breakpoints. It requires elevated administrator access with SeDebugPrivilege, but it bypasses VBS, VSM, and TPM protections by intercepting the PIN at the moment of entry. The capture is silent and allows normal login to proceed, making detection difficult.
BlackWasp have published a technical guide documenting the manual extraction and decryption of Windows LSA secrets and Domain Cached Credentials from SYSTEM and SECURITY registry hives. It reverse-engineers the cryptographic process from Boot Key assembly through hierarchical decryption — essentially showing how attackers can silently exfiltrate and decrypt credentials offline without detection. Useful context if you're working on credential theft detection.
Security researchers have documented a novel shellcode execution technique abusing the legitimate Windows API function SetupIterateCabinetW. The method allows attackers to execute arbitrary code by passing shellcode as a callback function pointer when processing cabinet files — potentially evading EDR solutions that monitor thread-creation events. It requires executable memory allocation and a valid cab file to function.
Splunk have documented the PHP2Shell campaign — this follows the CISA alerts we covered at the top. Attackers abuse session upload-progress and multipart request handling to inject malicious payloads via PHP session upload progress fields, enabling web shell deployment and arbitrary command execution. The Splunk write-up includes detection guidance for their platform.
Searchlight Cyber cover the same vulnerability pair with a focus on high-fidelity detection. The two critical remote code execution flaws in PHP were publicly disclosed on the 20th of October, before patches were available, and there have been confirmed attacks against a European government agency. Detection requires triggering memory exhaustion errors, as traditional version scanning is unreliable for mod_php and PHP-FPM configurations.
And Adel Ka observed successful exploitation of PHP2Shell in the wild on the 24th of October. Automated attackers compromised PHP 8.4.26 environments running Apache mod_php through a four-stage remote code execution attack that bypassed ASLR. The exploit leveraged PHPSESSID cookie manipulation to leak memory addresses and achieved thirty-five successful shell executions across honeypot targets.
A security researcher has released Wake and Break, a proof-of-concept exploit that bypasses firmware signature verification on AMD Navi31 graphics cards — that's the RX 7900 series. The exploit targets the Platform Security Processor boot process and allows loading of unsigned firmware for GPU components, though it requires a warm boot and is cleared by cold power cycles. Not persistent, but notable for showing how GPU security boundaries can be bypassed.
NMG is a red team tool that generates fileless, parameterised .NET memory-shell payloads for IIS and ASP.NET applications. It supports multiple injection techniques including VPP, Route, and HttpListener, and is compatible with web-shell management clients including Godzilla, Behinder, and AntSword. Essentially the .NET equivalent of JMG for Java — attackers can inject malicious code directly into application memory without persistent disk artifacts.
Assetnote Security Research Team released php2shell-scanner, a specialised tool to detect the PHP2Shell vulnerabilities we've been covering. The scanner identifies vulnerable PHP installations by sending crafted multipart probes that trigger memory exhaustion errors, PHP-FPM crashes, or differential HTTP 500 responses. Worth looking at if you're trying to survey exposure across a large estate.
And finally, the mitmproxy project has added a command-line flag to support security testing using compromised eMudhra CA certificates — the EM OV TLS CA intermediate and emSign Root TLS CA root. The compromise allows unauthorised certificate signing, enabling potential man-in-the-middle attacks against systems trusting these CAs. The update includes the compromised certificate chain for research purposes. This follows eMudhra's announcement that they're exiting the global SSL/TLS certificate business, which we covered a few days ago.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated.