Security News Bulletin - October 2026

PHP RCE via OOM corruption Vulnerability

CVE-2026-109618

Published: 2026-10-21 
Updated: 2026-10-21  

Vendor: PHP Group 
Product: PHP

Attack Tags: Remote Code Execution (RCE), Use After Free, Memory Corruption, Out-of-Memory (OOM), Unauthenticated Attack, PHP-FPM, Web Server Security, PHP2Shell

Severity: Critical (CVSS 9.2)

What Is CVE-2026-109618?
 

CVE-2026-109618 is a critical remote code execution vulnerability in PHP, sometimes referred to as part of the “PHP2Shell” vulnerabilities. It arises when PHP encounters an out-of-memory (OOM) condition during request processing and leaves internal request data partially initialized. During request cleanup, PHP may incorrectly access this data, potentially causing memory corruption and allowing an attacker to execute arbitrary code remotely without authentication. 

The vulnerability affects PHP itself rather than a specific content management system, so websites and applications running vulnerable PHP versions may be exposed, including deployments using PHP-FPM, Apache mod_php, and other PHP server interfaces 

Affected Versions 

• Affected from 8.2.* before 8.2.35 
• Affected from 8.3.* before 8.3.36 
• Affected from 8.4.* before 8.4.27 
• Affected from 8.5.* before 8.5.12  

Observed Attack Activity 

• Exploitation attempts reported: Patchstack reported multiple exploitation incidents to hosting partners on October 21, 2026, before the official patch release.
• Network-level attack reports: Cloudflare reported early attacks and deployed Web Application Firewall (WAF) protections.
• Public PoCs: Exploit code and technical details became publicly available before the coordinated security release.
• Confirmed compromise status: The extent of successful exploitation remains unclear; reports of attempts do not establish that every targeted server was compromised.

 Indicators of Compromise are: 

• Suspicious or oversized HTTP POST requests using multipart/form-data.
• Unexpected PHP_SESSION_UPLOAD_PROGRESS fields in requests.
• Repeated PHP memory-exhaustion errors, crashes, or PHP-FPM worker restarts.
• Unexpected shell/process execution initiated by PHP.
• Suspicious file changes, web shells, or outbound network connections.
• Requests originating from known suspicious IP addresses associated with exploitation attempts.

Potential Impact of Successful Exploitation: 

• Remote Code Execution (RCE): Execute arbitrary code on the vulnerable server.
• Data Theft: Access sensitive application data, credentials, and tokens.
• Server Compromise: Modify files, install web shells, or deploy malware.
• Database Access: Read or manipulate databases, depending on permissions.
• Lateral Movement: Use the compromised server to target connected systems.
• Service Disruption: Interrupt website or application availability.

Additional Resources  

1. Official CVE Record – CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-109618 

2. National Vulnerability Database (NVD) 
   https://nvd.nist.gov/vuln/detail/cve-2026-109618 

3. Github.com 
   https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w 

---

PHP RCE via stale global state Vulnerability

CVE-2026-109619

Published: 2026-10-21 
Updated: 2026-10-21  

Vendor: PHP Group 
Product: PHP

Attack Tags: Remote Code Execution, Use-After-Free, Memory Corruption, Unauthenticated Attack, PHP Runtime, PHP-FPM, Web Server Compromise, Sensitive Memory Disclosure, PHP2Shell.

Severity: Critical (CVSS 9.2)

What Is CVE-2026-109619?
 

CVE-2026-109619 is a critical vulnerability in the PHP runtime caused by improper handling of internal global state that references request memory. In certain circumstances, PHP retains a reference to memory after that memory has been freed. A subsequent request handled by the same worker may access this stale memory before it is correctly initialized. 

Affected Versions 

• affected from 8.2.* before 8.2.35 
• affected from 8.3.* before 8.3.36 
• affected from 8.4.* before 8.4.27 
• affected from 8.5.* before 8.5.12  

Observed Attack Activity 

Amazon Threat Intelligence identified an attempted PHP2Shell exploit dating to October 17, 2026, before public disclosure. 

Researchers have published technical details and proof-of-concept demonstrations. 

Cloudflare reported deploying WAF protections against the PHP2Shell vulnerabilities. 

 Indicators of Compromise are: 

• Suspicious multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS and attacker-controlled PHPSESSID values.
• Unexpected PHP-FPM crashes, errors, or child-process execution.
• Unusual file modifications, web-shell creation, or outbound network connections.

Additional Resources  

1. Official CVE Record – CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-109619 

2. National Vulnerability Database (NVD) 
   https://nvd.nist.gov/vuln/detail/cve-2026-109619 

3. Github.com 
   https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp 

---

TYPO3 Shop Payment Notification Vulnerability

CVE-2026-113468

Published: 2026-10-20 
Updated: 2026-10-20  

Vendor: TYPO3 
Product: Extension "TYPO3 Shop by coding.ms"

Attack Tags: Broken Access Control, Payment Notification Manipulation, Unauthorized Data Modification, Unauthenticated Attack, E-commerce Security.

Severity: Medium (CVSS 6.9)

What Is CVE-2026-113468?
 

CVE-2026-113468 is a broken access control vulnerability in the TYPO3 Shop extension developed by coding.ms (codingms/shop). The flaw allows an unauthenticated website visitor to overwrite stored payment notifications associated with unpaid orders. This could interfere with payment processing workflows and undermine the integrity of order-payment records. 

Affected Versions 

• affected from 6.0.0 before 6.3.0 
• affected from 5.0.0 before 5.21.1 
• affected from 0 before 4.9.4  

Observed Attack Activity 

As of October 20, 2026, no confirmed real-world exploitation has been identified in the sources reviewed. 

Additional Resources  

1. Official CVE Record – CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-113468 

2. Typo3 Security Advisory 
   https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036 

3. National Vulnerability Database (NVD) 
   https://nvd.nist.gov/vuln/detail/cve-2026-113468 

---

TYPO3 Shop Order Cancellation Vulnerability

CVE-2026-112071

Published: 2026-10-20 
Updated: 2026-10-20  

Vendor: TYPO3 
Product: Extension "TYPO3 Shop by coding.ms"

Attack Tags: Broken Access Control, Missing Authorization, Unauthenticated Attack, Unauthorized Order Cancellation, E-commerce Security, Order Manipulation.

Severity: Medium (CVSS 6.9)

What Is CVE-2026-112071?
 

CVE-2026-112071 is a broken access control vulnerability in the TYPO3 Shop extension by coding.ms (codingms/shop). The order cancellation function accepts an order identifier from a request without verifying whether the requester owns the order. 

As a result, an unauthenticated visitor may cancel another customer's order that is still awaiting payment, potentially disrupting order fulfilment and causing business losses. Orders that have already been paid are not affected by this specific vulnerability 

Affected Versions 

• affected from 6.0.0 before 6.3.0
• affected from 5.0.0 before 5.21.1
• affected from 0 before 4.9.4  

Observed Attack Activity 

A public proof-of-concept (PoC) was reported on October 21, 2026. However, the available vulnerability tracking data reports no confirmed exploitation in the wild and no CISA Known Exploited Vulnerabilities (KEV) listing. 

Organizations using the affected extension should update to a fixed release and monitor order records for unexpected cancellations, particularly orders awaiting payment. 

 Indicators of Compromise: 

• Pending-payment orders changed to cancelled without a legitimate customer request.
• Requests to the TYPO3 Shop order-cancellation function containing order identifiers that do not belong to the requester.
• Order-cancellation actions initiated by visitors who are not authenticated or authorized to manage the order.
• Multiple requests targeting different order IDs from the same IP address or session.
• Reports of unpaid orders being cancelled without the customer's knowledge.

Additional Resources  

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-112071 

2. TYPO3 Security Advisory 
   https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036 

3. National Vulnerability Database 
   https://nvd.nist.gov/vuln/detail/cve-2026-112071