Security Thursdays by yisusvii — 2026-10-22

Table of Contents

🚨 Cybersecurity News of the Week

1. PHP2Shell: critical PHP remote-code-execution fixes land on the last day of the window

What happened: On October 21, the PHP project released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution on PHP installations serving web requests. The event is widely referred to as PHP2Shell. PHP security advisory; PHP 8.5.12 release.

Evidence and exposure: PHP states that all web-serving SAPIs are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, and considers the risk highest for mod_php, where a demonstrated exploit can trigger before application code runs. Cloudflare has reported attack traffic targeting these vulnerabilities, including attempts to evade its protections, and researchers have demonstrated unauthenticated disclosure of PHP worker memory, which can contain passwords, tokens, and API keys. This establishes severity and active attack interest, not that every PHP server has been compromised. PHP 8.1 and older receive no upstream fixes; the project published only minimal source backports for 7.4, 8.0, and 8.1. PHP advisory; Cloudflare report; NCSC-NL operational tracker.

Impact → action: Treat web-facing PHP as Emergency work this week. Update to the fixed release for each branch, or apply distribution and LTS-vendor backported packages, and check separately for PHP embedded in containers, appliances, and vendor products. PHP’s temporary mitigations — an uncapped memory_limit, low post_max_size, disabled session.upload_progress, and fatal_error_backtraces=0 on 8.5 — reduce exposure to specific attack paths only; PHP states they are not complete fixes. Technical detail follows in the CVE analysis below.

2. BeyondTrust Remote Support enters KEV after an origin-validation disclosure

What happened: BeyondTrust’s CVE record was published on October 15, 2026. It describes internal Remote Support components that inadequately validate message origin, allowing an attacker, under conditions not fully detailed in that record, to perform file operations on the appliance. The vendor lists Remote Support through 26.2.3 as affected. On October 16, CISA added CVE-2026-102764 to KEV, its Known Exploited Vulnerabilities catalog. These are both in-window events, not a recycled historical disclosure. Vendor-authored CVE record; CISA catalog.

Evidence and exposure: CISA’s inclusion confirms exploitation, but the catalog does not establish a victim count, actor, or ransomware campaign; its ransomware field is Unknown. BeyondTrust’s CVSS 4.0 vector describes network access without privileges or user interaction. That does not explain every internal component or deployment prerequisite. Appliance administrators should check their actual product, build, and exposure rather than assume all BeyondTrust products are affected. Vendor record and CISA assessment.

Impact → action: Treat affected Remote Support appliances as Emergency work. Obtain the exact remediation from BT26-05 and KB0024066, confirm installation, and follow CISA’s vendor-guidance and forensic-triage requirements where applicable. Those vendor pages were inaccessible here, not proven broken. As interim containment, administrators can restrict appliance access to required users and networks; that is an exposure reduction, not a verified complete fix. See the CVE analysis below for the unresolved patch detail.

3. Compromised emSign trust reaches certifi and uv

What happened: On October 20, certifi and uv published advisories about compromised intermediate certificate-authority keys chaining to emSign ECC Root CA - G3. A certificate authority (CA) is an organization whose certificates help clients authenticate websites. Someone holding a compromised intermediate key can create certificates that affected trust stores may accept; an attacker able to intercept the connection could then impersonate its destination. This is not evidence that every HTTPS connection was intercepted. certifi advisory; uv advisory.

Exposure and impact: uv uses its bundled CA certificates by default; versions below 0.13.4 are affected. Applications using certifi’s affected bundle also need attention, including copies embedded in virtual environments and container images. Merely updating an operating system’s CA package does not demonstrate that a separate bundled store changed. The advisories establish compromised trust material and an impersonation risk, not a confirmed campaign against every Python developer. uv exposure and alternatives; certifi’s bundle model.

Action: Python platform and build owners should prioritize uv 0.13.4 or later and updated certifi bundles. certifi’s original advisory identifies 2026.10.18 as the root-removal fix; the available follow-up 2026.10.19 is the version recommended here, not a different original disclosure date. Rebuild affected images and restart consumers so the deployed process uses the replacement. uv fix; certifi first fix; certifi follow-up release.

Using uv’s system or custom CA store is an alternative only after checking that store also distrusts the compromised chain. Disabling TLS verification is not a mitigation. Both advisories have no assigned CVE, so they are not given invented identifiers in the table below. uv guidance.

4. Pillow fixes memory-safety bugs in ordinary image-worker paths

What happened: Pillow 13.0.0 was released on October 16 UTC. Vendor advisories published on October 17 describe two particularly relevant paths: lossless JPEG thumbnail decoding (CVE-2026-112403) and TIFF output to an in-memory stream (CVE-2026-112393). Both vendor advisories list Pillow 12.3.0 and earlier as affected and 13.0.0 as fixed. Release; JPEG advisory; TIFF advisory.

Evidence → exposure: The JPEG issue needs lossless-capable libjpeg, such as libjpeg-turbo 3.x, and the scaled decoding path used by draft() or ordinary thumbnail() processing. The TIFF issue affects services that accept images and save TIFF output to BytesIO or another destination without a usable file descriptor. Restricting an upload to a nominal image format is not sufficient for these paths. The advisories contain public reproductions of memory corruption; that is not confirmation of attacks against deployed services. JPEG prerequisites; TIFF prerequisites.

Impact → action: Prioritize upload processors, thumbnail services, and document-conversion workers that actually reach these paths. Upgrade to Pillow 13.0.0, rebuild workers, and test representative images before rollout. The TIFF report demonstrates a crash and disclosure of leftover process memory, but explicitly does not demonstrate code execution. Neither CVE appeared in the downloaded KEV catalog; exploitation elsewhere remains unknown. Technical detail and temporary mitigations follow below. TIFF impact; CISA snapshot.

🛡️ CVEs That Deserve Attention

CVE-2026-109618 — out-of-memory corruption during PHP request cleanup

• Versions: Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35, all released October 21. PHP 8.1 and older are end-of-life upstream; the project published minimal source backports for 7.4, 8.0, and 8.1, and distributions and LTS vendors received patches in advance. Backported distribution packages may keep an older version number.
• Root cause: An out-of-memory error can interrupt a vulnerable operation while internal request data is only partially initialized. Request cleanup then treats the invalid data as valid, creating a remote-code-execution path. GHSA-w8hw-w9fx-j79w.
• Exposure and evidence: PHP considers the risk highest for Apache mod_php, with a demonstrated exploit that an unauthenticated request can trigger before application code runs; PHP-FPM’s startup behavior blocks a specific out-of-memory path, but FPM is not exempt from the paired vulnerability below. Cloudflare reports attack traffic, including attempts to evade its WAF protections. Qualys attributes a CVSS 4.0 score of 9.2 to each CVE. Neither CVE appeared in the downloaded KEV snapshot; KEV absence does not establish absence of exploitation.
• Remediation: Updating is the only complete fix. Pending rollout, PHP documents partial mitigations: set memory_limit=-1 through an unoverrideable channel such as php_admin_value, set a low post_max_size with upload_max_filesize below it, and use container or cgroup limits as an availability boundary. Do not substitute RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable allocation failure. These measures do not make an installation safe.
• Priority: Emergency for internet-facing PHP, starting with mod_php, then FPM, php-cgi, FrankenPHP, and LiteSpeed, including PHP embedded in images and appliances.

CVE-2026-109619 — stale request-owned global state reused by a later request

• Versions: Same fixed releases and backport situation as CVE-2026-109618 above.
• Root cause: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, producing a use-after-free. Researchers have demonstrated remote code execution through this sequence. GHSA-6wmf-4rv5-p3rp.
• Exposure and evidence: PHP validated a session-lifecycle remote-code-execution path against PHP-FPM under suitable application conditions, so FPM deployments are in scope even where the OOM path is blocked. Researchers also demonstrated unauthenticated disclosure of worker memory, which can expose passwords, authentication tokens, and API keys. Reported attack traffic applies to the vulnerability pair; per-CVE targeting breakdown is not public.
• Remediation: Updating is the only complete fix. Partial mitigations: set session.upload_progress.enabled=0 in php.ini, an FPM pool, or server configuration applied before request parsing — not ini_set() or .user.ini — and restart every worker; on PHP 8.5, set fatal_error_backtraces=0 and restart; remove invalid per-request settings that emit diagnostics before initialization and fix attacker-reachable fatal errors and timeouts. Each measure blocks confirmed paths only.
• Priority: Emergency alongside CVE-2026-109618; both are fixed by the same releases.

Sources for both PHP entries: PHP security advisory; NCSC-NL operational information and software status list; Qualys exposure analysis; Cloudflare attack-traffic report. News item 1 provides the rollout context.

CVE-2026-102764 — exploited appliance boundary, incomplete remediation evidence

• Versions: BeyondTrust’s own CVE record lists Remote Support ≤ 26.2.3 as affected. It does not identify a first fixed version or a hotfix identifier. Do not assume 26.2.4 is the required or sufficient fix.
• Prerequisites and impact: The vendor’s CVSS 4.0 score is 9.3, with network access, no privileges, and no user interaction in its vector. The prose describes file operations under unspecified conditions; the exact reachable internal interface and configuration prerequisites remain decision-critical unknowns.
• Exploitation: CISA confirms exploitation through its October 16 KEV addition and an active-exploitation assessment. This does not establish a public exploit’s availability, campaign scale, or ransomware use.
• Remediation and rationale: Emergency because exploitation is authoritative, not because the numerical score is large. Remote Support owners must confirm BT26-05 / KB0024066 with their vendor or support contact. Restricted access is interim containment, not proof of repair. Exact patch installation and restart requirements could not be verified.

Evidence: BeyondTrust-authored record, published October 15; CISA KEV. This is the same appliance issue discussed in news item 2.

CVE-2026-112403 — JPEG thumbnails can reach native memory corruption

• Versions: Vendor-listed affected versions are ≤ 12.3.0, fixed in 13.0.0. The public vendor advisory dates to October 17, even though the aggregated advisory-database entry was published on October 20; database ingestion is not a second disclosure.
• Prerequisites: An attacker-controlled lossless JPEG reaches scaled decoding through draft() or thumbnail(), with a lossless-capable linked library. The advisory identifies libjpeg-turbo ≥ 3.0, including official wheels, as supporting that path. Builds using libjpeg-turbo 2.x or IJG libjpeg reject the relevant lossless input before it reaches the overflow.
• Impact and evidence: Decoded rows can overrun a heap buffer sized for a smaller image. The public report demonstrates memory corruption, not confirmed exploitation in production or a demonstrated complete code-execution chain. The vendor labels the issue High; no vendor numerical score is asserted here.
• Remediation: Upgrade to 13.0.0. Pending that upgrade, the advisory documents loading before thumbnailing or using reducing_gap=None to avoid this particular path. Those are path-specific mitigations, not fixes for Pillow’s other vulnerabilities.
• Priority: High for services thumbnailing untrusted uploads with the affected library combination. Determine actual build linkage before treating every Pillow installation as equally exposed.

Sources: vendor advisory and mitigations; aggregated publication metadata; 13.0.0 release. Public reproducer available; not listed in the checked KEV snapshot. News item 4 provides the shared rollout context.

CVE-2026-112393 — in-memory TIFF saving can corrupt and disclose memory

• Versions: The vendor lists ≤ 12.3.0 as affected and 13.0.0 as patched. Its advisory was published on October 17; the aggregated database’s October 21 publication date is later ingestion, not a new incident.
• Prerequisites: A service accepts attacker-influenced images or metadata and re-encodes them as TIFF through libtiff into a stream without a usable fileno(), such as io.BytesIO. The report shows the vulnerable sequence with default save settings; an output stream, not just the input extension, determines exposure.
• Impact and evidence: Incorrect allocation sizing permits a heap overflow, and uninitialized output gaps can disclose process memory. A public reproducer demonstrates a crash and leakage; code execution is not demonstrated. The vendor labels the issue High.
• Remediation: Upgrade to 13.0.0. Real-file output is unaffected by this particular memory-sink defect, but changing output handling is only a temporary path-specific mitigation and introduces storage, cleanup, and access-control responsibilities.
• Priority: High for reachable image-to-TIFF services. Teams not using TIFF output should still deploy the shared Pillow update for applicable issues, without claiming this exact path exists in every application.

Sources: vendor advisory; aggregated publication metadata; 13.0.0 release. Public reproducer available; not listed in the checked KEV snapshot. No authoritative confirmation of wild exploitation was found in the reviewed sources.

🔧 Basic Security Tool of the Week

Gitleaks — local secret-pattern detection. Developers and repository owners can use it to find likely credentials in files or Git history before those credentials spread. This is a different category from last week’s govulncheck dependency analysis. Gitleaks is a free, MIT-licensed CLI; local scans require no account. Official documentation; license.

Maintenance check: The latest listed release checked was v8.30.1, March 21, 2026 UTC. The repository’s latest visible commit-feed activity was July 22, 2026 UTC, including build-dependency maintenance. Its current README states that future releases are for security patches rather than new features. This is a maintenance-mode tool, not a claim of a new release this week. Release; official activity feed; maintenance notice.

Installation: On macOS with Homebrew already installed, the documented command is:

brew install gitleaks

Other supported platforms have binaries on the official releases page. No administrator privileges, remote-script piping, or cloud account are needed for the following scan.

One safe example: Create a fresh local fixture containing no credentials, then scan only that directory:

demo_dir="$(mktemp -d)"
printf 'service_name = "local-demo"\n' > "$demo_dir/settings.txt"
gitleaks dir --redact --no-banner "$demo_dir"

The dir command and flags are verified against the v8.30.1 documentation; this example was documentation-verified, not executed. A successful scan of this benign fixture should exit 0 with no findings. The documented default exit code for detected leaks is 1; inspect error output as well, rather than treating every nonzero exit as a confirmed credential.

Interpretation and limits: Findings are pattern matches, not proof that a credential is valid. A clean result means no configured rule matched the scanned content, not that the project is secure. Directory mode does not cover deleted Git-history secrets. Redaction reduces accidental disclosure in output; do not paste real findings into public tickets. If a real exposed credential is confirmed, revoke or rotate it—deleting the file alone does not invalidate it. This local fixture neither scans third-party assets nor validates credentials against external services. Command behavior and limitations.

💡 Security Tip of the Day

Today’s tip: Spend 5–10 minutes checking the certifi version and bundle path inside one deployed Python application’s actual runtime, not just on its host.

Why: The trust-store story above concerns bundled roots. A patched host can still run an older virtual environment or image.

Apply: In an authorized local runtime or an existing approved application shell, use its Python interpreter:

python -c 'import certifi; print(certifi.__version__); print(certifi.where())'

The version attribute and bundle-path function are verified in certifi’s package initialization and official usage documentation; this command was not executed here. Record whether the deployed copy meets the recommended 2026.10.19 version and whether its path belongs to the intended environment. A missing module means certifi was not found by that interpreter; it does not prove the application uses a safe trust store.

Verify and operational impact: Check the application’s configuration for system/custom trust-store overrides before concluding that the printed default is its effective bundle. The inspection is read-only and does not establish which bundle an already-running process has cached. If remediation is needed, rebuild and restart through the normal rollout process, then repeat the check. Changing trusted roots can break connections to affected certificate chains; handle those failures without turning certificate verification off. Trust-store alternatives and caveats.

✅ Security Actions for This Week

1. Emergency — PHP platform and hosting owners: Inventory web-facing PHP runtimes, including mod_php, FPM, containers, appliances, and vendor-embedded copies. Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor backports; apply PHP’s partial mitigations only as a bridge, and plan an upgrade path off end-of-life branches.
2. Emergency — Remote Support owners: Identify affected appliances, obtain verified BT26-05 remediation, and confirm installation with the vendor. Follow applicable forensic-triage guidance; do not close the issue based on an assumed fixed version.
3. High — Python platform/build owners: Roll out uv ≥ 0.13.4 and updated certifi bundles, preferably 2026.10.19 or later, including embedded images. Use today’s runtime check to catch stale copies and review alternative trust stores.
4. High — Image-service owners: Upgrade to Pillow 13.0.0, prioritize reachable JPEG-thumbnail and in-memory TIFF paths, and verify replacement workers with representative benign images. Temporary path avoidance does not replace the update.
5. Medium — Repository owners: Try the isolated Gitleaks fixture, then consider an authorized project scan with redacted output and a private findings workflow. A clean result is not a reason to relax credential handling.

Sources

• PHP security advisory: critical RCE vulnerabilities, update now
• PHP 8.5.12 release announcement
• php-src: CVE-2026-109618, GHSA-w8hw-w9fx-j79w
• php-src: CVE-2026-109619, GHSA-6wmf-4rv5-p3rp
• NCSC-NL php2shell operational tracker
• Qualys PHP2Shell exposure analysis
• Cloudflare attack-traffic and WAF report
• BeyondTrust-authored CVE-2026-102764 record, including CISA enrichment
• CISA’s official KEV catalog mirror
• BeyondTrust BT26-05 — remediation reference; inaccessible during research
• BeyondTrust KB0024066 — remediation reference; inaccessible during research
• certifi: removal of emSign roots, GHSA-6q48-6c7w-9gw2
• certifi 2026.10.19 release
• certifi 2026.10.19 documentation
• certifi 2026.10.19 package initialization
• uv: emSign root removal, GHSA-hq85-5cpj-mr62
• Pillow 13.0.0 release
• Pillow JPEG decoder, GHSA-8g5g-8vmr-9782
• JPEG advisory database publication metadata
• Pillow TIFF memory sink, GHSA-332p-7hrc-92wf
• TIFF advisory database publication metadata
• Gitleaks v8.30.1 documentation
• Gitleaks v8.30.1 release
• Gitleaks MIT license
• Gitleaks official commit feed
• Gitleaks maintenance notice