All Articles

TL;DR for CISOs: CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog on October 26 and set an October 29 remediation deadline for federal agencies, three days out. CISA's guidance is blunt: patch now, and take PHP systems offline if you cannot. Navigate360 confirmed a breach exposing Social Security numbers seven months after a public claim, and the University of Copenhagen was attacked twice in six days.

Today's slate at a glance

Lead story: CISA puts PHP2Shell in the KEV catalog with an October 29 deadline

Key facts

What happened

PHP shipped emergency fixes on October 21 for two flaws that let an unauthenticated attacker run code on a web server. Five days later, CISA confirmed exploitation by adding both CVEs to its KEV catalog and updated its October 21 alert to say so. Federal civilian agencies now have until October 29 to remediate.

CISA's guidance goes further than a routine patch notice. It names every common way PHP is served, calls out that PHP is often embedded in other software where it is hard to see, and says systems that cannot be patched should be taken offline. Partner agencies in the UK, Australia, Canada, New Zealand and the Netherlands, along with the NSA, issued parallel guidance.

BOD 26-04, cited in the alert, also sets expectations for checking whether an attacker got in before a patch was applied. The directive binds only federal agencies, but CISA encourages every organization to prioritize KEV entries.

Evidence

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 26)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (revised October 26)
• CISA Known Exploited Vulnerabilities Catalog
• Recorded Future: PHP2Shell exploitation and patch guidance
• ReconBee: CISA confirms active exploitation of two PHP2Shell flaws

What this means for your team

For North American security leaders, the KEV listing changes the conversation with the business. It is now a confirmed-exploitation finding with a public federal deadline, which is the evidence application owners, auditors and boards tend to ask for. Federal contractors and regulated firms should expect customers and examiners to ask where they stood on October 29.

The hard part is coverage, not the patch itself. PHP sits inside CMS platforms, vendor appliances, containers and managed hosting, so an inventory of your own servers will miss some of it. The second hard part is the window before the patch: exploitation attempts began before October 21, so a clean patch status does not prove a clean host.

Action checklist

1. Inventory every PHP runtime by October 29, including PHP embedded in vendor products, containers and hosted sites, and ask suppliers to confirm their patched versions in writing.
2. Patch internet-facing systems first to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's backported fix), and take offline anything that cannot be patched or runs PHP 8.1 or earlier.
3. Deploy CISA's SIGMA rule and hunt for PHP worker processes spawning shells or fetching tools, looking back to at least October 20.
4. Report status to leadership as patched, offline or exception, with a named owner and date for each exception.

Supporting story: Navigate360 confirms a breach seven months after the claim

Key facts

What happened

Seven months after a hacker publicly claimed access to its tip platform, Navigate360 acknowledged that an intruder reached a system and copied months of data. The company has not explained the timing or whether the October acknowledgment covers the same incident as the March claim. The 8 million tip figure comes from the hacker, not the company.

Evidence

• Reuters via KSL: Navigate360 says hackers accessed system
• Insurance Journal: safety company acknowledges hack seven months after breach

What this means for your team

This is a supplier transparency failure with public-sector consequences. Customers who waited for confirmation after the March claim learned the data types only in October, while state officials and police were left asking for answers. When a threat actor claims a breach at a supplier, your own risk clock starts then, not when the supplier confirms.

Action checklist

1. List suppliers holding sensitive data about your people or the public, and confirm each contract sets a notification deadline and a duty to share scope.
2. When a hacker claim about a supplier surfaces, send a written request for status and evidence within days, and log the response.
3. If you use Navigate360 or P3 Global Intel, request written scope, data types and timeline now, and assess your own notification duties.
4. Add a claimed-but-unconfirmed playbook so legal, privacy and communications can act before confirmation arrives.

Supporting story: University of Copenhagen is hit twice in six days

Key facts

What happened

The university disclosed that an attacker reached identity data on about 525,000 people through a test environment, then shut down administrative systems after a second attack three days later. The attack method for either incident has not been disclosed.

Evidence

• BleepingComputer: University of Copenhagen data breach exposes data of 525,000 people
• The Copenhagen Post, October 24: data on 525,000 people compromised
• The Copenhagen Post, October 27: second cyberattack days after the first

What this means for your team

Two lessons apply in any sector. Test environments often hold copies of production identity data with weaker controls, and here that data included national ID numbers. And the exposed PIN codes turned a privacy incident into a physical access problem. A second attack within a week also tests whether your containment claims would hold up with regulators and your board.

Action checklist

1. Find every non-production environment holding real personal data, Social Security numbers or credentials, and replace it with masked or synthetic data.
2. Confirm PINs, badges and access codes are not stored or generated in systems weaker than production.
3. Before closing any incident, require credential rotation, a persistence hunt and log review, and keep the evidence.

Also notable

• Arista VeloCloud Orchestrator (CVE-2026-114625): added to KEV on October 23 with a federal due date of October 26, which has now passed. On-premises builds before 5.2.3.18, 6.1.3.10 or 6.4.2.12 are affected. CISA KEV catalog, Tech Insider
• AB InBev (unconfirmed): the Emperador group claims about 3.9 GB of data and demands $1 million in Bitcoin. The company has not confirmed a breach, so treat this as a claim only. Rescana
• Oracle October Critical Patch Update: 1,209 unique vulnerabilities across 33 product families, including 95 critical CVEs, per Check Point. Check Point Research

Frequently asked questions

What is the KEV deadline for PHP2Shell?

The CISA KEV catalog lists October 29, 2026 for both CVE-2026-109618 and CVE-2026-109619. The deadline binds federal civilian agencies, and CISA encourages all organizations to prioritize KEV entries.

Which PHP versions fix PHP2Shell?

CISA lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check your Linux distribution for backported fixes, since version strings may not change.

What if we cannot patch PHP right away?

CISA says to take PHP-based systems offline until they can be patched, including any running PHP 8.1 or earlier. A web application firewall may offer some protection in the meantime.

Which PHP setups are affected?

CISA says all installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

Is the Navigate360 breach the same one claimed in March?

The company has not said. The March claim and the October acknowledgment may be linked, but Navigate360 has not confirmed that.

How did the attacker get into the University of Copenhagen?

Not disclosed. BleepingComputer reports the attacker reached one of the university's test environments.

Related CISO Platform briefings

• Breach Watch: PHP2Shell critical PHP flaws (October 21)
• Breach Watch: AI agent file hijack, PHP2Shell, Tailscale (October 25)
• Vulnerability management briefings
• Breach Intelligence hub: all daily editions

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.