Weekly roundup, Oct 19–25:
- PHP2Shell CVE-2026-109618/-109619 (CVSS 9.2): fixed 8.5.12/8.4.27/8.3.36/8.2.35; probes since Oct 17. After patching, hunt new .php files in upload/cache dirs and PHP_SESSION_UPLOAD_PROGRESS POSTs
- KEV: Arista VCO CVE-2026-114625, Collabora CVE-2026-110447
- Node2Shell CVE-2026-111497: Node 22.23.4/24.22.1/26.12.1
- Okta lookalikes: riskified-okta[.]com, gladly-okta[.]com
https://tp-security.com/news/weekly-roundup-2026-10-25-php2shell-edge-flaws
#InfoSec #PatchNow #BlueTeam #Phishing
Touchpoint SecurityPHP2Shell, Exploited Edge Flaws and a Wave of AI-Infrastructure Compromises: The Week in CyberPHP2Shell patches, exploited Arista and Collabora flaws, Node.js Brotli RCE, Quest and Capcom breaches, ConnectWise attacks and Okta lookalike domains.