[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwree6XGsZeImQTEQ0M7DV3CwyMOVXFcBnuJEokfn6iQ":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7d4b4285-e6ff-42d3-994f-417407f49d47","Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw","week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-28611d","Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The project will publish those details, along with the patched version numbers, when the release goes out. … More → The post Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw appeared first on Help Net Security.","Two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been patched by the PHP development team. These flaws allow remote code execution without authentication. Palo Alto Networks has confirmed that its PAN-OS and Panorama products are affected, with no fixed releases yet available. A new open-source scanner has been released to check for these vulnerabilities.","Critical PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F25\u002Fweek-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002F25124832\u002Fcybersecurity-week-review-2-1500.webp","2026-10-25T09:00:56+00:00","2026-10-25T10:00:13.12675+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":19},"Panorama",{"name":23,"type":19},"PHP",{"name":25,"type":26},"Palo Alto Networks","vendor",{"name":28,"type":26},"OpenAI",{"name":30,"type":31},"AI","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":57,"value":61,"context":59},"CVE-2026-109619",[25,28,18],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":54,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[152],{"slug":153,"name":25,"logo_path":154,"roles":155},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"critical-php-rce-flaws-and-exploited-palo-alto-vpn-highlight-patching-urgency","Critical PHP RCE Flaws and Exploited Palo Alto VPN Highlight Patching Urgency","Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated attackers to execute arbitrary code on affected systems, while a separately exploited flaw in Palo Alto's GlobalProtect VPN remains unpatched. The combination of unpatched software and actively exploited network appliances creates a dangerous attack surface for organizations relying on these technologies. Attackers consistently target known, unpatched vulnerabilities because the barrier to exploitation is low once proof-of-concept tools or scanners are publicly available. The absence of a fix for the Palo Alto flaw underscores the risk of depending on vendor timelines without compensating controls in place. These incidents demonstrate that vulnerability management must be proactive, continuous, and paired with interim mitigations when patches are unavailable.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":170,"PCI DSS Requirement 6":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 mandates that essential and important entities implement appropriate technical measures for incident handling and vulnerability management, requiring organizations to have processes to rapidly address critical flaws like those in PHP and PAN-OS.","Requirement 6 mandates the development and maintenance of secure systems by applying security patches promptly, which would require immediate patching of the critical PHP vulnerabilities for any cardholder data environment running affected versions.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes, which would mandate timely application of the PHP patches and interim compensating controls for the unpatched Palo Alto vulnerability.","The PHP RCE vulnerabilities are a textbook example of this risk category, where running outdated or unpatched software components directly enables remote code execution by unauthenticated attackers.","Regular, automated vulnerability scanning and a defined remediation timeline would have ensured that the critical PHP flaws and the Palo Alto VPN vulnerability were identified and prioritized for patching or mitigation before attackers could exploit them.","This control requires organizations to obtain timely information about technical vulnerabilities, assess exposure, and take appropriate action—directly applicable to both the PHP RCE flaws and the actively exploited GlobalProtect VPN flaw.","The unauthenticated nature of the PHP RCE flaws and the exploited GlobalProtect VPN vulnerability highlight the need for layered access controls that could limit exploitation even when software flaws exist, such as restricting exposure of vulnerable services to the internet."]