Critical Vulnerabilities in PHP Require Immediate Patching
2026-10-21T17:24:05Z•beb1ac21895d13fc22582d6024ed2b69c68b50f907399452aa86c40d726fd525
CVE-2025-61624CVE-2026-0322CVE-2026-102764CVE-2026-104935CVE-2026-105133CVE-2026-105134CVE-2026-106931CVE-2026-109618CVE-2026-109619CVE-2026-110936CVE-2026-21589CVE-2026-76519CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656AhsayCBSAtlassianBeyondTrust Remote SupportCISACisco Secure Email GatewayFortinetIvanti Connect SecureKEVPHPPalo Alto PAN-OSPlex Media ServerSiemens Software Centeractive exploitationauthentication bypasscommand injectioncritical vulnerabilitiesincident responseinternet-facing systemsknown exploited vulnerabilitiespatchingpath traversalremote code executionserver-side request forgery
What happened
CISA reports multiple critical and actively exploited vulnerabilities requiring immediate remediation. Key risks include unauthenticated remote code execution in PHP (“php2shell”), authentication bypass and remote command execution in BeyondTrust Remote Support and Ivanti Connect Secure, plus newly added KEV entries affecting Plex Media Server, Fortinet, Atlassian, Palo Alto PAN-OS, Cisco Secure Email Gateway, AhsayCBS, EG Secure Solutions SiteGuard, and Siemens Software Center. Organizations should prioritize internet-facing systems, apply vendor patches, restrict administrative access, take-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- beb1ac21895d13fc22582d6024ed2b69c68b50f907399452aa86c40d726fd525
- Enrichment time
- 2026-10-21T17:24:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.