Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
2026-10-26T20:51:32Z•ed49cd357196f86546021ec1a1a2f1268087b29560d41654e17faf9101e70033
CVE-2024-47575CVE-2026-0257CVE-2026-109618CVE-2026-109619CVE-2026-88771CVE-2026-88772AI-assisted-cybercrimeAI-espionageFortiGateFortiManagerKubernetesLinuxNetScalerOAuthPAN-OSPEERSTITCHPHPRBACTLS-certificate-compromiseactive-exploitationcloud-securitycredential-abuseeMudhrainitial-accessman-in-the-middlephishingransomwaresupply-chain-attackersummer?vulnerabilityweb-shellzero-day
What happened
Unit 42 reporting covers critical and actively exploited vulnerabilities in PHP, PAN-OS and NetScaler, compromised eMudhra certificate authorities, OAuth and initial-access threats, AI-assisted cybercrime and espionage, firewall implants, cloud and Kubernetes supply-chain risks, and campaigns targeting critical infrastructure. The most urgent items are in-the-wild exploitation of PAN-OS CVE-2026-0257 and NetScaler CVE-2026-88771/CVE-2026-88772, alongside the FortiGate-related PEERSTITCH intrusion exploiting CVE-2024-47575.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- ed49cd357196f86546021ec1a1a2f1268087b29560d41654e17faf9101e70033
- Enrichment time
- 2026-10-26T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.