Finding bugs got cheap. Fixing them is still a calendar event.
PHP2Shell was found by researchers working under OpenAI's Patch the Planet programme, and OpenAI's own Codex Security team reported a Brotli decoder flaw in the same fortnight. Your patch process, meanwhile, probably still waits for the second Tuesday of the month and a change ticket. That mismatch is the story of October, and I think it matters more than any single CVE.
Discovery got cheap
Microsoft's October Patch Tuesday landed at roughly 1,400 vulnerabilities, a record. The exact figure depends on who is counting. BleepingComputer says 1,411 and leaves out 348 flaws fixed earlier in the month. Hackread says 1,413, then cites 1,409 from Action1 and a Qualys breakdown that sums to 1,377. Scope differs between trackers. The order of magnitude does not. BleepingComputer puts the surge down to Microsoft using AI platforms to hunt its own bugs.
That is cheap discovery from the defender's chair: a longer queue and the same number of people. Attackers get the same tools and no change advisory board.
The window opened before the patch
PHP2Shell is two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2. They were found in August, patched on 21 October and put on CISA's Known Exploited Vulnerabilities list on 26 October with a federal deadline of the 29th. I won't retell the saga. The shape of the timeline is the point.
Amazon says the first attempts came four days before the patches. AWS's CISO warned defenders not to treat the disclosure date as the earliest date of exploitation. FIRST's Art Manion makes a related argument: frontier models raise the odds of several people finding the same bug, which weakens the case for long embargoes. Two months of quiet coordination did not stop a leak.
Brotli runs the same pattern smaller. CVE-2026-111497 is a high-severity out-of-bounds write in the decoder, with a public proof of concept. Node.js shipped fixes on 21 October and Microsoft followed with out-of-band .NET updates on 25 October.
Know what you run
You cannot shorten a window on a system you have not found. Start with an inventory of everything that executes PHP and everything that links Brotli, and be honest about the second list.
A shared-library fix only reaches you when the downstream product rebuilds. Microsoft's .NET notes say self-contained and Native AOT apps must be rebuilt, because updating the shared runtime will not replace a decoder linked into your binary. PHP has a sharper edge: the fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and older branches have no official fix.
My own inference, not a reported finding: the box most likely to be forgotten is the appliance with a PHP-backed web console. Vendors that bundle a runtime patch on their own schedule, and the admin interface often sits on a management network that nobody has scanned since the install. I found no public list of affected appliances, so I will name none. Mend's guidance is to include internal tools and admin panels in the inventory, and to rank a private-network panel below an internet-facing mod_php server. Fair, as long as the panel really is private.
Buy hours, then patch, then hunt
When the patch is not available or not deployable today, shrink the exposure. Pull management interfaces off the internet and allow-list the source ranges. Put a WAF rule or virtual patch in front of the application. Restrict outbound connections from PHP processes, because the honeypot attackers tried to reach external servers and a locked egress path breaks that step.
Virtual patching has a ceiling. CrowdStrike says many public proofs of concept only crash the process until adapted to the target, so a signature built on one will miss the adapted version. It is a bridge that buys hours.
Then patch, and then go looking. Exploitation preceded the fix, so a patched host can still be a compromised host. Mend recommends reviewing logs for any system that stayed unpatched after 17 October, including outbound connections from PHP processes. CISA's BOD 26-04 implementation guidance goes further for the most urgent cases: collect evidence before applying critical patches, then analyse for unauthorised access and persistence and write a triage report. Snapshot first where you can. A patch run overwrites the evidence you now need.
Triage by risk, and count what panic costs
BOD 26-04, issued in June, dropped CVSS as the prioritisation input. It asks agencies to weigh four things: whether the asset is publicly reachable, whether the CVE is on KEV, whether an attacker can automate every step, and how much control a successful attack gives. The three-day window between the KEV listing and the 29 October deadline matches the directive's tightest tier, though the PHP2Shell coverage I read did not cite the directive by name.
Now the honest part. PHP2Shell was hard to exploit. PHP itself rates attack complexity as high. It validated code execution for the first flaw against mod_php and reports no complete FPM exploit for it. The honeypot results came from a deliberately favourable single-worker setup, and the researcher who ran it said he did not test reliability elsewhere. ReliaQuest and CrowdStrike reported no successful exploitation in customer environments. Unit 42 withdrew an AI-agent intrusion claim on 25 October because it could not tie the access to these CVEs.
Panic has a price. Government and enterprise sites took themselves offline for emergency fixes, and every urgent change spends attention the next real incident will need. Risk-based triage says yes fast to the internet-facing mod_php server and slower to the private admin panel, with a written reason for each.
My own pipeline carries a tension here. Aikido opens fix PRs for dependency flags, and Safe Chain holds new package versions for 48 hours by default. A security fix published this morning is a new version, so the hold argues against the urgency. An emergency path with a named approver has to exist before the emergency does.
Verdict
Stop measuring yourself by how fast you apply a patch after it exists. Measure the time from first plausible exploitation to your last exposed host being shielded, patched and checked. Discovery will keep getting faster, and nothing on the attacker's side waits for a maintenance window.
Build the inventory this month and write the emergency path down. Rank by reachability and exploitability, with CVSS as one input among several. The teams that do this will treat the next PHP2Shell as a bad Tuesday.
- BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
- The Register: CISA confirms PHP2Shell under attack
- Mend: PHP2Shell, CISA KEV and the PHP runtime
- noze: PHP2Shell, what is confirmed five days on
- Capital & Compute: Who found PHP2Shell
- TechTarget: PHP2Shell disclosure unravels after leaks forced early patch drop
- CSO Online: Node2Shell puts Microsoft and Node.js on Brotli patch duty
- RuntimeWire: OpenAI researchers find remote-code flaw in Brotli
- BleepingComputer: October 2026 Patch Tuesday fixes 1,411 flaws
- Hackread: Microsoft fixes 1,413 vulnerabilities in record October Patch Tuesday
- Inside Privacy: CISA releases BOD on prioritizing security updates based on risk
- Infosecurity Magazine: CISA orders agencies to patch by risk, not severity
No comments:
Post a Comment