PHP shipped an out-of-cycle patch on October 21 for two chained memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619, after exploit details leaked ahead of coordinated disclosure. The flaws sit in the PHP engine itself, not in any application built on top of it, which means Magento, Shopware, WooCommerce and every other PHP-based storefront or CMS is exposed regardless of how carefully the application layer was written. Researchers are calling the pair PHP2Shell, and the number attached to it, roughly 70 percent of public websites run some version of PHP, is the reason CISA issued a same-day alert instead of waiting for its usual KEV cadence. This is not patch-cycle inventory. It is the kind of flaw that erases a defensive assumption most teams did not know they were relying on.

That assumption is simple: if your code is clean, you’re fine. PHP2Shell breaks it because the vulnerable surface is the interpreter underneath the code, not anything a developer wrote or a WAF rule could reasonably anticipate. Watchtowr and other researchers who pushed back on early mitigation advice this week confirmed there is no reliable workaround before patching; the suggested configuration tweak that circulated Tuesday does not fully close the path. The fix lands in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and every version outside that supported set has no patch at all. Given that leaked vulnerability details plus a 70-percent install base is close to the worst-case combination for mass scanning, the expected timeline from leak to internet-wide exploitation attempts is hours, not days.

Analysis

What makes PHP2Shell worth a full section rather than a bullet point is where it sits in the stack. Security programs spend most of their detection and prevention budget at the application and network edge: WAFs, input validation libraries, dependency scanning, SAST and DAST tooling aimed at the code teams actually write. A flaw in the language runtime sidesteps nearly all of it. The same logic explains why this week’s other two zero-days matter together rather than separately: Citrix’s NetScaler SAML denial-of-service bug (CVE-2026-88779) and Fortinet’s FortiMail unauthenticated arbitrary file write flaw (CVE-2026-104286, CVSS 9.8) are both in actively exploited internet-facing gateway products, not in whatever those gateways were deployed to protect. As flagged in last week’s report, Ivanti’s Connect Secure chain showed root-level compromise surviving a full patch cycle on an edge appliance. This week extends the same pattern to Citrix and Fortinet, and PHP2Shell extends it one layer deeper, into the runtime every PHP application depends on without exception.

The GitLab disclosure this week is the quieter version of the same story. CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution flaw reachable through a crafted CI/CD regex configuration, has existed in every self-managed GitLab release since version 7.0, meaning twelve years of exposure that nobody found until now. No login required, maximum severity, over a decade unnoticed. That is not a failure of any one organization’s patch discipline; it is a reminder that the inventory of “foundational software everyone assumes is safe because it’s been running for years” is larger and less audited than most risk models account for. Between PHP2Shell, the GitLab RCE, and the LiteLLM supply chain compromise (more below), three of this week’s top developments are flaws or compromises in infrastructure that sits beneath or around the applications security teams actually monitor.

The LiteLLM incident deserves its own line because it is not a disclosed vulnerability, it is an executed attack. On October 21, attackers who had obtained GitHub CLI OAuth tokens from an exposed internal LiteLLM deployment used them to hijack the project’s own release pipeline, pushing a malicious version 1.107.0 to PyPI and Docker Hub for roughly two hours. The compiled payload shipped sixteen collection modules targeting AWS, Azure, GCP, Kubernetes, SSH keys, browser credential stores and developer configuration files, against a package with 23 million weekly downloads. Anyone who pulled that release should treat every credential on the affected host, cloud and local, as burned and rotate accordingly. The mechanism, a leaked CI/CD token turned into a supply chain weapon, is the same category of risk CISA’s new BOD 26-04 was written to address: identity and automation infrastructure is now a first-class attack surface, not a convenience layer.

Escalations from Monday

Monday’s report covered the ConnectWise and SkyKick tenant breach without a named actor: a stolen Microsoft Entra client assertion gave attackers MFA-free entry into 173 customer Microsoft 365 tenants. Microsoft closed that gap on October 21, attributing the campaign to Storm-0940 and disclosing that the group used ARTEX, a Go-based agentic AI penetration testing framework, to automate discovery and abuse of the compromised application identities. The operational numbers Microsoft published are the detail that matters: Storm-0940 reached more than 2,250 tenants at roughly 2,900 sign-in attempts per minute. No human-operated intrusion team runs at that tempo. This is one of the first documented cases of a state-aligned actor using agentic AI not for reconnaissance or phishing content generation, but to operationalize a supply-chain foothold at a scale and speed that outruns the detection windows most tenant-protection programs are built around.

It is also not isolated. A separate October threat-intel writeup, tracking a Chinese-speaking actor’s “global AI-assisted hacking campaign,” describes the same ARTEX framework paired with commercial coding assistants including Claude Code, Codex and Grok, initially aimed at South Korean financial institutions before expanding scope. Taken together with Storm-0940, the picture is a toolkit, not a one-off: agentic frameworks built for penetration testing are being repurposed as attack orchestration layers, and the thing that used to bottleneck large-scale identity abuse, the number of operators available to drive it, no longer applies. Victim count for ConnectWise has not meaningfully changed since Monday. What changed is that defenders now know the attacker had a machine doing the work a team of intrusion specialists would have needed days to do by hand.

What to watch

Two threads carry the most risk of changing materially before Monday. First, PHP2Shell exploitation volume over the next 72 hours will determine whether this stays a patch-fast story or becomes a mass-compromise story on the scale of past PHP and web-framework incidents; watch for ransomware or webshell activity riding the same chain once initial access brokers finish weaponizing it. Second, the CenterPoint Energy breach notification, 1.6 million confirmed records against a hacker’s claim of nearly 7.5 million, has an unresolved gap that is likely to move in one direction only as more of the claimed dataset gets verified.

Security Unlocked publishes threat intelligence and strategic analysis twice weekly. This mid-week brief covers developments from Monday, October 19, 2026 through Thursday, October 22, 2026.