Cybersecurity Threat Digest — October 22, 2026

Top Stories#

• PHP released emergency patches for two critical PHP2Shell vulnerabilities. The flaws can enable remote code execution on affected PHP deployments. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. See the PHP security advisory coverage and CISA’s alert.

• CISA warned of active Plex2Shell attacks. Attackers are chaining four Plex Media Server vulnerabilities to breach exposed servers. Organizations should identify internet-facing Plex instances, restrict administrative access, apply available fixes, and investigate for post-exploitation activity. BleepingComputer reports on CISA’s warning.

• ClickFix campaigns are accelerating. Criminals are using fake AI installers, malicious search results, and trusted chatbot platforms to persuade users to execute commands. The technique turns social engineering into user-assisted malware execution. BleepingComputer’s ClickFix report provides additional campaign context.

• Google Chrome is adding Gemini-powered scam detection. The browser will warn users about deceptive websites and suspicious commands associated with ClickFix-style attacks. Browser protections can reduce exposure, but they do not replace endpoint controls and user training. BleepingComputer’s coverage describes the new protections.

• Japan’s Onamae Desktop Cloud was compromised. Malware was installed on as many as 26,739 customer servers after attackers compromised the service infrastructure. Organizations using affected hosted environments should review provider communications, validate server integrity, and investigate unexpected changes. BleepingComputer’s report contains the reported scope.

• Lazarus-linked operators are using post-quantum cryptography for malware delivery. The technique is intended to protect malicious payload delivery and shows why defenders should monitor delivery infrastructure and execution behavior rather than rely on conventional cryptographic assumptions. See BleepingComputer’s analysis.

• Internet-facing infrastructure teams are under increasing pressure. Organizations worldwide are being urged to protect websites and exposed services. The Google News report reflects the urgency around website and service protection.

Analyst’s Take: The immediate priority is exposure, not headline count: patch internet-facing PHP and Plex systems, then investigate for the web shells, unusual processes, and authentication activity described below. ClickFix requires a different control path, because the user is being persuaded to launch the command; browser warnings alone will not replace endpoint restrictions and monitoring.

Critical Vulnerabilities#

PHP remote-code-execution flaws

• CVE-2026-109618 — CVSS 9.8: PHP memory handling under out-of-memory conditions can leave request memory uninitialized, potentially enabling remote code execution (RCE). CISA advises immediate patching. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. References: PHP advisory and CISA alert. See our RCE glossary.

• CVE-2026-109619 — CVSS 9.8: PHP request-global state can retain references to freed request memory, potentially enabling remote code execution. Fixed versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. References: PHP advisory and CISA alert.

WordPress plugin upload vulnerabilities

• CVE-2026-111832 — CVSS 10.0: WP Mailster versions through 1.9.1.0 allow unrestricted uploads of dangerous file types. An attacker may use the weakness to upload a web shell to the server. See the Patchstack advisory.

• CVE-2026-111834 — CVSS 9.9: Mang Board WP versions through 2.4.4 allow unrestricted uploads of dangerous file types and potential web-shell deployment. See the Patchstack advisory.

Lagoon SSH authorization flaw

• CVE-2026-113788 — CVSS 9.4: Lagoon’s SSH service permits authenticated attackers to execute arbitrary code and potentially obtain elevated administrative privileges. Upgrade to Lagoon v2.33.2 and lagoon-core Helm chart v1.62.2. References: Lagoon release v2.33.2 and security advisory.

The supplied vulnerability data does not identify these CVEs as being in CISA’s Known Exploited Vulnerabilities catalog. That status should not be treated as evidence that exploitation is unlikely, particularly for internet-facing PHP, WordPress, Plex, and infrastructure-management systems.

What Defenders Should Do Today#

1. Patch every internet-facing PHP deployment immediately. Inventory PHP versions across web servers, containers, application platforms, and managed hosting. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as appropriate, then restart relevant services and verify the running version.

2. Find and isolate exposed Plex Media Server instances. Identify servers reachable from the internet, restrict administrative interfaces to trusted networks or VPN access, apply vendor fixes, and review authentication and process activity for signs of Plex2Shell exploitation.

3. Patch or remove vulnerable WordPress plugins. Update WP Mailster and Mang Board WP beyond the affected versions where fixes are available. If patching cannot be completed, disable the plugins and temporarily restrict file uploads. Do not assume that removing an uploaded web shell alone restores trust.

4. Review web-server and PHP logs for exploitation indicators. Look for unexpected uploads, executable files in media or temporary directories, unusual POST requests, repeated errors, child processes launched by PHP workers, and outbound connections from web servers.

5. Upgrade Lagoon components. Move Lagoon to v2.33.2 and the lagoon-core Helm chart to v1.62.2. Review authenticated SSH sessions, command execution, role changes, newly created credentials, and changes to cluster or deployment configuration.

6. Harden endpoints against ClickFix. Block unauthorized use of PowerShell, Windows Command Shell, AppleScript, shell interpreters, and other scripting tools where operationally possible. Endpoint protection such as Malwarebytes can complement these controls. Monitor for commands launched immediately after browser or office activity and for suspicious clipboard-to-shell behavior.

7. Control software and AI-tool downloads. Require users to obtain software from approved vendor channels. Treat instructions to paste commands into a terminal, Run dialog, PowerShell, or shell as a high-risk behavior, even when the instruction appears on a trusted website or chatbot.

8. Investigate managed and shared hosting environments. For systems connected to Onamae Desktop Cloud or other shared infrastructure, compare current files, processes, scheduled tasks, credentials, and network connections with known-good baselines.

9. Preserve evidence before rebuilding. Capture relevant logs, process listings, disk images, cloud audit records, and network telemetry before remediation when compromise is suspected. Rebuild only after identifying persistence mechanisms and rotating exposed credentials.

10. Prioritize based on exposure and privilege. Address publicly reachable PHP and Plex services first, followed by WordPress systems with upload functionality and management platforms with administrative access.

Technical Notes#

Verify PHP versions and process exposure

Run version checks on hosts and inside application containers:

php -v
php -r 'echo PHP_VERSION, PHP_EOL;'
docker ps --format '{{.Names}}\t{{.Image}}' | grep -i php
kubectl get pods -A -o wide | grep -i php

Confirm that the upgraded version is the version actually used by the web service. CLI output alone may not reflect the PHP-FPM or application-container version:

ps aux | grep -E '[p]hp-fpm|[p]hp-cgi'
systemctl status php*-fpm --no-pager

After patching, restart the applicable service according to the operating system and deployment model, then validate application health and error rates.

Review web and PHP logs

Search common log locations for suspicious upload activity, command execution, and unexpected HTTP behavior:

sudo grep -RniE \
  'POST|multipart|upload|shell|cmd=|exec|system\(|passthru|base64|/tmp/' \
  /var/log/nginx /var/log/apache2 /var/log/php* 2>/dev/null

Look for combinations of indicators rather than relying on one string. High-value patterns include:

• Upload requests followed by requests for a newly created executable file.
• PHP workers spawning shells, interpreters, download tools, or archive utilities.
• Web-server processes making unexpected outbound connections.
• Requests to unusual paths under upload, cache, temporary, or plugin directories.
• Repeated HTTP 500 responses followed by authentication or privilege changes.

Find recently modified executable files

Use a bounded search to identify files changed recently under web roots and temporary directories:

sudo find /var/www /tmp /var/tmp \
  -type f -mtime -3 \
  \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' -o -perm /111 \) \
  -ls 2>/dev/null

Treat findings as leads for investigation. Some legitimate applications create files dynamically, so compare results with deployment records and known-good file inventories.

Restrict upload execution

Where the application does not require executable content in upload directories, configure the web server to prevent script execution. The exact syntax depends on the server and deployment, but the control objective is consistent:

Uploads:
  allow static content only
  deny PHP and other server-side script execution
  restrict write access to the application account
  store uploads outside the web root when practical

Apply and test configuration changes in staging before production. Blocking execution in upload directories reduces the impact of file-upload flaws but does not replace plugin patching.

Detect suspicious child processes

Use host telemetry or endpoint detection to alert when web processes launch shells or download tools:

Parent process:
  php-fpm
  apache2
  httpd
  nginx

High-risk child process examples:
  /bin/sh
  /bin/bash
  powershell.exe
  cmd.exe
  curl
  wget
  certutil
  python
  perl

Correlate process events with the originating web request, account, destination address, and file changes. Preserve timestamps in UTC to align host, web, cloud, and network logs.

Review Lagoon and SSH activity

Prioritize authenticated SSH events around unexpected deployments, privilege changes, or administrative actions:

sudo journalctl -u ssh --since "2026-10-20" --no-pager
sudo grep -Ei 'Accepted|Failed|sudo|session opened|session closed|useradd|usermod' \
  /var/log/auth.log /var/log/secure 2>/dev/null

For Kubernetes-backed Lagoon environments, also review audit logs for changes to deployments, secrets, service accounts, roles, and cluster bindings. Rotate credentials if unauthorized access cannot be ruled out.

Reduce ClickFix execution paths

Use application control, endpoint policy, and browser security controls to limit unapproved script execution. Example policy objectives include:

- Deny unsigned scripts from user-writable directories.
- Alert when a browser launches a shell or scripting interpreter.
- Restrict clipboard-to-terminal workflows on managed endpoints.
- Block execution from Downloads, Temp, and browser cache paths where practical.
- Require approved software distribution channels.

These controls should be tuned against legitimate administrative workflows. The goal is to make a user pasting a command from a deceptive page visible and difficult, not merely to display another warning.

Sources

• PHP emergency patch coverage
• CISA alert on critical PHP vulnerabilities
• CISA warning on Plex2Shell exploitation
• ClickFix campaign activity
• Chrome Gemini-powered scam detection
• Onamae Desktop Cloud compromise
• Lazarus payload-delivery cryptography
• WP Mailster vulnerability
• Mang Board WP vulnerability
• Lagoon v2.33.2 release

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.