Security Roundup October 2026: PHP2Shell, a Wave of VPN Zero-Days and Breached VPS Platforms

October 2026 was the busiest month of the year. Almost every major VPN and firewall brand had an exploited zero-day, Microsoft broke its Patch Tuesday record again, and PHP, the language behind most websites and hosting panels, shipped emergency patches. In Asia a Japanese VPS platform was breached, and in Indonesia millions of Fore Coffee customer accounts were exposed.

Here is what matters most for businesses and server operators in Indonesia.

This month’s priorities

Product	Flaw	Status	Action
PHP	CVE-2026-109618, CVE-2026-109619	Exploited, unauthenticated code execution	Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
Linux kernel	CVE-2026-46300	Chained with PHP2Shell to gain root	Update the kernel and reboot
Windows	CVE-2026-96951	Exploited zero-day	Install the October updates
Ivanti Connect Secure	CVE-2026-104935	Zero-day, fully patched appliances breached	Emergency update and compromise hunt
Palo Alto PAN-OS	CVE-2026-0322	Exploited	Update, restrict the management interface
Fortinet FortiOS	CVE-2025-61624	Exploited alongside the PEERSTITCH implant	Update per FG-IR-26-122
Cisco ASA/FTD	CVE-2026-76418	Zero-day used to reboot firewalls	Update

PHP2Shell: emergency patches for almost every PHP server

On 21 October PHP released emergency patches for two unauthenticated remote code execution flaws named PHP2Shell:

• CVE-2026-109618: memory corruption when memory runs out, leading to code execution as the web server account.
• CVE-2026-109619: stale global state that triggers a use-after-free, memory disclosure and code execution.

Every PHP installation that serves web requests is affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The highest risk is mod_php, where the attack can fire before any application code runs. Both flaws are rated CVSS v4 9.2.

Latest developments (as of 1 November):

• 17 October, four days before the patch, Amazon saw exploitation attempts against its honeypots. Amazon now reports broad exploitation attempts in the wild.
• 24 October, a researcher reported honeypots running PHP 8.4.26 being successfully exploited.
• 26 October, CISA added both flaws to the KEV catalog. Trail of Bits said exploits work against pre-patch PHP 8.2 to 8.5, with demos against MediaWiki, Symfony, Laravel and phpBB.
• Cloudflare said attacks were already emerging when the patches shipped, and the UK NCSC told organisations to take unpatched servers offline.

In short, an unpatched PHP server should now be treated as likely to be breached, not merely vulnerable.

Then on 28 October CISA added the Linux kernel flaw CVE-2026-46300 (CVSS 7.8) to the KEV catalog. It is being used together with PHP2Shell: after getting in through PHP, attackers use the kernel flaw to gain root and plant web shells.

Action:

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Minimal backports exist for PHP 7.4, 8.0 and 8.1, but you should move to a supported version soon.
2. Restart PHP-FPM or the web server after updating. Updated packages do not patch PHP processes that are already running.
3. If a server was exposed without the patch at any point since 17 October, look for web shells and new PHP files in web directories, unknown accounts and cron jobs, and suspicious outbound connections.
4. Update the kernel to a fixed version (for example 6.1.174, 6.6.141, 6.12.91 or 6.18.33) and reboot.
5. If you cannot update yet, interim mitigations are to set session.upload_progress.enabled=0 and lower post_max_size. They reduce the risk but are not full protection.

Hosting panels such as cPanel and Plesk usually ship PHP through their own packages. Make sure the panel’s PHP packages have been updated too.

October Patch Tuesday: 1,413 CVEs

Microsoft fixed 1,413 CVEs on 14 October, the largest Patch Tuesday ever, beating September’s record. One zero-day was already exploited: CVE-2026-96951 (CVSS 8.8), a Mark of the Web bypass in Windows Shell that requires the victim to open a malicious file.

Action: install the October cumulative updates and remind users not to open unexpected attachments or links. If you still run Windows 10, also read our explainer on Windows 10 ESU.

A wave of VPN and firewall zero-days

Almost every week in October a VPN gateway or firewall came under attack:

• Ivanti Connect Secure, CVE-2026-104935 (CVSS 8.6). Volexity found attackers breaching fully patched appliances from 3 October, then stealing Active Directory credentials, LAPS passwords and BitLocker keys. Ivanti’s integrity checker does not detect this chain. Fixed in 25.1.1.2, 25.1.3.1 and 22.8R2.5. Two more flaws were added to KEV on 30 October, fixed in 25.1.1.3 and 22.8R2.6.
• Palo Alto PAN-OS, CVE-2026-0322 (CVSS 8.6). Code execution as root through the management interface. There is no workaround, so restrict the management interface to internal IPs.
• Fortinet FortiOS, CVE-2025-61624. Unit 42 reported a group that breached a telecom service provider, stole the configurations of more than 500 FortiGates, then deployed the memory-resident PEERSTITCH implant. Update per advisory FG-IR-26-122, patch FortiManager, and look for unknown admin accounts.
• Cisco ASA/FTD, CVE-2026-76418 (CVSS 8.6). An unauthenticated request to the SSL VPN can reboot the firewall. It affects devices with SSL VPN and secondary authentication.
• Citrix NetScaler, CVE-2026-88779. A SAML flaw used to crash appliances, patched on 3 October. If you already updated for the September zero-days, update again if you use SAML.
• Cisco Secure Email Gateway, CVE-2026-76519 (CVSS 9.8). A crafted email attachment can lead to command execution as root.

The main lesson: firewall and VPN management interfaces must never be exposed to the internet, and edge devices need a patch schedule as fast as your servers.

Backup and virtualization

• AhsayCBS, CVE-2026-105133 and CVE-2026-105134. This backup console, widely used by MSPs, was breached to plant web shells and crypto miners. The first fixes were incomplete; use v10.3.4.45 or v9.15.2.70. One breached console can reach every customer it manages.
• VMware ESX, CVE-2026-41709. A logging flaw (CVSS 2.7) used by a China-linked group to hide admin activity. Added to KEV on 28 October.
• On-premises SharePoint. The Warlock ransomware group is still breaching SharePoint through the 2025 ToolShell flaws. Victims include a water utility and a telecom operator.

Asia: cloud and VPS platforms breached

• IDC Frontier (Japan), 7 October. A ransomware attack stopped the virtual servers of 495 companies and local governments, and recovery was only possible from customers’ own backups. We covered it in Lessons from the IDC Frontier Attack.
• GMO Onamae.com Desktop Cloud (Japan), 19–27 October. A Windows VPS service for MetaTrader trading was breached. Up to 26,739 servers are in scope, malicious programs were planted in customer server environments, and data was stolen. The attacker demanded about USD 50 million; GMO refused and will not restart the platform in its current form. Reports differ on whether ransomware was activated.

Both cases point to the same risk: when your provider is attacked, a backup you keep somewhere separate is your only guarantee.

Indonesia: the Fore Coffee breach

On 28 October PT Fore Kopi Indonesia Tbk disclosed unauthorised access to its customer data platform, affecting about 5.7 million accounts. Exposed data includes names, email addresses, phone numbers, dates of birth, gender, in-app addresses, hashed PINs and purchase history. Fore said it never collected national ID (NIK) numbers and that payment card data sits on a separate platform. It reported the incident to Komdigi and added two-step verification for logins from new devices.

If you are a Fore customer, change your PIN, especially if you reuse it elsewhere, and watch for phishing by phone, SMS, email or WhatsApp.

For businesses, this is a real-world example of the notification duty under Indonesia’s Personal Data Protection Law. See how to prepare in our PP 33/2026 guide. On the regulatory side, Komdigi also pushed for data minimisation in the draft Population Administration Bill on 28 October.

Microsoft 365: password spraying

On 8 October the FBI, CISA and several international agencies published advisory AA26-281A on password spraying against Exchange and Microsoft 365. We cover the advisory and a protection checklist in a separate article.

DDoS: Indonesia among the three most-attacked countries

Cloudflare’s DDoS report for Q3 2026 (29 October) found:

• 18.2 million network-layer attacks, about 8,226 per hour.
• 96% of attacks lasted under 10 minutes, and 98% stayed under 1 Gbps.
• Attacks above 1 Tbps fell from 805 to 251, which Cloudflare links to the takedown of four IoT botnets.
• DNS amplification rose 215%.
• Indonesia rose into the top three most-attacked locations, with 2.93% of all attacks.

In the first half of the year Indonesia was one of the largest sources of attacks; now it is also one of the main targets. Short, frequent attacks make automatic protection more important than peak capacity.

End of the month: GitLab

On 29–30 October CISA added the GitLab flaw CVE-2026-97229 to the KEV catalog. This integer overflow in the CI/CD regex compiler (CVSS 10.0) allows unauthenticated code execution. Alpine Linux reported exploitation attempts against its own GitLab instance between 20 and 26 October; it found no evidence of success but rebuilt the server anyway. It is fixed in GitLab CE/EE 19.4.2, 19.3.5 and 19.2.8. If you self-host GitLab, update now.

Quick checklist

1. Update PHP and the Linux kernel, then restart services and reboot.
2. Install October Patch Tuesday.
3. Update any Ivanti, Palo Alto, Fortinet, Cisco and Citrix devices, and close management interfaces to the internet.
4. Update AhsayCBS, ESXi, SharePoint and GitLab if you use them.
5. Make sure you have a backup outside your main provider and test restores.
6. Prepare a 3 x 24-hour incident notification procedure under the PDP Law.

How Cloudku can help

The IDC Frontier and GMO cases show that any provider can be attacked. Cloudku Cyber Protection keeps backups separate from your servers, with anti-malware protection, so recovery does not depend on a single provider. For DDoS attacks, which now increasingly target Indonesia, Cloudku DDoS Protection filters traffic automatically through filtering nodes in Indonesia.

We will publish the November 2026 roundup at the end of the month.