# Weekly Threat Roundup: Week 44, 2026

> Weekly Threat Roundup for 26 to 30 October 2026: PHP2Shell reaches EPSS 100% and CISA KEV, a Linux kernel bug chains into it, Dell ships 47 CVEs in one release, and 41,191 DHS staff records go public.

Canonical page: https://www.edgeprotect.io/blog/weekly-threat-roundup-2026-week-44

Weekly Threat Roundup · 30 October 2026 · Leo Thomson, Security Consultant at Precursor Security

---

## The week at a glance

Last week we wrote about three things that had just broken and had not yet been confirmed as exploited. This week the confirmations arrived, one per day.

CISA added both php2shell bugs to the Known Exploited Vulnerabilities catalogue on Monday, the Brotli overflow behind the Node.js issue on Tuesday, and GitLab's regular expression compiler bug on Thursday. The two PHP CVEs now carry an EPSS score of 100%, which is as high as that model goes.

Between 26 and 30 October 2026 the NVD published 2,795 vulnerabilities: 172 critical, 635 high, 849 medium, 120 low and 1,019 not yet scored. That is a third down on last week's volume, and the week was busier for it.

Ransomware leak-site claims kept falling. Groups posted 126 victims across 30 brands, after 159 the previous week and 232 the week before that. Qilin led with 21, ahead of Booba Project on 16, Whitearmor on 11, Everest on 8 and Play on 7. Healthcare and pharmaceuticals took 16 claims, technology and telecommunications 13, and manufacturing 12. The US accounted for 44, Germany 8 and the UK 6.

![This week in numbers](https://www.edgeprotect.io/img/roundups/weekly-threat-roundup-2026-week-44/chart_numbers.png)

## The chain is the story

The single most useful sentence published this week was in a CISA KEV entry rather than a vendor advisory.

CVE-2026-46300 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-46300`) is a missing variable initialisation in the Linux kernel. The shared-fragment marker is not preserved when socket buffers are coalesced, so ESP input processing decrypts shared fragments in place and modifies page-cache-backed data. On its own that reads like a kernel maintenance note with a CVSS in the sevens. CISA's entry states that it can be chained with CVE-2026-109618 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109618`) and CVE-2026-109619 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109619`), the two php2shell flaws, to implant PHP webshells and run commands as root.

So the kernel bug and the PHP bugs belong in the same change window. Patching one and scheduling the other for next month leaves the chain intact.

Two more kernel CVEs from the same family of in-place operations on shared memory moved sharply on EPSS in the same week, which is covered below.

## Exploited in the wild (CISA KEV)

Eight additions, spread across all four working days:

- CVE-2026-109618 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109618`): PHP memory corruption allowing unauthenticated remote code execution, added 26 October 2026.
- CVE-2026-109619 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109619`): PHP stale internal request state allowing unauthenticated remote code execution, added 26 October 2026.
- CVE-2026-111497 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-111497`): Google Brotli unchecked return value, added 27 October 2026.
- CVE-2026-48356 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-48356`): Adobe Commerce and Magento unrestricted upload of a file with a dangerous type, added 27 October 2026.
- CVE-2026-46300 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-46300`): Linux kernel missing initialisation of a variable, added 28 October 2026.
- CVE-2026-41709 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-41709`): Broadcom VMware ESX insufficient logging, added 28 October 2026.
- CVE-2026-97229 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-97229`): GitLab CE and EE integer overflow in the regular expression compiler, added 29 October 2026.
- CVE-2026-76418 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-76418`): Cisco Secure Firewall ASA and FTD NULL pointer dereference causing denial of service, added 29 October 2026.

The VMware ESX entry is worth a second look because it does not fit the usual shape. It is an insufficient logging flaw that lets an actor with admin access perform certain operations without being logged. There is no code execution and no privilege escalation, and it is on KEV anyway, which tells you someone used it to cover their tracks during a real intrusion.

## New vulnerabilities worth a look

The top ten newly published CVEs by EPSS this week were all command injection or authentication bypass, and the largest single batch landed in a backup appliance.

Dell published 47 CVEs in PowerProtect Data Domain in one release, covering the Feature Release, LTS2024, LTS2025 and LTS2026 branches. Seven are critical and 24 are high or above, topping out at CVSS 9.8. Most are OS command injection reachable by a privileged remote user, which sounds reassuring until you remember that backup appliances tend to have a lot of privileged remote users. CVE-2026-86396 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-86396`) (CVSS 8.8) is reachable by a low-privileged one. An attacker who reaches your backup platform removes your recovery option before doing anything else, so this outranks its scores.

Elsewhere:

- CVE-2026-116485 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-116485`) (CVSS 9.8, EPSS 2.4%): an authentication bypass in `danmu_api` before 1.21.7. Where the default TOKEN is still in place and ADMIN_TOKEN is unset, anyone can POST to `/api/env/set` to claim ADMIN_TOKEN, lock the real operators out, and repoint OTHER_SERVER or PROXY_URL for SSRF before triggering a redeployment.
- CVE-2026-116505 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-116505`) (CVSS 9.1, EPSS 2.7%): command injection in the TOTOLINK A950RG device-information handler, reached by manipulating a MAC address in the DHCP lease file. Remotely exploitable without authentication, with a published exploit.
- CVE-2026-112351 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-112351`) (CVSS 8.8, EPSS 2.7%): Sunhillo SureLine before 9.1.5 lets any authenticated web account run commands as root through `networkDiag.cgi`. It works by bypassing the incomplete character denylist that was shipped to fix CVE-2021-36380 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2021-36380`) five years ago, using a URL-encoded newline or an ampersand.
- CVE-2026-116219 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-116219`) (CVSS 7.2, EPSS 2.1%): Dolibarr ERP CRM before 24.0.0 lets authenticated administrators bypass the `restrict_os_commands` allowlist by chaining commands around an allowlisted basename.

The Sunhillo and Dolibarr entries make the same point from different directions. Both are allowlist and denylist bypasses, and both are the second bite at a vulnerability someone had already fixed once.

## Exploit probability movers

Five of the six biggest EPSS movers this week were already on CISA KEV before the score moved:

- CVE-2026-31431 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-31431`) jumped from 3.4% to 98.1%. Linux kernel `algif_aead` reverting to out-of-place AEAD operation, CVSS 7.8. On KEV since 1 May.
- CVE-2026-109619 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109619`) went from 6.0% to 100%. The second php2shell flaw, added to KEV on 26 October.
- CVE-2026-34486 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-34486`) rose from 6.6% to 98.5%. An Apache Tomcat EncryptInterceptor bypass introduced by the fix for an earlier issue, CVSS 7.5. On KEV since 4 August.
- CVE-2026-43500 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-43500`) climbed from 2.6% to 94.1%. Linux kernel rxrpc failing to unshare DATA and RESPONSE packets carrying paged fragments, CVSS 7.8. This one is not on KEV.
- CVE-2026-109618 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-109618`) moved from 11.6% to 100%. The first php2shell flaw, the one watchTowr reproduced.
- CVE-2026-3055 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-3055`) rose from 4.0% to 91.5%. A Citrix NetScaler memory overread when configured as a SAML IdP, CVSS 9.8. On KEV since 30 March.

Look at the three kernel entries together. CVE-2026-31431, CVE-2026-43500 and the KEV-listed CVE-2026-46300 are all the same underlying mistake: operating on socket buffer memory in place when that memory is shared with something else. One of them is documented as part of a root-level chain, and the other two moved into the nineties in the same seven days.

## What the honeypots saw

By attempt volume between 26 and 29 October, Shadowserver's honeypots recorded:

- CVE-2022-40684 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2022-40684`) (Fortinet FortiOS, FortiProxy and FortiSwitchManager): 51,271 attempts.
- CVE-2018-13379 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2018-13379`) (Fortinet FortiOS): 33,972 attempts.
- CVE-2023-35078 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2023-35078`) (Ivanti Endpoint Manager Mobile): 31,095 attempts.
- CVE-2023-20198 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2023-20198`) (Cisco IOS XE): 17,465 attempts.
- CVE-2026-3055 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-3055`) (Citrix NetScaler ADC and Gateway): 16,811 attempts.
- CVE-2022-26134 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2022-26134`) (Atlassian Confluence): 16,285 attempts.
- CVE-2026-23760 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2026-23760`) (SmarterTools SmarterMail): 12,733 attempts.
- CVE-2025-5777 (`hxxps[:]//www[.]edgeprotect[.]io/what-is/CVE-2025-5777`) (Citrix NetScaler): 9,891 attempts.

![Most-attacked vulnerabilities this week](https://www.edgeprotect.io/img/roundups/weekly-threat-roundup-2026-week-44/chart_honeypots.png)

Counted by unique attacking IPs, the leaders were Realtek SDK UPnP on 1,364, Dasan GPON on 1,314, Netgear on 1,256, Huawei HG532 on 1,249, Zyxel D1000 on 1,221 and Cisco IOS XE on 1,088.

Php2shell is absent from both lists. The honeypots logged it on 21 to 23 October, 142 unique IPs across the two CVEs, and have not seen it since, while a 2014 Realtek bug drew nearly ten times that in four days. The honest reading is that honeypot telemetry measures commodity scanning rather than total exposure, so it belongs alongside EPSS and KEV rather than instead of them. A vulnerability at EPSS 100% with no honeypot hits is still a vulnerability at EPSS 100%.

## Software supply chain

Three GitHub Advisory sweeps took down 126 malicious packages this week. Two entries stand out from the typosquat background noise.

The first is a real compromise. The `@camera.ui/camera-ui-nvr-windows-amd64` 1.6.1 release was published through a compromised trusted-publisher workflow, so the malicious build carried the project's genuine provenance. Attestation proves where a package was built, and it says nothing about whether the build pipeline was still under the maintainer's control when it ran. Any policy that treats a valid attestation as a safety signal needs rethinking in light of this one.

The second is a worm. On install, `publish-poc-base` and `publish-poc-test3` publish fabricated `publish-poc-found-*` packages to the registry using the installing developer's own npm token. It is labelled a proof-of-concept, and it is also a complete self-propagation loop. The exposure that matters here is CI runners holding publish credentials, where an install step and a publish token sit in the same environment.

The long tail was the kam193-tracked cluster, which ran all week: `claudeopus*` typosquats on the Anthropic brand carrying a steganographic infostealer with blockchain-based command and control, `trajmetrics` exfiltrating files, `numprint` dropping a RAT from a GitHub Gist, and `h13t0ry-hello-demo` opening a reverse shell at import time. The `@sudobility` XMRig miner also returned in a second wave with a byte-identical `miner.sh` and the same mining pool.

## Elsewhere this week: Icepick

On 28 October, Distributed Denial of Secrets published a dataset called Icepick, given to it by a hacktivist group calling itself the Department of Peace and to the journalist maia arson crimew. It indexes 41,191 Department of Homeland Security employees and contractors, including 21,329 CBP entries and 6,598 ICE entries, and it is searchable. CNBC, Help Net Security and Gizmodo all reported on it the following day.

The dump holds names, offices, job titles, assignments, email addresses, phone numbers and reporting lines. DDoSecrets says home addresses and personal contact details were withheld, though Reuters was able to match records against credit-bureau and earlier breach data regardless. Roles tied to certified undercover HSI agents and use-of-force instructors are included.

The group claims the records came from an Okta single sign-on directory used by DHS. Okta disputes this, saying it has no evidence that its data or systems were compromised, and Reuters could not corroborate the claim. DHS says it is aware of a potential breach and is investigating. Treat the source as unconfirmed.

The part that generalises to everyone else is the 55,603 internal permission groups indexed alongside the people. Group memberships describe which internal tools, vendors and programmes each account can reach, which turns a staff directory into a targeting map. Most organisations hand read-all directory scopes to SaaS integrations without much thought, and most name their groups after exactly what they unlock.

## What we'd do first

- **Patch the kernel and PHP together.** CISA says CVE-2026-46300 chains with the two php2shell bugs to implant webshells and run commands as root, so doing one without the other is half a fix. PHP goes to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and both PHP CVEs are now at EPSS 100%.
- **Finish last week's list, because all of it is now on KEV.** Node.js 22.23.4, 24.22.1 or 26.12.1 plus Bun 1.4.4 for the Brotli overflow, GitLab self-managed to 19.3.6, 19.4.3 or 19.5.1, and Adobe Commerce for a file upload flaw already sitting at EPSS 44.6%.
- **Put Dell PowerProtect Data Domain near the front of the queue.** Forty-seven CVEs in one release, seven critical, mostly command injection, one reachable by a low-privileged remote user, on the system holding your last line of recovery.
- **Take an hour on your identity directory.** Review which SaaS integrations hold read-all directory scopes, rename the groups that advertise their own privilege, require phishing-resistant MFA for anyone in a high-value group, and check your IdP logs for bulk directory reads over the last 90 days. Icepick is a reminder that a list of who works where, and what each of them can open, is intelligence on its own.

Subscribe to our weekly newsletter to get this intelligence directly in your inbox: `hxxps[:]//www[.]edgeprotect[.]io/newsletter`

---

## Links

- All roundups and guides: https://www.edgeprotect.io/blog
- The EdgeProtect Brief, the free weekly threat email: https://www.edgeprotect.io/newsletter
- Start free (no card, nothing to install): https://www.edgeprotect.io/register