--- title: "#AxisOfEasy 473: PHP Ships Emergency Security Release For Two Critical RCE Flaws" type: "post" post_id: "34479" slug: "axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws" canonical: "https://axisofeasy.com/aoe/axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws/" markdown_url: "https://axisofeasy.com/aoe/axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws.md" json_url: "https://axisofeasy.com/aoe/axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws.json" txt_url: "https://axisofeasy.com/aoe/axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws.txt" published: "2026-10-23T22:00:06+00:00" modified: "2026-10-23T18:24:07+00:00" author: "Mark E. Jeftovic" categories: - "#AxisOfEasy" tags: - "AdFection" - "API Key Security" - "Backdoors" - "Broadcom" - "Candiru" - "Citizen Lab" - "Conversation Privacy" - "credential theft" - "Critical vulnerabilities" - "cyber extortion" - "cybercrime" - "Cybersecurity" - "Dark Web" - "data breaches" - "Data Leaks" - "Discover Tech" - "Emergency Security Patches" - "Exit Relay Hijacking" - "FBI" - "Firmware Security" - "Gift Card Fraud" - "Insider Threats" - "Malvertising" - "Meta Muse" - "Nikkei" - "Organized Crime" - "Personal Data Protection" - "PHP" - "Privacy" - "Ransom Negotiation" - "ransomware" - "Real-time bidding" - "Remote code execution" - "retail security" - "Router Vulnerabilities" - "ShinyHunters" - "SSH" - "Staples" - "State Bank of India" - "Surveillance" - "Targeted Advertising" - "Tor" - "unpatched vulnerabilities" - "UpdraftCentral" - "Web Server Security" - "Wi-Fi Protected Setup" - "Wi-Fi Security" - "WordPress security" - "Zero-Click Spyware" excerpt: "PHP Ships Emergency Security Release For Two Critical RCE Flaws Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware Feds Suspect Ransom Negotiator Ran ShinyHunters' Extortion Site... this and more in AofE #473" site_name: "" publisher: "" language: "en-US" license: "" generator: "easyPress AI Discoverability" generator_version: "2.0.14" --- *![](https://axisofeasy.com/wp-content/uploads/2020/02/weekly-briefing-axis-of-easy.jpg)* --- *Weekly Axis Of Easy #473* ========================== --- ***Last Week’s Quote was:** “Security is a process, not a product,” was by Bruce Schneier. A few got it right, but Reann got it first! Congrats Reann.* ***This Week’s Quote:** “No man is free who is not master of himself.” By ???* ***THE RULES: No searching up the answer,** must be posted at the bottom of this blog post, in the comments section.* ***The Prize:** First person to post the correct answer gets their next domain or hosting renewal on us.* --- *This is your easyDNS #AxisOfEasy Briefing for the week of October 19th, 2026. Our Technology Correspondent Joann L Barnes and easyCEO Mark E. Jeftovic send out a short briefing on the state of the ‘net and how it affects your business, security and privacy.* *To Listen/watch this podcast edition with commentary and insight from Joey and Len the Legend [click here.](https://axisofeasy.com/podcast/axisofeasy-473-php-ships-emergency-security-release-for-two-critical-rce-flaws/)* **Is Your Website Vulnerable to PHP2shell? (and what else)** We’ve added a PHP2shell scanner to [DomainHelp here](https://mc.easydns.com/r/aabe1142b472093bfdc3e7673?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MjAwNzt9czo1OiJlbWFpbCI7aToyMDA3O3M6NDoic3RhdCI7czoyMjoiNmFkYjliZjQ3MTA4ZDY1NzA1NDQzMCI7czo0OiJsZWFkIjtzOjU6IjE5NTUyIjtzOjc6ImNoYW5uZWwiO2E6MTp7czo1OiJlbWFpbCI7aToyMDA3O319&) which can tell you whether your website is vulnerable. It is based on Assetnote’s [Git repo](https://mc.easydns.com/r/05ed3d5af31b46134d90d2e6e?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MjAwNzt9czo1OiJlbWFpbCI7aToyMDA3O3M6NDoic3RhdCI7czoyMjoiNmFkYjliZjQ3MTA4ZDY1NzA1NDQzMCI7czo0OiJsZWFkIjtzOjU6IjE5NTUyIjtzOjc6ImNoYW5uZWwiO2E6MTp7czo1OiJlbWFpbCI7aToyMDA3O319&) (be sure to give him a star when you clone it). **PHP2Shell** is just the beginning – we’ve scored a deal for AxisOfEasy readers on a comprehensive “after *after* PHP2shell” that you should be worried about (including the new Node.js remote shell! Huzzah). Use coupon code “AXISOFEASY” [order your vulnerability report here:](https://mc.easydns.com/r/540b6ae6dd0aeeba9dce4bbe5?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czo1OiJlbWFpbCI7aToxO2k6MjAwNzt9czo1OiJlbWFpbCI7aToyMDA3O3M6NDoic3RhdCI7czoyMjoiNmFkYjliZjQ3MTA4ZDY1NzA1NDQzMCI7czo0OiJsZWFkIjtzOjU6IjE5NTUyIjtzOjc6ImNoYW5uZWwiO2E6MTp7czo1OiJlbWFpbCI7aToyMDA3O319&) [![](https://axisofeasy.com/wp-content/uploads/2026/10/axisofeasy473add.png)](https://zybee.ai/exposure-report/?coupon=AXISOFEASY) ***In this issue:*** - **PHP Ships Emergency Security Release For Two Critical RCE Flaws** - **Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware** - **Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site** - **GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking** - **Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers** ***Elsewhere Online:*** - **Over 300 Tor Exit Relays Were Hijacked To Intercept SSH Logins** - **Stolen UpdraftCentral Keys Are Now Backdooring WordPress Sites** - **State Bank Of India Says 3,897 Of ~375K Dark-Web Records Are Real** - **Meta’s Muse Leaks Conversations When Users “Share” Them With Friends** - **Nikkei Discloses Its Third Data Breach In A Month, 1.8M Records This Time** --- [**PHP Ships Emergency Security Release For Two Critical RCE Flaws**](https://www.php.net/archive/2026.php#2026-10-21-1) PHP’s security team shipped the out-of-cycle release it had warned about at 14:00 UTC today: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical, unauthenticated remote-code-execution flaws — CVE-2026-109618 (RCE via OOM corruption, GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (RCE via stale global state, GHSA-6wmf-4rv5-p3rp) — and the advisory is blunt: “All PHP users are strongly encouraged to update immediately.” The highest-risk SAPI is mod\_php, with a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are in scope too. PHP has also posted minimal source-backports for the EOL 7.4, 8.0 and 8.1 branches. If you can’t restart right away, the advisory lists interim mitigations — set memory\_limit=-1 at a layer the app can’t override (php\_admin\_value in the FPM pool or Apache config) and lower post\_max\_size for the OOM path — but is explicit that they only reduce exposure, they do not make an installation safe. If you’re still on 8.1 or older and running remirepo.net, the advice is direct: build from source, migrate to a distro package, or move to a supported branch. *More via [PHP.net](https://www.php.net/archive/2026.php#2026-10-21-1)* *· [BleepingComputer](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/)* **[Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/)** Citizen Lab and the SHARE Foundation report the first-ever public confirmation of zero-click mercenary spyware delivered through targeted online ads — a technique the researchers call AdFection. The write-up shows how Discover Tech, which it describes as helping mercenary surveillance companies track and hack devices around the world, was the targeting layer that delivered Candiru’s spyware to devices at Al Jazeera without a single user action, riding the real-time-bidding ad-exchange plumbing (DSPs, SSPs, ad exchanges) that already handles most of the web’s audience targeting. The practical read: the delivery path for mercenary spyware is no longer a phishing email or a 0-day in your OS — it’s an ad slot in an app or site you already use, selected by the same RTB machinery that picks your regular ads. If you run DSP / SSP / ad-exchange infra, audit the SSP code embedded in publisher apps and the third-party tags that execute at render time first; and if you’re the targeted side, “we never clicked anything” is no longer a defense claim. *More via [Citizen Lab](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/)* [**Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site**](https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/) Federal investigators probing the ShinyHunters extortion group — the crew behind the FBI jobs-site breach — say at least one executive at a large U.S. ransomware-negotiation firm ran “shinywire\[.\]com,” the site that pressured victims into paying. Krebs reports the firm has 1,000+ associates and is not named because no one there is charged yet; the chain runs from the Dutch arrest of Pepijn van der Stap on September 15 and the Signal messages Dutch police pulled off his account — tying the two executives to the operation and to a murder-for-hire plot they allegedly directed abroad. Reuters reported in early October that “Rey,” the Amman-based teenager who took over the ShinyHunters brand, is in Jordanian custody and cooperating with the FBI. The bigger story is the trust relationship itself: a firm selling “we’re the only one on your side” was reportedly the one with inside knowledge of ShinyHunters’ latest victim before the victim did — and, in the Dutch file, the one that knew about the FBI breach and did not tell the FBI. If you engage a ransom negotiator, this is the due-diligence question the industry now has to answer: does the firm have a direct line to the group it’s negotiating with, and is that line disclosure-protected or not. *More via [Krebs on Security](https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/)* *· [Politico](https://www.politico.com/news/2026-10-09/dubrovsky-shinyhunters-fbi-arrest/)* **[Staples Hacked, Millions In Gift Cards, Goods Shipped Back To China](https://www.404media.co/how-a-massive-chinese-crime-ring-hacked-staples-to-steal-millions/)** A Chinese organized-crime group hacked into retail giant Staples, used that access to fraudulently issue millions of dollars’ worth of gift cards from stores like Target and Sephora, then went on a nationwide spending spree — shipping much of the stolen electronics and other merchandise back to China, 404 Media reports based on court records. The scale these crews run at — entire warehouses dedicated to housing the goods they steal from U.S. retailers and the gift cards they mint through the same breach — is what the records make clear. The takeaway for readers is the fraud surface, not the intrusion itself: a single compromised retailer credential (or a single insider) can be turned across every store that accepts that retailer’s card and every loyalty / gift program it participates in. If you accept or run a gift-card or loyalty system, treat cross-merchant acceptance and the issuing endpoint as the blast radius — and assume a breach will surface first as volume, not as an alert. *More via [404 Media](https://www.404media.co/how-a-massive-chinese-crime-ring-hacked-staples-to-steal-millions/)* **[Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers](https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html)** A flaw in Broadcom’s Wi-Fi Protected Setup code lets an attacker within radio range run code as root on Broadcom-based routers — no network password, no pairing step. Quentin Kaiser demonstrated it against home gateways supplied by three of the four big Belgian providers (Proximus, Orange Belgium, VOO), in one case reading the Wi-Fi pre-shared key straight off the device and in another opening an air-bound reverse shell. No CVE has been assigned and no fix has shipped: the affected chip families split in two, the older eCos models (BCM3380/3383/33834) — which the researcher calls a permanent “forever day” — and the newer Linux-based models (BCM3390/BC65xx/BCM68xx) only get a fix if their vendors swap Wi-Fi software. If you run or evaluate Broadcom-based gear, treat in-range RCE via WPS as a live, unpatched path: disable WPS if you can, put any management UI off the public net, and budget for a firmware or software swap rather than a point patch. “Millions of devices worldwide” are on the researcher’s list — from Cisco small-business access points to Huawei and ARRIS gear, some of it permanently exposed by design. *More via [The Hacker News](https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html) · [Quentin Kaiser (X)](https://x.com/quentin_kaiser)* **Also on AxisOfEasy this week:** *Nothing new in Curated Posts since our last check — still nothing since May. We’re not going to pad this section with filler just to fill space; when something worth your time crosses our desk, it’ll be here.* --- ***Elsewhere Online:*** **Over 300 Tor Exit Relays Were Hijacked To Intercept SSH Logins** ** **Stolen UpdraftCentral Keys Are Now Backdooring WordPress Sites** ** **State Bank Of India Says 3,897 Of ~375K Dark-Web Records Are Real** ** **Meta’s Muse Leaks Conversations When Users “Share” Them With Friends** ** **Nikkei Discloses Its Third Data Breach In A Month, 1.8M Records This Time** ** --- **Previously on #AxisOfEasy** If you missed the previous issues, they can be read online here: - - [October 16, 2026: #AxisOfEasy 472: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited](https://axisofeasy.com/472) - [October 9, 2026: #AxisOfEasy 471: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software](https://axisofeasy.com/471) - [October 2, 2026: #AxisOfEasy 470: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched](https://axisofeasy.com/470) - [September 25, 2026: #AxisOfEasy 469: Google Confirms Gemini Broke Into Three Real Companies During A Security Test](https://axisofeasy.com/469) - [September 18, 2026: #AxisOfEasy 468: A Compromised HBO Max Account Became A Malware Storefront](https://axisofeasy.com/468)