# October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs

> Recorded Future Insikt Group identified 82 high-impact CVEs in October 2026 (52 Very Critical), 69 actively exploited or weaponized, 36 sourced from CISA KEV, with public PoCs for 37. Highlighted campaigns: PHP2Shell + Fragnesia chained to root PAN-OS firewalls, Longlegs (Storm-2603) deploying Warlock ransomware through SharePoint ToolShell CVEs and a vulnerable K7 driver, CL-STA-0954 abusing FortiManager/FortiOS to implant PEERSTITCH, and Qilin-related activity via PAN-OS CVE-2026-0257.

- **Published:** 2026-11-06T18:50:23Z
- **Last reviewed:** 2026-11-06T18:50:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5439
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5439.png
- **ID:** TL-2026-5439
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-46300, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, CVE-2025-1055, CVE-2026-0257, CVE-2024-47575, CVE-2025-61624

## Description

Recorded Future's Insikt Group tracked 82 high-impact vulnerabilities in October 2026, a 13% decrease from September's 94. Of these, 52 carried a Very Critical risk score, 36 were sourced from CISA KEV, 33 from open sources and 13 exclusively from honeypot data; 69 were actively exploited or operationally weaponized, 37 had public PoCs and 37 enabled remote code execution across 51 vendors. The most frequent weakness classes were CWE-78 (8), CWE-287 (7), CWE-22 (6) and CWE-77 (6). Ten of the CVEs are at least five years old, the oldest about sixteen. Recorded Future risk scores are reported rather than CVSS, so no aggregate CVSS applies.

PHP2Shell + Fragnesia. CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, CVSS 9.2 per secondary reporting) are memory-corruption flaws in PHP session/upload handling that give unauthenticated RCE under Apache mod_php; the PHP Foundation fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Dream Security describes four stages: memory exhaustion via a ~383MB multipart POST, an out-of-bounds read leaking the libphp.so base address, stale-reference setup under ~500MB memory pressure, and a forged HashTable destructor that runs system() as the 'nobody' user. Requests abuse PHP_SESSION_UPLOAD_PROGRESS and oversized PHPSESSID cookies. The attacker then chains CVE-2026-46300 (Fragnesia, CVSS 7.8, a logic bug in the Linux XFRM ESP-in-TCP subsystem in the Dirty Frag class; kernels before the 2026-05-13 fix) to write into the page cache of /etc/pam.d/su, replacing authentication with pam_permit.so so that 'su root' works without a password. The full chain from unauthenticated HTTPS to persistent root takes under 15 minutes. Dream Security observed an apparently Chinese, AI-assisted operation against Palo Alto Networks PAN-OS firewalls: ~19,000 exposed management interfaces were found via FOFA, ~5,000 fingerprinted, 240 filtered to the US, Japan, Taiwan and South Korea, and 24-25 rooted (sources differ on 24 vs 25; at least three servers were US-government affiliated). A custom PHP2Shell build with ~40 post-exploitation scripts, the aiscan platform (DeepSeek/Kimi LLMs), Claude Code and the iox tunneling utility were recovered. Post-exploitation included a 103-byte webshell at /unauth/php/change_password.php, a systemd-wrapped 8-port reverse SSH tunnel with an rc.local hook, extraction of private keys, decryption of an LDAP service-account password, Active Directory enumeration and topology mapping, with 22 firewalls parked for later use. CISA added CVE-2026-46300 to KEV on 2026-10-28 (federal deadline 2026-11-10) and the PHP2Shell CVEs the same week (deadline 2026-10-31). Recorded Future also cites a CYFIRMA assessment of suspected North Korean preparations (21 compromised nodes checking 216 hosts, Lazarus link at moderate confidence), Potassium (Mirai-derived) botnet payload attempts, and probing seen by Arctic Wolf and Cisco Talos. The two attributions conflict and neither is firmly established.

Longlegs / Storm-2603. The group (Symantec: Longlegs; Microsoft: Storm-2603; described as China-nexus) exploited the SharePoint ToolShell chain (CVE-2025-49704, CVE-2025-49706 and bypasses CVE-2025-53770, CVE-2025-53771) against a water utility, a telecom provider, a regional government body and a university in Portuguese- and Spanish-speaking regions. Intrusions deployed web shells, used BloodHound/SharpHound and NetExec, installed Visual Studio Code Insiders as a tunneling service, abused the signed vulnerable K7RKScan driver (CVE-2025-1055) as BYOVD to kill EDR (40+ hosts within two hours in one intrusion), and staged Warlock ransomware in SYSVOL for propagation across domain controllers.

CL-STA-0954 (UNC5820). Unit 42 reports initial access through FortiManager CVE-2024-47575 (FortiJump) beginning September 2024, exposing configurations and trust material for 500+ managed FortiGate firewalls. CVE-2025-61624 (FortiOS auto-script path traversal) gave root, used to drop PEERSTITCH, a memory-resident ARM64 implant that ptrace-patches the miglogd and iked daemons, leaves no on-disk binary or listening port, and tags VPN sessions to skip checks. Anti-forensics included killing syslog daemons, clearing crash logs and auto-deleting rogue accounts.

Other items: Qilin/Settra/Tarnished Scorpius (INC Ransom) activity used PAN-OS CVE-2026-0257 and BloodHound/SharpHound; Integrity Technology Group was linked to espionage and CyberXero to AI-assisted exploitation, with few details in the source. Insikt published Nuclei templates, Sigma, Suricata and Snort rules. The source article lists no IOCs; the IOCs below come from the Dream Security, ampcus and Unit 42 reports.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1543.002 Systemd Service
- T1037.004 RC Scripts
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1055.008 Ptrace System Calls
- T1484.001 Group Policy Modification
- T1556.003 Pluggable Authentication Modules
- T1110.003 Password Spraying
- T1552.004 Private Keys
- T1087.002 Domain Account
- T1572 Protocol Tunneling
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fragnesia CVE-2026-46300 Follow-On — su Executed from Service Context / /etc/pam.d/su Tampering (Post-Exploitation)** (`TL-2026-5439-SPL-002`)

Detects the privilege-escalation outcome of Fragnesia (CVE-2026-46300): su executed by an account with no login session (auid unset) or a web service uid (www-data, apache, nobody), and writes to /etc/pam.d/su, whose page-cache copy is rewritten to pam_permit.so so that 'su root' works with no password in the PHP2Shell chain (T1068, T1556.003).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1556.003
- **Data sources:** linux_audit, auditd, DeviceProcessEvents, DeviceFileEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=linux sourcetype=linux_audit earliest=-24h ```Fragnesia CVE-2026-46300 (T1068, T1556.003): su from service context or pam.d/su tamper```
  ((type=SYSCALL syscall IN (59, 221) exe IN ("/usr/bin/su", "/bin/su") (auid=4294967295 OR auid=unset OR uid IN (33, 48, 65534, 99)))
   OR key="pam_su_tamper")
| eval evidence=if(key="pam_su_tamper", "pam_su_modified", "su_from_service_account")
| stats count min(_time) as first_seen max(_time) as last_seen values(uid) as uid values(auid) as auid values(comm) as comm values(exe) as exe by host, evidence
````

### Microsoft KQL

```kql
let WebAccounts = dynamic(["nobody", "www-data", "apache", "wwwrun", "httpd"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "su"
 | where AccountName in~ (WebAccounts) or InitiatingProcessFileName in~ ("httpd", "apache2", "php-cgi") or InitiatingProcessFileName startswith "php-fpm"
 | extend Evidence = "SuFromServiceContext"
 | project Timestamp, DeviceName, Evidence, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/etc/pam.d" and FileName =~ "su"
 | where ActionType in ("FileModified", "FileCreated", "FileRenamed")
 | extend Evidence = "PamSuModified"
 | project Timestamp, DeviceName, Evidence, AccountName = InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine)
```

### Sigma

```yaml
title: "Fragnesia CVE-2026-46300 Follow-On — su Executed from Service Account"
id: a1c5d7e2-5439-4b01-9a11-0c1f3d7a0002
status: experimental
description: "Detects su executed by a web service account (nobody, www-data, apache), the passwordless root step after Fragnesia (CVE-2026-46300) rewrites /etc/pam.d/su to pam_permit.so in the PHP2Shell chain."
references:
  - https://www.recordedfuture.com/blog/october-2026-cve-landscape
  - https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.credential-access
  - attack.t1556.003
  - cve.2026-46300
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/su'
    User:
      - 'nobody'
      - 'www-data'
      - 'apache'
      - 'wwwrun'
      - 'httpd'
  condition: selection
falsepositives:
  - "Misconfigured service or cron scripts that run su from a service account for legitimate maintenance"
  - "Administrative automation that rewrites /etc/pam.d/su during hardening"
level: critical

```

**Known false positives:**

- Misconfigured service or cron scripts that run su from a service account for legitimate maintenance
- Administrative automation (Ansible/Puppet) that rewrites /etc/pam.d/su during hardening

**Tuning notes:** Add the auditd rule 'auditctl -w /etc/pam.d/su -p wa -k pam_su_tamper' so the key-based half fires. Fragnesia modifies the page cache, not the on-disk file, so also schedule a FIM or package-verify (rpm -V / debsums) comparison of /etc/pam.d/su against the baseline. Add the uids used by your web stack to the uid list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SharePoint ToolShell (CVE-2025-53770) — spinstall0.aspx Drop and w3wp Spawning Shells (Exploitation) (locked: unlock with TL Creds)
- PAN-OS/Linux Persistence — .panops Scripts, [indicator] Injector, rc.local and systemd Unit Writes (Post-Exploitation) (locked: unlock with TL Creds)
- VS Code Insiders Tunnel Service and iox Tunneling Utility Execution — Longlegs / PHP2Shell Remote Access (C2) (locked: unlock with TL Creds)
- Apache/PHP Worker Spawning Shell or su — PHP2Shell system() Execution as nobody (Exploitation) (locked: unlock with TL Creds)
- Syslog Daemon Kill and FortiOS Crashlog Clear — CL-STA-0954 / PEERSTITCH Anti-Forensics (Post-Exploitation) (locked: unlock with TL Creds)
- Executable or Script Staged in SYSVOL — Warlock Ransomware Propagation Across Domain Controllers (Lateral Movement) (locked: unlock with TL Creds)
- PHP2Shell CVE-2026-109618/109619 Exploitation Request — PHP_SESSION_UPLOAD_PROGRESS / Oversized PHPSESSID (Exploitation) (locked: unlock with TL Creds)
- PEERSTITCH / PHP2Shell Campaign Infrastructure Connections — Research and Community-Observed IPs (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `15.204.59[.]70`
- File hash: `b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70`
- IP address: `162.35.99[.]94`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [October 2026 CVE Landscape - Recorded Future Insikt Group](https://www.recordedfuture.com/blog/october-2026-cve-landscape)
- [CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/)
- [Chained PHP2Shell exploit roots 25 servers - Dream Security](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
- [Fragnesia (CVE-2026-46300) Chained with PHP2Shell in Active Root-Access Attacks - Ampcus Cyber](https://www.ampcuscyber.com/shadowopsintel/fragnesia-cve-2026-46300-chained-with-php2shell-in-active-root-access-attacks)
- [PHP2Shell plus Fragnesia: a dangerous new route from web server to root - CSO Online](https://www.csoonline.com/article/4242454/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root.html)
- [Fragnesia PoC repository (v12-security)](https://github.com/v12-security/pocs/tree/main/fragnesia)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [PEERSTITCH and FortiManager CVE-2024-47575 - Unit 42](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware)
- [Attackers exploit FortiOS flaw to plant PEERSTITCH - The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html)
- [Warlock ransomware breaches SharePoint in water, telecom operator attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/)
- [Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure - Security Affairs](https://securityaffairs.com/200304/malware/warlock-ransomware-still-exploits-year-old-sharepoint-flaws-to-hit-critical-infrastructure.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5439