Eptura Archibus: Three Flaws Let Attackers Take Over Servers Without Logging In
Rapid7 disclosed three Eptura Archibus flaws enabling database reads and code execution. Admins should upgrade to version 2025.02 or later.
Vulnerabilities
PHP2Shell: Patches Released for Critical PHP Flaws as Exploitation Attempts Begin
PHP has patched two critical flaws, and exploitation attempts are already appearing. Admins should update environments running websites and apps.
On October 21, patches were released for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. This is a significant update to the earlier advance notice: specific releases are now available, and security vendors are recording attempts to exploit the flaws.
What’s New Since the Announcement
The PHP Foundation has confirmed the release of versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both vulnerabilities involve memory management and error handling. Under certain conditions, they allow an unauthenticated attacker to execute code. The Foundation described confirmed code execution scenarios, including Apache with mod_php.
SecurityWeek also reported exploitation attempts observed by security vendors. These requests need to be distinguished from a confirmed server compromise: watchTowr said its sensors recorded attempts, but in the reported observation it did not find that any had succeeded.
Who Is at Risk
The problem lies in PHP itself, so confirming that your content management system or its plugins are up to date is not enough. Administrators need to determine which version of the runtime environment is actually executing the application. For installations that use distribution packages, check the maintainers’ advisory and whether a patched package is available.
Public-facing websites, customer portals, and applications that process credentials deserve particular attention. Having a web application firewall in place does not, on its own, confirm that the vulnerability has been eliminated.
What to Do Now
- Identify where PHP is running, including in containers and in services maintained by third-party contractors.
- Deploy the patched version of the relevant branch, or the patched package from your OS vendor.
- After updating, verify the version the web server is actually using and confirm the application works correctly.
- Review logs and alerts from the period before the update. Preserve any suspicious requests for analysis.
SecurHUB Commentary
An urgent update should also include confirming that the patched version is actually serving user traffic. Application security testing helps assess the exposure of your services and the effectiveness of the safeguards you’ve deployed.
Sources: PHP Foundation, SecurityWeek
