Two items this week, both exploited in the wild and both in CISA's Known Exploited Vulnerabilities (KEV) catalog. The big one is php2shell: two flaws in PHP itself that let someone with no login run code on a web server. PHP quietly runs the web interface on a lot of homelab gear, so this reaches much further than "I don't run a website." EPSS is FIRST's estimate of how likely a flaw is to be exploited in the next 30 days.
It's a short list on purpose. Of the six flaws CISA put in KEV this week, only these two matter for most homelabs and small offices. Arista VeloCloud Orchestrator (CVE-2026-114625) is an enterprise SD-WAN controller. If you run one on-prem, update to 5.2.3.18, 6.1.3.10 or 6.4.2.12 now, because Arista says any logged-in user, down to the read-only role, can take it over.
The last two were added on Tuesday. Adobe Commerce and Magento (CVE-2026-48356) is an unrestricted file upload flaw, and shop software faces the internet, so if you run a Magento store, patch it now from Adobe's advisory. Google Brotli (CVE-2026-111497) is a bug in a compression library; if you run PHP on Windows, the updated PHP builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 include the fixed Brotli 1.2.1.
We found no new exploitation reports this week for Proxmox, TrueNAS, MikroTik, Ubiquiti/UniFi, TP-Link/Omada, ASUS, Netgear, Home Assistant, Plex, Fortinet or WatchGuard. pfSense, OPNsense, Unraid, Synology and QNAP all shipped PHP fixes, covered in item 1.
The rule: anything you can reach from the internet gets patched first. Anything that's only reachable on your LAN or over a VPN can wait for your normal patch day. This week, item 1 is the exception: patch it everywhere, because it sits under so many web interfaces.
1. PHP php2shell on OPNsense, pfSense, Unraid and NAS apps: CVE-2026-109618/109619 exploit, patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — 🔴 PATCH NOW
What it is: Two bugs in the PHP engine itself, nicknamed php2shell. CVE-2026-109618 corrupts memory when a request runs out of memory, and CVE-2026-109619 leaves stale data behind for the next request to trip over. Either one lets an attacker with no login run code on the server. PHP shipped fixes on Oct 21. Amazon's honeypots caught an exploit attempt on Oct 17, four days before the fix, and attacks have spread widely since. On Oct 24, a researcher's PHP 8.4.26 honeypots (a deliberately easy setup) had shell commands run on them.
Exposure: Any PHP site or web interface that answers web requests, through Apache mod_php (the worst case), PHP-FPM, php-cgi, FrankenPHP or LiteSpeed. In a homelab that includes the web UI on OPNsense, pfSense and Unraid, PHP packages and apps on Synology and QNAP, and self-hosted apps like Nextcloud and WordPress. Risk is highest when the interface or a captive portal faces the internet or guest Wi-Fi. TrueNAS itself doesn't use PHP (only PHP apps you install, like Nextcloud), and Netgear says only six Wi-Fi 6 and 6E routers include it (RAX28, RAX29, RAX30, RAXE290, RAXE300 and CAX30), reachable from the LAN only, with fixed firmware still to come.
Scores: EPSS 0.99999 for both (99.99th percentile). CVSS v4 9.2. In KEV since Oct 26, 2026, with a federal deadline of Oct 29.
Fix: Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or the web server so the new version actually loads. On appliances, the vendor update brings the fixed PHP (versions below). PHP 8.1 and older get no official release (the PHP team posted source-only backports for 7.4, 8.0 and 8.1), and CISA says to take those servers offline until they're upgraded. Can't patch today? Keep the interface off the internet and use PHP's partial stopgaps (set session.upload_progress.enabled to 0 and use a low post_max_size). They reduce the risk but don't remove it. → PHP security release · CISA alert · CISA KEV catalog · Vulnpatch: CVE-2026-109618 · Vulnpatch: CVE-2026-109619 · Amazon threat report · SecurityWeek on the honeypot shells · Netgear notice
Fixed versions on homelab gear:
OPNsense: Community 26.7.7 (PHP 8.5.12) or 26.1.11 (PHP 8.3.36), and Business 26.4.2p4 (PHP 8.3.36). Restart the captive portal after updating. OPNsense notice
pfSense: new PHP packages for Plus 26.07, Plus 26.03.1 and CE 2.9.0 (PHP 8.5.12) and CE 2.8.1 (PHP 8.3.36). They install from the shell, not the GUI: pfSense-upgrade -c && pkg upgrade -y && pkg upgrade -fy pfSense-pkg-WireGuard && /etc/rc.reboot (expect a WireGuard drop and a reboot). Netgate notice
Unraid: 7.3.4 (PHP 8.4.27), or 7.2.9 if you stay on the 7.2 branch. Unraid 7.3.4 notes
Synology: update the PHP packages in Package Center (for example 8.4.27-0051, 8.3.36-0051 or 8.2.35-0171), plus Calendar 3.0.4-21435 and Mail Station 30000002.3.19-20333. PHP 7.3 gets no fix, so move off it. Synology says DSM's own built-in PHP isn't exposed. Synology-SA-26:14
QNAP: QTS 5.2.11.3661, QuTS hero h6.0.2.3656 or h5.2.11.3661, and QuTScloud c5.2.9.3661 (all build 20261023), with fixed 6.1 public betas too. Some apps, like Note Station 3 and QVR Surveillance on ARM32 models, are still waiting for a fix. QNAP update
Nextcloud, WordPress and other PHP apps in Docker: pull the updated image and recreate the container, then run php -v inside it to confirm.
2. Nextcloud Collabora Built-in CODE Server: CVE-2026-110447 exploit, patch to 26.4.303 — 🔴 PATCH NOW
What it is: A command injection bug in the "Collabora Online - Built-in CODE Server" app for Nextcloud (app ID richdocumentscode). Anyone, with no login, can run commands on the server through the app's proxy.php file, but only while the built-in CODE server is stopped, for example during a restart, an upgrade or after a crash. Attackers have used it since Sep 10 to plant webshells, then search the server for password vaults and crypto wallets.
Exposure: Nextcloud servers that use the built-in CODE app and are reachable from the internet. Standalone Collabora installs, the Collabora Docker image, distro packages and Nextcloud All-in-One are not affected. Disabling the app is not enough, because the vulnerable file stays on disk.
Scores: EPSS 0.116 (96th percentile). CVSS 9.2. In KEV since Oct 23, 2026, and CISA's federal deadline has already passed.
Fix: Update the Built-in CODE Server app to 26.4.303 or newer, or remove it and switch to a standalone Collabora server. The fixed versions need Nextcloud 30 or newer, and Nextcloud 29 and older are end of life, so an old Nextcloud means upgrading Nextcloud first. If the server was exposed, look through the Nextcloud folders for PHP files you don't recognize, and treat any you find as a break-in: rebuild and change passwords. → Collabora advisory · CISA KEV catalog · BleepingComputer report · Vulnpatch: CVE-2026-110447
Also this week: browsers drop eMudhra certificates
Not a rated item and not in KEV (there's no CVE), but worth five minutes. On Oct 17, a researcher reported that the private keys for eight eMudhra intermediate certificate authorities were generated with weak randomness, so anyone could forge a trusted HTTPS certificate. Browsers blocked them within hours, and no misuse has been reported.
Browsers: Firefox already blocks them through its OneCRL list, and Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 cover setups that don't get OneCRL. Chrome removes the emSign ECC Root CA - G3 root on Oct 27.
Servers and scripts: the root is gone in NSS 3.131.1, Python's certifi 2026.10.19 and later, Ubuntu (USN-8944-1), Debian 12 (ca-certificates 20250419~deb12u2) and Debian 13 (20250419+deb13u1). Update ca-certificates on your Linux boxes and containers.
If you run a site on an emSign certificate: get a new certificate from another CA now, because Chrome will stop trusting it.
→ Mozilla · Google · eMudhra notice
Forgotten firmware: PHP hides inside your appliances
Last week's lesson was that set-and-forget gear is where attackers go. php2shell is a quieter version of the same problem. Your firewall, NAS and router don't look like PHP servers, but several of them run PHP for their web interface, and updating PHP on another box won't fix them. They only get the fixed PHP when you install the vendor's update, and on pfSense that update doesn't even show up in the GUI.
A 15-minute check this week:
List every box with a web login and note whether it runs PHP. The vendor notices in item 1 are a good start.
Check each one's PHP version with php -v from the shell, or in the vendor's package list. The appliance's own version number may not change after a PHP-only hotfix.
Install the vendor's update, then restart the web UI, PHP-FPM or captive portal so the new PHP actually loads.
Confirm the web UI only answers on your LAN or VPN: no port forwards to it, and no captive portal on guest Wi-Fi until it's patched.
Keep it in your monthly maintenance window and write down the firmware version each time, as @drivetechpc suggested last week.
Still open from Issue #1: Plex Media Server, PAN-OS GlobalProtect and D-Link ShareCenter NAS are all still on KEV, and so is Log4Shell, the flaw behind the Ubiquiti UniFi Video item, and the two end-of-life boxes still have no fix. If you skipped last week, the fixed versions are in Issue #1 at patchorpass.beehiiv.com.
Not on this list: three things we checked and left out because they aren't in KEV. GitLab CE/EE (CVE-2026-110264) is a CVSS 10 bug fixed Oct 21 in 19.5.1 and backports, and GitLab reports no exploitation, so batch it into your next update. WatchGuard fixed a large set of Fireware OS flaws on Oct 27, some of them remote code execution with no login, in Fireware 2026.4 and 12.12.4 (12.5.22 for T15 and T35). Firewalls get targeted fast, so put that in your next window. SonicWall SMA1000 (CVE-2026-102255) isn’t in KEV, but honeypots have seen exploit attempts since Oct 8, so if you run one, apply SonicWall’s newest platform hotfix (anything newer than 12.4.3-03670 or 12.5.0-03082) now (BleepingComputer report · Cyber Centre AV26-1017).
Your turn: hit reply and tell me which box on your network surprised you by running PHP. I read every reply.
Data: CISA KEV catalog (version 2026.10.27, checked Oct 27, 2026), FIRST EPSS API (Oct 27, 2026), and vendor security advisories.
Disclaimer: This newsletter is general information, not professional security advice. Calls are conservative and based on public data. Always follow the vendor's advisory and check your own exposure. No warranty; you are responsible for your systems.