CISA Adds Critical PHP & GitLab Flaws to KEV Catalog
Black October: CISA Warns of Actively Exploited PHP & GitLab Flaws
CVE Identifiers
Full Report
Executive Summary
In late October 2026, the cybersecurity community faced a surge of critical vulnerability exploitations, a period security experts have dubbed "Black October." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded by adding several high-impact vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active attack. Key among them are a pair of flaws in the PHP language, collectively known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), and a perfect 10.0 CVSS score vulnerability in GitLab (CVE-2026-97229). All of these flaws can lead to remote code execution (RCE). Due to the active exploitation and the widespread use of these technologies, CISA has issued directives mandating rapid patching by federal agencies, and strongly urges all organizations to remediate immediately.
Vulnerability Details
This wave of attacks targets fundamental components of modern web and software development infrastructure.
PHP2Shell Vulnerabilities
CVE-2026-109618&CVE-2026-109619: These two vulnerabilities in the ubiquitous PHP scripting language are rated critical with a CVSS score of 9.2. When exploited, they allow an unauthenticated attacker to achieve remote code execution on a vulnerable web server. The premature public disclosure of the flaws, before patches were widely available, provided a window of opportunity for threat actors, which they have aggressively seized. Honeypots have detected widespread scanning and exploitation attempts from numerous actors.
GitLab RCE Vulnerability
CVE-2026-97229: This vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE). It carries the maximum possible CVSS score of 10.0, indicating a flaw that is easy to exploit, requires no authentication, and has a critical impact. A successful exploit allows a remote attacker to execute arbitrary code on the GitLab server. Given GitLab's central role in the software supply chain, a compromise could lead to malicious code being injected into an organization's software, creating a massive downstream risk.
Affected Systems
- PHP2Shell: Any public-facing web server running a vulnerable version of PHP. As of late October, patching rates were alarmingly low, with estimates showing over 80% of exposed hosts remained vulnerable.
- GitLab: Self-hosted instances of GitLab Community Edition (CE) and Enterprise Edition (EE) running vulnerable versions.
Exploitation Status
CISA has confirmed that all three CVEs (CVE-2026-109618, CVE-2026-109619, and CVE-2026-97229) are being actively exploited in the wild. Security firms have reported that multiple threat actors, potentially including nation-state groups, are leveraging these flaws. The availability of functional proof-of-concept (PoC) exploits has lowered the barrier to entry for attackers.
Impact Assessment
The impact of these vulnerabilities is severe and widespread. The PHP flaws expose a massive portion of the internet's websites to potential takeover. The GitLab vulnerability represents a critical threat to the software supply chain. A compromised GitLab instance could allow attackers to steal source code, credentials, and other intellectual property, or worse, inject backdoors into an organization's applications before they are deployed, affecting all of that organization's customers. The speed and scale of exploitation during "Black October" suggest a new era of risk where vulnerabilities are weaponized almost instantaneously.
Cyber Observables — Hunting Hints
The following indicators could help identify unpatched systems or active exploitation:
apache2, nginx, php-fpm)Detection Methods
- Vulnerability Scanning: Regularly scan all public-facing assets for vulnerable versions of PHP and GitLab.
- Web Application Firewall (WAF): Deploy WAF rules specifically designed to block known exploit patterns for these CVEs. This can serve as a crucial compensating control while patching is underway.
- Log Analysis: Actively monitor web server logs for the URL patterns and error messages associated with exploitation attempts. Ingest these logs into a SIEM and create alerts for high-frequency attacks or successful exploit indicators.
D3-PA: Process Analysis: Monitor for anomalous process creation on web and application servers. A web server process should not be spawning shells (/bin/sh,cmd.exe) or network utility tools (curl,wget).
Remediation Steps
- Immediate Patching: This is the most critical step. Organizations must upgrade to the patched versions of PHP and GitLab immediately. CISA has set a deadline of October 31, 2026, for federal agencies, highlighting the urgency.
- Asset Inventory: Ensure you have a complete and accurate inventory of all internet-facing systems to identify all instances of PHP and GitLab in your environment.
- Assume Compromise: For any unpatched systems that were exposed to the internet, organizations should assume they may have been compromised and conduct forensic analysis to hunt for signs of malicious activity.
D3-ACH: Application Configuration Hardening: Restrict unnecessary PHP functions via thephp.inifile to reduce the attack surface.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to immediately apply the security patches released by PHP and GitLab to fix these critical vulnerabilities.
Restrict Web-Based Content
Use a Web Application Firewall (WAF) with rulesets designed to block exploit attempts against these specific CVEs as a compensating control.
D3FEND Defensive Countermeasures
The most critical and effective countermeasure against the PHP2Shell and GitLab vulnerabilities is immediate software updating. Organizations must prioritize the deployment of patched versions of both PHP and GitLab across all production and development environments. This requires a robust patch management program that includes comprehensive asset inventory to identify all vulnerable instances. For GitLab, this means upgrading to the secure version specified in their security advisory. For PHP, all web servers must be updated. Given the active, widespread exploitation, these updates should be treated as emergency changes, bypassing standard, slower-moving patch cycles. After patching, it is essential to verify that the update was successful and that the services are running the new, secure versions. Failure to patch is not an option, as automated scanners are actively seeking and exploiting these flaws.
While patching is in progress, Inbound Traffic Filtering via a Web Application Firewall (WAF) is an essential compensating control. Security teams should immediately deploy virtual patches or custom rules on their WAFs to block the specific HTTP request patterns used to exploit CVE-2026-97229 (GitLab) and the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619). These rules would inspect incoming traffic for malicious payloads, such as command injection strings or deserialization attacks targeting PHP. For GitLab, the WAF should be configured to block the specific API endpoints or request structures identified in the exploit PoCs. This provides a crucial layer of defense for internet-facing servers, reducing the likelihood of a successful compromise while the underlying software is being updated. It is not a replacement for patching, but it buys critical time and reduces risk.
Timeline of Events
Reports emerge of slow patching for PHP2Shell, with only 19% of hosts patched.
CISA adds PHP2Shell vulnerabilities to its KEV catalog.
CISA adds the critical GitLab RCE vulnerability CVE-2026-97229 to the KEV catalog.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.