Daily Cyber Threat Brief — October 23, 2026: 'php2shell' — critical PHP RCE flaws patched as attackers struck before the fix

The php2shell pair is the kind of bug that inverts the normal patch math. Both flaws sit in the PHP runtime's request handling — CVE-2026-109618 (out-of-memory handling interrupts PHP while internal request data is only partly initialized, and cleanup then treats the invalid data as valid) and CVE-2026-109619 (internal state surviving after its memory is freed, reused by a later request on the same worker). Patching WordPress, Drupal or any plugin changes nothing; the fix is a runtime update, a worker restart, and confirming which PHP binary the web server actually loads. Vendors that ship PHP inside appliances or control panels inherit the exposure silently — that is the long tail to hunt.

The disclosure itself is the case study. The embargo was a day early because a Hacker News post leaked the identifiers on October 20; watchTowr reproduced one flaw within hours. By 07:43 UTC on release day, Cloudflare's CTO was already seeing early attacks — the exposure window opened before the patch existed, which is exactly why PHP shipped ahead of its own 14:00 UTC deadline and why "no working exploits seen at release time" is cold comfort. Linux distributions had the patches in advance, and PHP published minimal source backports for 7.4, 8.0 and 8.1 — but 8.1 and older get no official updates, and PHP 8.2 goes end of life December 31, 2026.

The other notable thread: the discovery was AI-assisted. Calif used GPT-5.6 Sol through OpenAI's Patch the Planet effort to find a critical issue, while Wiz independently reported both vulnerabilities; PHP maintainers wrote the fixes with validation and disclosure coordination support from OpenAI, Wiz and Cloudflare. The tooling didn't write the patches — but the timeline from AI-flagged finding to mass-exploitation warning was measured in hours, not weeks. Defender playbook: update every PHP runtime you operate, restart the workers, and treat any pre-patch-exposed web tier as possibly compromised until proven otherwise.

The Onamae Desktop Cloud compromise is no longer a hosting-provider story — it's a financial one. AvaTrade Japan says hackers accessed accounts and executed unauthorized trades, and OANDA Japan temporarily delayed withdrawal processing while running additional security checks. GMO's own October 22 update acknowledged customer reports of unauthorized trading-account operations and warned that credentials stored inside the compromised server environments may have been obtained and misused. Onamae Desktop Cloud is marketed for always-on FX automated trading with MetaTrader 4 — which means the breached layer is exactly where traders kept their broker credentials.

One evidentiary caution from the reporting: AvaTrade did not explicitly attribute its confirmed unauthorized transactions to GMO's infrastructure — its notice referred more broadly to external services, and GMO's 26,739 figure counts potentially affected server environments, not confirmed compromised brokerage accounts. The throughline is circumstantial but strong: a VPS product purpose-built to hold trading credentials was compromised at the infrastructure layer, and two brokers are now doing incident response. GMO is investigating with a security firm, police and partner businesses; all Desktop Cloud plans remain suspended with no restart date. For affected traders: change broker passwords, review transaction history, terminate active sessions, enable 2FA, and watch for phishing riding the incident's publicity — GMO explicitly warned it will never ask for credentials by email or phone.

Between September 9 and October 7, an unauthorized party used stolen service-account credentials to walk through PingCAP's internal systems, copying data and obtaining source code — a near-month of dwell time before PingCAP detected the activity on October 7 and began killing the credentials the same day. What makes this one sting: the attacker's actual databases weren't breached, but the metadata around them was. Exported records include TiDB Cloud account details (names, email addresses, org and project associations, SQL editor text and errors, cluster identifiers) and business data (contacts, contract terms, orders, pricing, payment terms, billing configuration). A table with encrypted API keys was also exported — investigators say the encryption held.

PingCAP's third-party-assisted review found no evidence the attacker ran commands or kept persistent access in the production systems examined, and says there is no evidence TiDB-stored data was impacted. All identified access paths were blocked by October 14, and four vulnerabilities flagged by the external IR firm were fixed and independently verified. That said, customer-specific impact is still being determined — and an extortion group calling itself FulcrumSec claims to have stolen 10.6 TB and alleges plaintext API keys. Those claims are unverified. For TiDB Cloud users: rotate management API keys, audit service accounts for anything you didn't create, and treat SQL editor content as exposed — it often contains queries pasted from production schemas.

The Everest ransomware group claims it stole 590.69 GB of data from PwC, the global professional services firm — allegedly 108,426 files from internal HR and learning systems, including HR records, training files and internal documents. The listing surfaced October 22 on Everest's leak site, picked up by Hackmanac's public alert and CTIWatch's victim tracker.

The evidence-first read: this is a claim, not a confirmed breach. No PwC response has been identified in the reporting, and leak-site listings are a negotiation tactic as much as a fact. Ransomware groups routinely recycle old data, inflate volume, or misattribute victims. Treat it as a watching brief: if PwC confirms, the HR/learning-systems targeting is the interesting thread (personnel data is high-value for follow-on social engineering); until then, it's uncorroborated. Defender lesson from the pattern: exfiltrate-the-HR-share is a cheap attacker win — access reviews on training platforms and document stores deserve the same rigor as production databases.