# Weekly Situation Report — 10/26/26

2026-10-29 · Threat Brief

Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-10-26-26

---

- Two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been disclosed dubbed PHP2SHELL.

- An intermediate certificate authority eMudhra has been compromised.

- A zero-day vulnerability in BeyondTrust software has been exploited by Armory Castle, a China-linked threat group.

- Attackers are exploiting a flaw in Siemens Software Center as part of an active ClickFix malware campaign.

## 1. PHP2SHELL Disclosure of CVE-2026-109618 and CVE-2026-109619

**Summary**

PHP2SHELL is the combination of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that result in RCE on vulnerable PHP versions from 5.4.0 to 8.

**Category:** Zero-day

**Industry:** Technology

**Analyst comments**

The PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619) represent architectural memory-safety flaws. They reside inside the core engine of PHP and are triggered before application code (such as WordPress, Drupal, or Laravel) even executes. Alleged working PoCs are reportedly held by researchers and have been demonstrated on social media, while other claimed PoCs have been released publicly.

Based on user reports on social media, exploitation attempts of this vulnerability began as early as Tuesday, October 20th. We have also observed exploitation attempts against our honeypot environments. However, there are currently no reports of successful organization intrusion using this vulnerability. Analysis of samples from public sandboxes such as VirusTotal between October 20 and 22 found no evidence of backdoors or webshells that would indicate successful exploitation. Initial exploitation attempts are likely being conducted primarily by less sophisticated threat actors using one of the earliest publicly available PoCs. Combined evidence from social media, vendor advisories, and the absence of known breaches indicates that this vulnerability chain is difficult to exploit successfully and is unlikely to succeed at scale. However, it is likely that this could be used for more targeted intrusions against a well-researched target. The latter aligns more with nation-state and espionage-focused groups than financially motivated ones.

What is more likely in the evolution of PoC code is that offsets and configuration items will be gathered to build target profiles, treating the primary PoC as a framework tailored to specific targets based on initial reconnaissance.

**Actionable guidance**

A patch is available that addressesses these vulnerabilities in PHP. In addition to applying the patch, organizations can implement the following temporary mitigations to partially reduce the risk of exploitation:

```
session.upload_progress.enabled = 0
session.use_strict_mode = 1
memory_limit=-1
```

Further hardening can be done if AppArmor is available, to explicitly deny the PHP binary file access to shells such as `/bin/sh`, `/bin/bash`, and similar, with a custom configuration file.

```
Fixed Versions of PHP

PHP 8.5: Update to 8.5.12 or higher
PHP 8.4: Update to 8.4.27 or higher
PHP 8.3: Update to 8.3.36 or higher
PHP 8.2: Update to 8.2.35 or higher
```

## 2. eMudhra Intermediate CA Compromise

**Summary**

The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs and downstream trust stores, have been compromised. In response, major browsers and operating systems have taken steps to block the affected certificates to protect users against potential impersonation attacks.

**Category:** Supply Chain Risk

**Industry:** Multiple

**Analyst comments**

The private keys of eight eMudhra intermediate CA certificates have been compromised, impacting trust from major root programs including Mozilla, Microsoft, Apple, and Chrome. Verification of the compromised keys involved a signed message by the reporter, Wayne, using the private keys of each of the eight intermediate CAs. The compromised certificates have been blocked in various platforms since the 17th of October, with actions taken to protect users through revocation information tools and updates. The private keys were incorrectly generated by the CA with severely weak secret key strings such as 4, 56, 66, 115, 155, 156, 230, 237, allowing anyone to recover them from the certificates. Though CT-enforcing clients were not at risk due to no entries in certificate transparency logs.

An abuse scenario would involve threat actors using the compromised certificates to make phishing-related sites appear legitimate during attacks. This would increase the success rate for threat actor intrusions through a phishing or similar social engineering vector relying on hosted websites. It would also put encrypted in-transit communications at risk if threat actors are able to position themselves as a man-in-the-middle attacker over a network.

**Actionable guidance**

Patch software that uses TLS/SSL certificates, including operating systems, browsers, VPNs, and other internet-connected software. Patch language runtimes that may have made use of these certificates in the past. Revoke certificates issued by eMudhra that may have been saved or in use within the network. Threat hunt for binaries using revoked eMudhra code-signing certificates, especially those observed between October 19th and 20th, which may indicate potential intrusions and abuse. If Go or Go-enabled software such as Docker, Kubernetes, Terraform, and Prometheus is within the network environment, upgrade to the latest Go version to address CVE-2026-111943, which is related to the certificate compromise.

## 3. BeyondTrust zero-day exploited by China-linked group Armory Castle

**Summary**

BeyondTrust confirmed a China-linked threat group, Armory Castle, exploited a zero-day flaw in its Remote Support appliances, highlighting the group's pattern of targeting edge devices for espionage.

**Category:** Threat Actor Activities

**Industry:** Technology, Legal, Public Administration and Government

**Analyst comments**

BeyondTrust confirmed a zero-day flaw (CVE-2026-102764) in their Remote Support appliances was exploited by the China-linked threat group Armory Castle (UNC5221), allowing attackers to perform file operations under certain conditions. The vulnerability received a CVSS score of 9.3, and patches have been released to address it. Users of self-hosted deployments must manually update to a patched version. Research indicates Armory Castle prioritizes zero-day vulnerabilities in edge devices for espionage, and such nation-state attacks differ from cybercriminal activities by focusing on intelligence gathering and remaining undetected. This actor is known for dropping BRICKSTORM malware and exploiting internet-exposed edge devices in previous attacks.

We are not aware of a public PoC abusing this vulnerability. This limits wide exploitation and narrows the potential threat groups making use of it. The report recommends restricting public access to the `/login` and `/appliance` endpoints, suggesting they may be vulnerable. However, this has not been independently verified. Despite efforts to identify additional samples and data in the wild, no samples have been located. This also points to the actor performing targeted intrusions as opposed to operating with this vulnerability at scale.

For persistence, the actor creates `/home/bomgar/sbin/post_boot.d` to host a majority of its scripting files and makes changes to the sudoers file to persist elevated privileges on the compromised host. The actor also deployed an anti-forensic strategy by deleting log files on compromised hosts using simple bash commands for file and folder deletion. The report details that the threat actor elevated user access to root by copying `/bin/sh` to `/usr/bin/dbus-authd` and setting the SUID bit and ownership to root. This was likely more used for persistence rather than privilege escalation, as most Linux-based systems would need to run `chown` or `chmod u+s` to complete this. However, setting user to root with `chown` would imply the user already had root, and the same goes for `chmod` as the SUID bit is set for the current user. This casts doubt on the mechanism by which the threat actor gained elevated privileges.

C2 communication was primarily facilitated by the BARECLAW tunneler, which made TLS-enabled WebSocket requests to `/uidchanarge`, combined with HAProxy setups that pointed to localhost addresses to help hide callback locations. Between this and the anti-forensics employed, network C2 addresses were likely not captured during the original incident. Shortly after compromise, the threat actor attempted to move laterally by logging in as an administrator within the BeyondTrust Remote Support application and established further persistence by altering user permissions from NoAccess to Administrator. Administrator credentials were likely dumped using the `/ns/sbin/bt-secrets` CLI tool.

**Actionable guidance**

Apply available patches to BeyondTrust hosts and rotate sessions and user credentials. It may also be necessary to redeploy from clean versions or backups to ensure intrusion artifacts are removed, followed by applying the most recent patches after a clean redeploy.

If compromise is suspected, look for persistent artifacts on suspected systems, as logs are likely to have been cleared through threat actor anti-forensic activity. This includes a rogue folder named `/home/bomgar/sbin/post_boot.d` with script files contained within, alteration to the sudoers file in relation to the service account user, and suspicious traffic to `/login` and `/appliance` endpoints, as well as unattributable administrator logins to other BeyondTrust applications.

The vulnerability affects BeyondTrust up to and including version 26.2.3. Self-hosted deployments are at the greatest risk; cloud deployments managed by BeyondTrust have already had necessary protections applied.

## 4. Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

**Summary**

Researchers confirmed the active exploitation of a DLL side-loading vulnerability (CVE-2026-110936) in its Software Center. Attackers used a trusted, signed copy of the software to distribute malware through a tactic called ClickFix. The report also examined the broader Romulus multi-payload delivery platform, and outlined defensive measures against these attacks.

**Category:** Threat Actor Activities

**Industry:** Manufacturing, Food and Agriculture, Technology

**Analyst comments**

Researchers confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in the Siemens Software Center. The vulnerability was exploited by placing malicious DLL files alongside a genuine copy of the software, taking advantage of the software's trustworthiness and its practice of loading helper files from its own folder without verification. The attack vector used ClickFix, tricking users into running malicious commands manually, and involved a trojanized installer called AllMyBasic.msi spread through unofficial channels. The exploit leverages a multi-payload delivery platform called Romulus, which can serve various malware payloads, including LegionLoader.

Romulus was also seen in-use recently using ChatGPT lures within ClickFix attacks (see Weekly Situation Report October 5th, 2026). The loader primarily uses .MSI files and PowerShell for initial exploitation into environments after a successful ClickFix attack. The report details that the malware established persistence via scheduled tasks and start-up folders executing "Siemens Software Center" items. The report also specifically mentions that these items are usually present on workstations without the software installed. This is a notable change from previously analyzed samples, as they typically did not include persistence objects. The malware has previously been identified as an information stealer and RAT, with no indication that this aspect has changed in recent versions.

**Actionable guidance**

Organizations should look for SiemensSoftwareCenter.exe in user directories, temp folders, or on machines with no business need for the software. For organizations that use the software during day-to-day business operations, update to version 4.0.9.8 to prevent side-loading of malicious DLLs. Consider restricting PowerShell and Run dialog access, especially for users with no business need for either feature.

If compromise is suspected, look for Siemens-related dropped files in user folders and monitor for IP addresses associated with Dedik Services ASNs, as the panels favor those hosts. While typical variants of this malware do not leave persistence traces, the Siemens variant will leave artifacts in start-up folders and scheduled tasks associated with Siemens technology. ClickFix initiation strings can also be identified by examining RunMRU registry keys for command-related strings that use Base64 or download and execute .msi or similar binaries from user or temporary folders.

—------- TEAROFF: Internal USE ONLY Below this line —-------------------------------------

Internal use only below this line. This section will include data that has either not undergone further research, verification, and so on and is presented as is with light analysis conducted on these items.

Major BREACHES

BAE Systems (US Bankruptcy Courts)https://www.theregister.com/security/2026-10-16/attack-on-bae-managed-system-disrupts-us-bankruptcy-courts/5303487

Assessment: Likely to cause delays in the targeted systems, primarily affecting notices and alerts. No group has claimed responsibility at this time.

Sector: Legal, Public Administration, and Government | Region: US

Burger King Japanhttps://securityaffairs.com/201119/security/burger-king-japan-data-breach-impacted-11-million-customers.html

Assessment: Primarily affects customers who use the BK mobile app. Partial PII, including names and addresses, was leaked. Additional downstream effects at the corporate level are unlikely. No group has claimed responsibility at this time.

Sector: Food and Agriculture | Region: JP

OpenCodehttps://twitter.com/opencode/status/2111516673953935833

Assessment: Credentials were leaked, affecting 1.4 percent of console users. The compromise occurred through the API and resulted in exposed keys for Anthropic, OpenAI, and Google. Damage is primarily financial to users, as charges for unauthorized AI usage were billed to affected accounts.

Sector: Technology | Region: US, EU

ConnectWisehttps://www.theregister.com/security/2026-10-19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758https://www.connectwise.com/company/trust/advisories#faqshttps://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

Assessment: Actively used to gain access to M365 tenants, according to Huntress. A prominent threat to customers. Depending on the level of access gained by the attackers and the credential information stolen, this may translate into longer-term effects overall. Notably, the group used an AI-agent penetration-testing framework known as ARTEX. The group appears to use the framework primarily for password-spraying attacks and to generate malicious traffic that overwhelms defenders while augmenting hands-on-keyboard activity, or to allow the automation to test credential access. ARTEX activity and related attacks should be monitored for evolution; however, the framework is likely not used exclusively in successful attacks and has more likely augmented existing sophisticated playbooks. The responsible actor is known as Storm-0940 and is Chinese in origin, with no other vendor-assigned alias. Most automated password-spraying and credential operations were unsuccessful, with few successes.

Sector: Multiple | Region: Multiple

CapcomReference links: https://www.pcmag.com/news/capcom-suffers-a-breach-affecting-117-million-accounts

Assessment: Over 11 million accounts exposed. No threat actor has claimed responsibility. Downstream phishing is likely for those with active compromised accounts, extending not only to customers but also to retailers and other industry partners. The compromised data consists primarily of partial PII, including names and addresses.

Sector: Media, Entertainment, Technology | Region: US, EU, JP, South Korea