Today’s Field Note

Three things worth your morning. PHP shipped an out-of-cycle fix for two unauthenticated RCE bugs (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) after the details leaked early, so the window between disclosure and mass scanning is effectively closed. Separately, a public PoC now exists for the FortiSIEM path traversal (CVE-2026-106173, CVSS 9.4), meaning unauthenticated code execution against your logging stack is in reach of anyone. And Palo Alto confirms Qilin and INC ransomware crews are still exploiting CVE-2026-0257 to stand up rogue VPN connections and skip MFA, a bug patched back in May that plenty of shops never closed. None of these are theoretical. The PHP flaw hits anything running the stack, and the Fortinet and PAN-OS issues sit on exactly the boxes attackers love.

Today’s Action

  • Patch PHP to the out-of-cycle release immediately on all internet-facing hosts; audit for unexpected processes spawned by php-fpm or webserver accounts.
  • Apply the FortiSIEM fix for CVE-2026-106173 now, and restrict management interface access to trusted networks until confirmed patched.
  • Verify PAN-OS and Prisma Access are patched for CVE-2026-0257, then review GlobalProtect logs for unauthorized or newly created VPN sessions.
  • Check for forged certificates tied to the eight revoked eMudhra intermediate CA keys and push browser/OS updates that block them.
  • If you run UpdraftPlus/UpdraftCentral, rotate connection keys and scan connected WordPress sites for planted backdoors.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

The patch was ready. You just hadn’t applied May’s yet.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.