Skip to content
Monday, November 2, 2026Nov 2, 2026
Previous issue

Correction · Nov 2, 2026

This edition was corrected after a source review and published as Monday’s Horizon. It was originally generated on November 2 at 02:50 UTC for the reporting week ending November 1 at 23:55 UTC. It has not been newly generated.

  • Restored the distinction between potential PHP exposure and observed attacks on PAN-OS management interfaces.
  • Clarified the Ivanti federal deadlines and Cursor extension’s attempted, conditional SSH access.
  • Replaced the initial Binance laptop account with the company’s October 30–31 updates; replenishment is distinct from recovery of stolen assets.
  • Corrected .NET wording and typography and removed a teaser for a story absent from the edition.
  • Original generation metadata is retained as provenance; its source-match counts are not a factual review of this correction.

Vol. 1, No. 43Composed Nov 2 · 02:50 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 3 elevated5 stories on the wire

Control your blast radius; automate the small fixes.
— Senecowitz Draper
ⓘAn invented Stoic/VC pen name, paired with this edition’s AI-written reflection.

You are reading a previous issue. Go to the latest edition →

The week behind

PHP Flaws Put Exposed Deployments at Risk

The week behind: PHP, Ivanti, Binance, Cursor and .NET. Federal Ivanti remediation deadlines fall on November 2 and 13.

5 sources

Unit 42, The Hacker News, Microsoft Secure, Binance, BleepingComputer

Unit 42 reported two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. Its telemetry identified more than 22.6 million exposed instances as potentially vulnerable. Observed exploitation targeted internet-facing PAN-OS management interfaces, where attackers chained PHP2Shell with a Linux kernel flaw to gain root access.

Context

The reporting distinguishes potential exposure from observed attacks. Unit 42's broad PHP estimate does not establish compromise of every exposed instance. Separately, The Hacker News reported that CISA added two Ivanti Connect Secure flaws from an exploited chain to its catalog.

“Review each vendor's affected versions and investigation guidance: applying a fix can interrupt an exploit chain, but does not by itself establish that a previously exposed system was never compromised.”
From the analysis

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

A Failed Tunnel Can Still Leave Malicious Artifacts

Microsoft's analysis says the malicious extension can leave SSH keys and persistence artifacts even when tunnelling fails. Its remote-access capability depends on local privileges and configuration. The operational implication is to investigate affected installations even without evidence of a successful tunnel.

Microsoft Secure

The move

4 things to do today

  1. Check affected PHP deployments against vendor guidance. For exposed PAN-OS management interfaces, apply available fixes and remove public management access.
  2. Prioritize affected Ivanti Connect Secure appliances: federal deadlines are November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. Follow vendor remediation and investigation guidance.
  3. For services affected by a financial breach, track the company's verified investigation and recovery updates. Distinguish stolen assets, frozen assets and replacement reserves; avoid treating an initial access theory as a final root cause.
  4. Identify installations of the affected Cursor extension, preserve evidence, and remove confirmed malicious keys and persistence. Revoke exposed credentials or sessions when investigation indicates compromise.

On the wire

  • 1critical
  • 3elevated
  • 1moderate
  • 0low
P0Intelligence

PHP Exposure Estimate Calls for Targeted Remediation

CVE-2026-109618 · CVE-2026-109619 · Potential exposure is not confirmed compromise

Unit 42's estimate of over 22.6 million potentially vulnerable exposed instances is not a count of confirmed compromises. The reported exploitation involved internet-facing PAN-OS management interfaces. The vendor advises applying available fixes and restricting management access.

Previously in SitRep Oct 30: PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls · CVE-2026-109618, CVE-2026-109619

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  5. Oct 30PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls
  6. This edition

Single sourceUnit 42

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

UNIT 42 · Threat Brief: Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Copy link to “PHP Exposure Estimate Calls for Targeted Remediation”

P1Exploit

Ivanti Exploit Chain Brings November Remediation Deadlines

CVE-2026-111357 · CVE-2026-118527 · Federal deadlines November 2 and 13

The Hacker News reports that CISA added two Ivanti Connect Secure flaws to its exploited-vulnerability catalog. Combined with CVE-2026-104935, the chain enables unauthenticated root access. Federal civilian agencies face remediation deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. Affected operators should follow the vendor's guidance.

Previously in SitRep Oct 31: Ivanti Connect Secure Enables Unauthenticated Root · CVE-2026-111357, CVE-2026-118527, CVE-2026-104935

Timeline

  1. Oct 13Ivanti Connect Secure zero‑day CVE-2026-104935 Exploited in the Wild
  2. Oct 14Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935
  3. Oct 31Ivanti Connect Secure Enables Unauthenticated Root
  4. This edition

Single sourceThe Hacker News

Added to CISA KEV: CVE-2026-104935 on 13 Oct 2026; CVE-2026-111357 on 30 Oct 2026; CVE-2026-118527 on 30 Oct 2026 · CVE-2026-111357: CVSS 7.0, EPSS <0.01 (FIRST); CVE-2026-104935: EPSS 0.87 (FIRST)

THE HACKER NEWS · Attackers chain Three Ivanti Connect Secure Flaws to Root Access

Copy link to “Ivanti Exploit Chain Brings November Remediation Deadlines”

P1Breach

Binance Updates Theft Investigation and Asset Replenishment

Oct 30–31 company updates · Initial laptop theory incomplete · Replenishment is not recovery

Binance's October 30 update confirmed about $6.3 billion in unauthorized hot-wallet withdrawals. The company said its initial laptop theory was incomplete and additional breach points had emerged, with no evidence of leaked wallet private keys. Withdrawals were paused while deposits continued.1 On October 31, Binance said company funds had replenished 90% of impacted token assets; that is distinct from recovering stolen funds.2

Single sourceBinance

  1. 1BINANCE · Security incident update #2
  2. 2BINANCE · Recovery update #3: 90% of stolen assets replenished

Copy link to “Binance Updates Theft Investigation and Asset Replenishment”

P1Supply Chain

Malicious Cursor Extension Attempts Persistent SSH Access

Tampered Claude Code-branded extension · Access depends on host conditions

Microsoft analyzed a tampered Claude Code-branded extension distributed through Cursor Marketplace. Its loader attempts to add SSH keys, activate SSH, create a reverse tunnel and persist across restarts. These capabilities do not establish that every step succeeded. Microsoft says Visual Studio Marketplace and the official npm package were unaffected; available evidence limits this incident to Cursor Marketplace.

Single sourceMicrosoft Secure

MICROSOFT SECURE · Inside a Malicious Claude Code Extension and SSH Backdoor

Copy link to “Malicious Cursor Extension Attempts Persistent SSH Access”

P2Patch

Microsoft Releases .NET Updates for Brotli Vulnerability

CVE-2026-111497 · .NET 8, 9 and 10 updates · .NET 11 RC3

BleepingComputer reports Microsoft released emergency updates for .NET applications using vulnerable Brotli decompression. A crafted stream can cause crashes or memory disclosure and, in some cases, code execution. The affected paths include direct Brotli APIs; HTTP request and automatic response decompression are disabled by default and require explicit opt-in.

Previously in SitRep Weekend edition, Oct 31: Microsoft Details Brotli Decoder Buffer Overflow · CVE-2026-111497

Timeline

  1. Oct 27Google Brotli Decoder Flaw Enables Remote Code Execution
  2. Oct 29Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane
  3. Oct 31Brotli Decoder Overflow Affects Palo Alto PAN-OS
  4. Weekend, Oct 31Microsoft Details Brotli Decoder Buffer Overflow
  5. This edition

Single sourceBleepingComputer

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub)

BLEEPINGCOMPUTER · Microsoft patches Critical Brotli Flaw in .NET Out-of-Band

Copy link to “Microsoft Releases .NET Updates for Brotli Vulnerability”

Known exploited

Added 26 Oct – 1 Nov10 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111357Ivanti Connect Secure30 Oct2 Nov
CVE-2026-118527Ivanti Connect Secure30 Oct13 Nov
CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software29 Oct1 Nov
CVE-2026-97229GitLab Community Edition and Enterprise Edition29 Oct1 Nov
CVE-2026-41709Broadcom VMware ESX28 Oct11 Nov
CVE-2026-46300Linux Kernel28 Oct31 Oct
CVE-2026-111497Google Brotli27 Oct10 Nov
CVE-2026-48356Adobe Commerce and Magento27 Oct10 Nov
CVE-2026-109618PHP Group PHP26 Oct29 Oct
CVE-2026-109619PHP Group PHP26 Oct29 Oct

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

End of the Monday, November 2, 2026 Horizon edition.

Colophon

SitRep · Vol. 1, No. 43

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.