Reporting puts the first exploitation of PHP2Shell four days before PHP shipped its fix, and seven of the eight flaws CISA added this week carry exploitation forecasts below 0.03.
SECTION 01
What the signals mean
Events recorded on the Venus decoys fell 26.3% this week, to 963,151 from 1,306,889. Distinct sources fell 3.2%, to 5,321 from 5,498, and sessions rose 8.6%, to 14,539 from 13,388. The Windows surface accounts for 342,624 of the 343,738 events lost. Every other surface together fell 1.5%, to 73,958 from 75,072. 3,015 sources were new and 2,306 had been seen before, against 3,122 and 2,376 in Edition 012.
Exploitation of PHP2Shell began before the patch
Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on a server (Rapid7). PHP shipped emergency patches on 21 October. Amazon says exploitation began four days earlier (Bleeping Computer), and SecurityWeek reports several security companies saw attempts before the patches landed. Exploit code reached Exploit-DB on 22 October. By 23 October Mirai botnet operators had joined in, although The Hacker News reports their attempts to install the Potassium variant failed. On 25 October The Hacker News reported a government entity breached, with signs that the attackers ran AI agent platforms once inside.
CVE-2026-109618 has a CVSS score of 9.8 and an exploitation forecast of 0.9998, the highest in this week’s data. Neither flaw is on CISA’s exploited catalogue. Two days after the emergency patches PHP warned of a further code execution risk with no patch, and shared a mitigation (The Hacker News).
PHP requests on the decoys fell
Requests for server-side script files fell 42.2%, to 3,828 from 6,618, from 158 sources against 202. The most requested were /phpinfo.php with 152, /config.php with 128 and /index.php with 112. PHP remote include requests fell 43.6%, to 75 from 133. Requests carrying the PHPUnit eval-stdin pattern, CVE-2017-9841, rose 133.0%, to 480 from 206.
Eight additions to the exploited list
CISA added eight vulnerabilities to its catalogue of flaws confirmed as exploited, six on 20 October and two on 23 October. Four are in Plex Media Server, scored 4.3, 4.3, 6.5 and 7.2, and reporting says attackers chain them to take over servers and install crypto miners and a Linux proxy backdoor (The Hacker News). The others are SiteGuard Server Edition, Siemens Software Center, Arista VeloCloud Orchestrator and the Collabora Online server app for Nextcloud. The Siemens flaw is a DLL sideloading weakness scored 6.7, reported in ClickFix attacks that deliver a remote access trojan. Arista’s is the third VeloCloud Orchestrator zero-day in four months (SecurityWeek). Seven of the eight carry exploitation forecasts below 0.03. Collabora’s is 0.1233.
Palo Alto reports that the Qilin and INC ransomware groups continue to exploit a patched PAN-OS and Prisma Access flaw, CVE-2026-0257, to bypass multi-factor authentication (The Hacker News). Its forecast is 0.9689.
Forecasts rose on flaws already listed
EPSS estimates the chance that a flaw is exploited in the next 30 days. FortiClient EMS rose from 0.091 to 0.940, Cisco Identity Services Engine from 0.140 to 0.756, AhsayCBS from 0.048 to 0.863 and SolarWinds Serv-U from 0.019 to 0.437. All four are on the CISA catalogue: FortiClient EMS since 6 April, Cisco since 16 September, AhsayCBS since 14 October and Serv-U since 5 June. AhsayCBS entered Edition 012 with a forecast of 0.0478.
Environment files, Git metadata and traversal variants
Requests for secrets and configuration files rose 9.6%, to 23,036 from 21,024, across 970 distinct paths against 1,747. /.env drew 606 requests, /.env.local 270, /.env.development 239 and /.env.production 229. /.git/config rose 36.2%, to 316 from 232. Terraform state fell, /terraform.tfstate to 46 from 76 and /.terraform/terraform.tfstate to 37 from 45, while /site.zip rose to 48 from 22 and /backup.zip to 32 from 21.
Traversal requests fell 7.0%, to 1,933 from 2,079, from 31 sources against 19 and across 220 distinct paths against 83. /@fs/../.env led with 74 requests and /_nuxt/../.env drew 38. /static../.env, /assets../.env and /build../.env drew 38, 37 and 37. They omit the slash after the folder name, a form that can step outside the folder on servers whose aliases lack a trailing slash.
Langflow requests rose
A second Langflow signal appeared: 25 requests from six sources to the auto-login token endpoint and the MCP server list, which show whether an instance is present and whether a follow-up attack could proceed. Requests carrying the exploit itself rose 45.3%, to 109 from 75, from four sources in both weeks.
The fingerprint cluster fell again
The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 116 addresses and produced 3,007 sessions, against 170 addresses and 3,431 sessions in Edition 012. The address count has fallen in each of the last two editions, from 262 in Edition 011. Two other signatures appear in this edition for the first time: a cookie value rdp-async with 373 sessions from 15 sources, and TLS fingerprint 43016d7f7f93 with 173 sessions from 3 sources.
Scanners, databases and logins rose
Automated scanner and recon tooling rose 122.5%, to 939 requests from 422, from 106 sources against 93. Database events rose 30.4%, to 1,189 from 912, and Auth events 30.9%, to 2,583 from 1,973. MySQL credential attack requests rose 40.5%, to 843 from 600. VPN events fell 26.2%, to 3,703 from 5,016, after doubling in Edition 012. Gateway fingerprinting reached 7 requests from 2 sources, against 1 from 1.
AI agents in the reporting
Reporting this week describes AI agents running intrusions: the Cairn penetration-testing tool abused against more than 100 organisations (SecurityWeek) and 1,200 sites (The Hacker News), and the ARTEX agents in the ConnectWise supply chain attack (The Hacker News). Venus labelled 32 sessions as suspected agentic reconnaissance.
My view
None of the 25 vulnerabilities Medulus flagged this week appears among the 17 identifiers Venus recorded. 17 of the 25 carry 2026 identifiers, while 8,322 of the 8,523 CVE-identified hits on the decoys, 97.6%, carry identifiers from 2022 or earlier. Disclosures and decoy requests are mostly different lists, which makes two patching jobs: one driven by the news and one by old exposure.
Secrets are the subject both feeds share. The decoys saw 23,036 requests for configuration files and 316 for Git metadata, up 36.2%. The reporting names a leaked master key at LiteLLM, Railway‘s request that customers rotate secrets, API keys exposed in the OpenCode breach and more than 70,000 credentials exposed by breaches of firewalls and VPNs. A request for an .env file asks for the kind of material those incidents report losing.
PHP2Shell and Arista’s orchestrator were used before a patch existed, and the Plex chain within hours of disclosure. All eight flaws CISA added were exploited, and seven were forecast below 0.03. I prioritise on the exploited list first and the forecast second.
What to act on
Apply PHP’s 21 October patches first. Plex Media Server, Collabora’s Nextcloud app, Siemens Software Center, SiteGuard and VeloCloud Orchestrator follow, with federal deadlines running from 23 October to 3 November. Raise the priority of FortiClient EMS, Cisco ISE and Serv-U, where forecasts rose on flaws already exploited. Remove environment files, Git directories, Terraform state and site archives from any path a web server can reach.
19 Oct – 25 Oct 2026
19 Oct – 25 Oct 2026
963,151 external events (−26.3%). 5,321 distinct sources (−3.2%). 14,539 sessions (+8.6%).
Against Edition 012’s published figures, events fell from 1,306,889 to 963,151, sources from 5,498 to 5,321 and sessions rose from 13,388 to 14,539. New sources fell 3.4%, to 3,015 from 3,122, and returning sources fell 2.9%, to 2,306 from 2,376. By surface, Shell fell 2.6% to 17,787 from 18,258, Web rose 4.1% to 42,416 from 40,743, Database rose 30.4% to 1,189 from 912, API fell 23.0% to 3,144 from 4,082, Portal fell 23.3% to 3,136 from 4,088, Auth rose 30.9% to 2,583 from 1,973, VPN fell 26.2% to 3,703 from 5,016, Windows fell 27.8% to 889,193 from 1,231,817. 1,035 campaigns were active and 596 are flagged recurring.
Ranked signals
| Rank | Signal | Events | Ed. 012 | Change | Sources | Score |
|---|---|---|---|---|---|---|
| 1 | Webshell / RCE Script Probing | 3,828 | 6,618 | −42.2% | 158 | 0.4743 |
| 2 | AI Workflow Builder Probing | 25 | none | new | 6 | 0.4500 |
| 3 | PHP Injection / Remote Include | 75 | 133 | −43.6% | 15 | 0.4115 |
| 4 | AI Workflow Builder Exploit Attempts | 109 | 75 | +45.3% | 4 | 0.4067 |
| 5 | Automated Scanner / Recon Tooling | 939 | 422 | +122.5% | 106 | 0.3819 |
| 6 | VPN Gateway Fingerprinting | 7 | 1 | +600.0% | 2 | 0.3500 |
| 7 | MySQL Credential Attack | 843 | 600 | +40.5% | 89 | 0.3090 |
| 8 | Sensitive File & Secret Exposure | 23,036 | 21,024 | +9.6% | 169 | 0.2755 |
| 9 | Directory / Path Traversal | 1,933 | 2,079 | −7.0% | 31 | 0.2410 |
| 10 | SSH Invalid-User Enumeration | 17,008 | 17,394 | −2.2% | 362 | 0.2130 |
| 11 | SSH Campaign Targeting | 1,526 | 1,832 | −16.7% | 178 | 0.2022 |
| 12 | Admin Console Discovery | 1,574 | 1,942 | −18.9% | 116 | 0.2014 |
| 13 | SSH Access Probing | 17,787 | 18,258 | −2.6% | 721 | 0.1683 |
| 14 | SMB Access Probing | 136,445 | 146,283 | −6.7% | 2,329 | 0.1453 |
| 15 | SMB Credential Attack | 124,784 | 128,006 | −2.5% | 54 | 0.1277 |
| 16 | WordPress Plugin Probing | 2 | 3 | −33.3% | 1 | 0.0726 |
Atlassian Data Center exploit attempts fell to 0 from 2 and SQL injection probing to 0 from 1.
Remote desktop fingerprint campaigns
| Client signature | Sessions | Ed. 012 | Change | Sources | Ed. 012 | Change |
|---|---|---|---|---|---|---|
TLS 73ede1f461b6 | 3,007 | 3,431 | −12.4% | 116 | 170 | −31.8% |
| RDP cookie "rdp-async" | 373 | not published | – | 15 | not published | – |
| TLS 43016d7f7f93 | 173 | not published | – | 3 | not published | – |
Fingerprint 73ede1f461b6 fell from 170 addresses to 116. The "hello" and "anonymous" cookies and TLS fingerprint 43e25370946f, all published in Edition 012, are no longer among the ten largest campaigns, the smallest of which ran 173 sessions.
Path families
| Family | Events | Ed. 012 | Change | Paths | Ed. 012 | Sources | Most requested |
|---|---|---|---|---|---|---|---|
| Sensitive File & Secret Exposure | 23,036 | 21,024 | +9.6% | 970 | 1,747 | 169 | /.env (606), /.git/config (316) |
| Backup & Archive Download Probing | 424 | 408 | +3.9% | 27 | 99 | 29 | /site.zip (48), /terraform.tfstate (46) |
| Webshell / RCE Script Probing | 3,828 | 6,618 | −42.2% | 590 | 1,773 | 158 | /phpinfo.php (152), /config.php (128) |
| Admin Console Discovery | 1,574 | 1,942 | −18.9% | 157 | 377 | 116 | /admin/.env (118), /dashboard/.env (83) |
| Directory / Path Traversal | 1,933 | 2,079 | −7.0% | 220 | 83 | 31 | /@fs/../.env (74), /_nuxt/../.env (38) |
| SQL Injection Probing | 0 | 1 | −100.0% | 0 | 1 | 0 | – |
Distinct paths fell in every family except traversal, which rose to 220 from 83. Sensitive-file paths fell to 970 from 1,747, webshell paths to 590 from 1,773 and admin paths to 157 from 377. Two of the three most requested admin paths end in .env.
Representative paths
| Secrets and configuration | Events | Ed. 012 | Backup and archive | Events | Ed. 012 |
|---|---|---|---|---|---|
/.env | 606 | 641 | /site.zip | 48 | 22 |
/.git/config | 316 | 232 | /terraform.tfstate | 46 | 76 |
/.env.local | 270 | 319 | /.terraform/terraform.tfstate | 37 | 45 |
/.env.development | 239 | 193 | /backup.tar.gz | 32 | not published |
/.env.production | 229 | 273 | /backup.zip | 32 | 21 |
/.git/config rose 36.2% and /.env.development 23.8%, while /.env, /.env.local and /.env.production fell.
Behaviour progression
300 sessions carried behaviour from two or more distinct stages, against 327 in Edition 012.
| Ordering | Sessions | Ed. 012 | Change | Sources | Ed. 012 | Busiest source | Evasive |
|---|---|---|---|---|---|---|---|
| Discovery, then Exploitation | 250 | 246 | +1.6% | 156 | 160 | 20 (8.00%) | 4.66% |
| Exploitation, then Discovery | 50 | 81 | −38.3% | 49 | 63 | 2 (4.00%) | 28.00% |
Evasive sessions fell to 4.66% of the forward ordering from 5.44%, and rose to 28.00% of the reverse from 25.93%. The busiest source’s share fell in both, to 8.00% from 8.54% and to 4.00% from 7.41%.
Vulnerability mapping
| Identifier | Description | Hits | Ed. 012 | Change | Sources | KEV |
|---|---|---|---|---|---|---|
| CWE-312 | Cleartext secrets (.env) | 18,457 | 17,430 | +5.9% | 113 | no |
| CVE-2021-41773 | Apache traversal | 3,846 | 6,633 | −42.0% | 161 | yes |
| CVE-2019-0232 | Tomcat CGI | 3,828 | 6,618 | −42.2% | 158 | no |
| CWE-527 | Exposed Git | 2,084 | 1,967 | +5.9% | 115 | no |
| CVE-2017-9841 | PHPUnit eval-stdin | 480 | 206 | +133.0% | 20 | yes |
| CVE-2012-1823 | PHP-CGI argument injection | 75 | 133 | −43.6% | 15 | yes |
| CVE-2025-3248 | Langflow code validation | 49 | 30 | +63.3% | 4 | yes |
| CVE-2026-0768 | Langflow code injection | 49 | 30 | +63.3% | 4 | no |
| CVE-2023-2982 | WordPress login bypass | 43 | 108 | −60.2% | 16 | no |
| CVE-2025-59528 | Flowise CustomMCP | 40 | 30 | +33.3% | 2 | no |
17 identifiers were reached, against 20, and 8 are on the KEV catalogue, against 9. CVE-2022-22963 drew 38 hits from 9 sources, against 50, CVE-2026-33017 20 from 2, against 15, and Spring4Shell, CVE-2022-22965, 19 from 5, against 8. CVE-2021-42013 drew 18 from 11, against 15, and CWE-22 drew 15 from 3, against 1. CVE-2017-12629 and CVE-2021-27905 each drew 9, against 4. Log4Shell and CVE-2026-21589 recorded no hits, against 1 and 2.
Medulus correlation
25 vulnerabilities qualified this period, against 24 in Edition 012. Eight entered the CISA Known Exploited Vulnerabilities catalogue, on 20 and 23 October.
| Product | Identifier | CVSS | EPSS | Added | Due | Reported exploitation |
|---|---|---|---|---|---|---|
| SiteGuard Server Edition | CVE-2026-106931 | 7.8 | 0.0253 | 20 Oct | 23 Oct | The Hacker News |
| Plex Media Server | CVE-2026-96656 | 7.2 | 0.0179 | 20 Oct | 23 Oct | Bleeping Computer, SecurityWeek |
| Plex Media Server | CVE-2026-96654 | 6.5 | 0.0195 | 20 Oct | 23 Oct | The Hacker News |
| Plex Media Server | CVE-2026-96652 | 4.3 | 0.0182 | 20 Oct | 3 Nov | The Hacker News |
| Plex Media Server | CVE-2026-96655 | 4.3 | 0.0164 | 20 Oct | 3 Nov | – |
| Siemens Software Center | CVE-2026-110936 | 6.7 | 0.0097 | 20 Oct | 3 Nov | The Hacker News, SecurityWeek |
| Arista VeloCloud Orchestrator | CVE-2026-114625 | 9.9 | 0.0103 | 23 Oct | 26 Oct | SecurityWeek, Bleeping Computer |
| Collabora Online (Nextcloud) | CVE-2026-110447 | not rated | 0.1233 | 23 Oct | 26 Oct | The Hacker News |
Seven of the eight have an EPSS score below 0.03. EPSS is a forecast of exploitation within 30 days. The Plex flaws are an SSRF, a plugin call flaw and a file write executed at startup, and SecurityWeek reports the chain was weaponised hours after disclosure. The Collabora flaw is an OS command injection in the Nextcloud app’s built-in server, reported as exploited in September and October. Arista’s flaw lets an authenticated user gain operator privileges; hosted deployments were already patched.
CVE-2026-109618 has an EPSS of 0.9998, a CVSS of 9.8 and a public exploit, Exploit-DB 52704. It is not on the catalogue. Citrix NetScaler CVE-2026-88771 (CVSS 9.8, EPSS 0.8216) and CVE-2026-88772 (8.1, 0.7816) were listed on 27 September, and CVE-2026-88773, an HTTP request smuggling flaw scored 10.0, is not listed and has an EPSS of 0.0336. Metasploit changed its NetScaler module on 22 October, and Rapid7 analyses intrusions chaining CVE-2026-88771 with CVE-2026-88779. Ten Metasploit modules changed: the NetScaler exploit and nine Meterpreter payloads.
Exploit-DB published 11 entries. Three carry identifiers: PHP2Shell, Keycloak CVE-2026-18963, an unauthenticated account takeover scored 9.1, and Open eClass CVE-2024-26503, a file upload leading to code execution scored 9.1. Other reporting: a public proof of concept for FortiSIEM CVE-2026-106173 (The Hacker News), a Node.js Brotli decoder flaw, CVE-2026-111497, with a demonstrated exploit (The Hacker News), a critical Pillow flaw, CVE-2026-112900 (The Hacker News), and a GitLab flaw scored 10.0 that allows unauthenticated code execution across 12 years of releases (The Hacker News). CISA published eight advisories, among them the Kiloview E3 NDI Encoder (nine identifiers), the PEAK-System PCAN Windows drivers (six) and HAPI FHIR (four), and the PHP advisory VA-26-295-01.
Supply chain compromises were reported at LiteLLM (Bleeping Computer), five OVHcloud CLI releases (Bleeping Computer), the Rank Math PRO WordPress plugin (Bleeping Computer) and the AOMEI Backupper update servers (Bleeping Computer). ConnectWise reset credentials and kept its cloud backup offline (The Hacker News). Reporting named 10 malware families and 13 threat actors. Mirai and its Potassium variant appear in the PHP2Shell reporting, Qilin in the PAN-OS reporting and Storm-0940 in the ConnectWise intrusion. Medulus recorded certificates for two lookalike domains of known brands, linkedin-verify.com and zalado.com. A certificate on a lookalike name is not proof of impersonation.
Venus and Medulus together
None of the 25 vulnerabilities qualified by Medulus appears among the 17 identifiers recorded on the decoys. The feeds meet on secrets and on Langflow.
| Subject | Medulus | Venus | Overlap |
|---|---|---|---|
| PHP2Shell | Exploited before the patch, EPSS 0.9998, not on the catalogue (Rapid7) | Script file requests −42.2%, PHP remote include −43.6%, PHPUnit pattern +133.0% | No shared identifier |
| Langflow | Edition 012 reported CVE-2026-105740 with 1,423 honeypot attempts (The Hacker News) | Exploit requests +45.3% to 109, and a new probing signal of 25 requests from 6 sources | Reported last week; requests rose this week |
| Secrets | Leaked keys, rotated secrets and exposed API keys at LiteLLM, Railway, OpenCode and OVHcloud; 70,000 credentials from firewalls and VPNs | Configuration file requests +9.6%, /.git/config +36.2% | Same target |
| Gateways | NetScaler, PAN-OS and Arista, all exploited | VPN events −26.2%; gateway fingerprinting 7 requests from 2 sources | No shared identifier |
| Scanning | PHP2Shell reported amid global scanning (The Hacker News) | Scanner and recon requests +122.5% from 106 sources | Same week, no link established |
| AhsayCBS | EPSS 0.048 to 0.863, web shells reported in Edition 012 | Webshell script requests −42.2% | Opposite directions |
Technical checks for the week
- Patch: PHP to the 21 October emergency release. Plex Media Server to 1.43.3.10861 or later. Collabora Online built-in CODE server to 26.4.303 or later. Siemens Software Center to V4.0.9.8 or later. NetScaler to 14.1-73.37 or 13.1-64.23.
- Patch: SiteGuard Server Edition and on-premises Arista VeloCloud Orchestrator, per their vendors. AhsayCBS to 10.3.4, with a forecast now at 0.863.
- Prioritise: FortiClient EMS, Cisco ISE and SolarWinds Serv-U. Each is on the CISA catalogue and each forecast rose this week.
- Review: Palo Alto PAN-OS and Prisma Access against CVE-2026-0257, which ransomware groups are reported to use to bypass multi-factor authentication.
- Remove: Terraform state, site archives,
.gitdirectories and every.envvariant from web-reachable paths. - Check: Web server folder aliases end in a slash, so a request for a folder name followed by two dots cannot step outside it.
Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. Every observed request is an attempt. Week-on-week comparisons are drawn from the figures published in Edition 012.