FOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in php2shell, Plex2Shell, PAN-OS, Drupal Core, GitLab, Oracle WebLogic, BeyondTrust Remote Support, Fortinet, and Apache Tomcat

Introduction

This week's Focus Friday highlights nine significant vulnerability and threat events that TPRM professionals must prioritize when assessing third-party exposure. The week brought two critical PHP core remote code execution flaws (php2shell), a weaponized Plex Media Server exploit chain (Plex2Shell) actively used to deploy cryptominers, an authenticated-but-actively-exploited Palo Alto PAN-OS code injection flaw (CVE-2026-0322), critical Drupal Core RCE and XSS vulnerabilities, two CVSS 10.0 GitLab unauthenticated RCE flaws, multiple high-severity Oracle WebLogic flaws from the October 2026 CPU, a China-nexus APT-exploited BeyondTrust Remote Support zero-day active since August, a Fortinet FortiMail flaw confirmed in CISA KEV alongside a critical FortiSIEM PoC, and a batch of Apache Tomcat fixes including a CVSS 9.1 HTTP/2 vulnerability.

Together, these events underscore the breadth of the attack surface facing enterprise supply chains this week. TPRM professionals should assess vendor exposure across each affected product category and prioritize remediation conversations for vendors operating CISA KEV-listed or actively exploited vulnerabilities. Black Kite's FocusTag® intelligence provides context on which vendors in your portfolio are exposed and the relative urgency of each disclosure.

Filtered view of vendors with the php2shell FocusTag® on the Black Kite platform.

php2shell

What is this vulnerability?

php2shell refers to two critical remote code execution (RCE) vulnerabilities in the PHP core — CVE-2026-109618 and CVE-2026-109619 — both rated CVSS v4.0 9.2 (Critical) and classified as CWE-416 (use-after-free). Details leaked on October 20, 2026, ahead of the scheduled coordinated disclosure, prompting PHP to move its emergency release one day earlier to October 21, 2026 at 14:00 UTC. Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Source backports exist for the end-of-life 7.4, 8.0, and 8.1 branches; PHP 7.3 and earlier (and 5.x) receive no official fix and must be taken offline or upgraded.

CVE-2026-109618 is an out-of-memory (OOM) corruption bug: when PHP's memory limit is hit during request startup, internal request state can be partially initialized. The request shutdown procedure then operates on that invalid state, enabling RCE. Apache mod_php is at highest risk because it invokes shutdown even when startup failed. CVE-2026-109619 is a stale global state bug: request-owned state can survive after its backing memory is freed; a later request on the same worker may consume that stale state before initialization resets it. Session upload progress (enabled by default) is the primary attack path against both mod_php and PHP-FPM. A working unauthenticated exploit was demonstrated against mod_php with a default configuration. As of October 22, neither CVE is in the CISA KEV catalog, but active exploitation attempts have been observed by multiple threat intelligence providers.

Black Kite Shodan analysis found approximately 1.9 million internet-facing PHP hosts, of which 72.5% of those disclosing a version run end-of-life branches with no official patch. The affected ecosystem includes WordPress (~538K internet-facing instances), Drupal, Joomla, Magento/Adobe Commerce, Laravel (~141K), Nextcloud (~107K), phpMyAdmin, Roundcube, and cPanel/Plesk.

On October 23, 2026, PHP disclosed a third, separate RCE path, CVE-2026-115560, also reachable through session upload progress. It is not part of php2shell and is not fixed by the October 21 releases. The precondition is narrow — an application must set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime with ini_set() before session_start(), with session upload progress still enabled — so PHP rates it “unlikely” and is addressing it in a routine release (no CVSS or affected-version list published yet). The same mitigation applies: session.upload_progress.enabled = 0. Anyone who applied that mitigation for php2shell is already covered.

Beyond RCE, the official advisory also confirms memory disclosure: worker memory can leak into a PHPSESSID cookie, potentially exposing credentials, session tokens, API keys, or even TLS private keys.

Black Kite has published a detailed technical analysis of php2shell — covering CVE details, the disclosure timeline, exposure data, detection indicators, and supply chain impact. Read the full report: blackkite.com/blog/php2shell-two-critical-remote-code-execution-vulnerabilities-in-the-php-core-

Why should TPRM professionals care?

PHP is the invisible foundation of third-party ecosystems. Even organizations running no PHP themselves are exposed through the web portals, customer panels, e-commerce infrastructure, and SaaS platforms of their critical suppliers. With 72.5% of version-disclosing PHP hosts on EOL branches, the 'just patch it' directive applies to fewer than a third of exposed systems — the rest require branch upgrades or decommissioning. The exploit is unauthenticated, works against default PHP configurations, and a working PoC exists. Mass exploitation is expected imminently. Sansec warned that large-scale attacks were likely within 15 minutes of patch release. From a supply chain standpoint, this is a textbook cascading risk: a single core flaw travels downstream through third and fourth parties relying on PHP-based applications.

What questions should TPRM professionals ask vendors?

1. Do any of your internet-facing applications, web portals, or APIs run PHP, and have you updated to 8.2.35, 8.3.36, 8.4.27, or 8.5.12?
2. What PHP branches are your production systems running, and do any use end-of-life branches (PHP 8.1 or earlier)? If so, what is your upgrade or decommissioning timeline?
3. Have you disabled session.upload_progress in php.ini as an interim mitigation for CVE-2026-109619 while patching is in progress?
4. Do your Apache mod_php installations receive the highest priority for emergency patching, given that mod_php is rated at highest risk by the PHP security team?
5. Do your WAF rules (e.g., Cloudflare, AWS WAF) include coverage for php2shell-style multipart request anomalies, and have you confirmed those rules are active on all PHP-serving endpoints?
6. Have you audited your CMS platforms (WordPress, Drupal, Joomla, Magento, Nextcloud) to ensure the underlying PHP engine is updated to a fixed version?
7. Are any of your applications in the narrow configuration affected by CVE-2026-115560 (switching session.serialize_handlerto php at runtime via ini_set() before session_start()), and have you applied the session.upload_progress.enabled = 0 mitigation that also covers it?

Remediation recommendations

• Update PHP to the fixed version for your branch immediately: 8.2.35, 8.3.36, 8.4.27, or 8.5.12; prioritize internet-facing Apache mod_php installations.
• For EOL branches (7.4, 8.0, 8.1): apply PHP's minimal source backports or check your Linux distribution's security tracker; for 7.3 and older, upgrade or take systems offline.
• Set session.upload_progress.enabled = 0 in php.ini as an interim measure for CVE-2026-109619; on PHP 8.5, also set fatal_error_backtraces = 0.
• For CVE-2026-109618 on mod_php: enforce memory_limit and post_max_size at the server level (php_admin_value) to reduce OOM-trigger attack surface — this is not a complete fix but reduces the window while patching.
• Monitor PHP worker processes for suspicious child processes (sh, bash, wget, curl, nc) and treat 5xx error spikes as a potential exploitation signal.
• Deploy or verify WAF emergency rules (Cloudflare Managed Ruleset published coverage on October 21); note that WAF rules do not fully substitute for patching.
• If you rely on rpms.remirepo.net for PHP packages: switch to distribution packages or build from source, as this volunteer repository did not have updates on the day of release.
• The session.upload_progress.enabled = 0 mitigation also covers the separate CVE-2026-115560; keep it in place until PHP ships the routine-release fix. Set it administratively (php_admin_flag) and restart — not reload — every worker, then verify on the SAPI that serves traffic (not the CLI).
• Assume a pre-patch window and rotate secrets: because this is also a memory-disclosure bug and attacks were seen before the patch, rotate anything that lived in PHP worker memory — application keys (e.g. Laravel APP_KEY), database credentials, API keys, and any origin TLS private keys on the same host.

Black Kite's php2shell FocusTag® details critical insights on the event for TPRM professionals.

Plex2Shell

What is this vulnerability?

Plex2Shell is a four-CVE exploit chain enabling unauthenticated remote code execution on Plex Media Server, discovered by researcher Zach Main and publicly disclosed on October 16–17, 2026. Attackers weaponized the exploit within hours of public disclosure and have been observed deploying the XMRig cryptominer on compromised servers. All four CVEs have been added to the CISA Known Exploited Vulnerabilities catalog. The fix is Plex Media Server version 1.43.3.10861. Shadowserver data shows approximately 49,000 Plex servers remained exposed as of publication.

The chain works in sequence: CVE-2026-96652 (SSRF via /player/timeline) and CVE-2026-96655 (SSRF via the transcode endpoint) are used to probe internal services; CVE-2026-96654 exploits improper URL neutralization in the searchOne endpoint to steal the server owner's admin token; and CVE-2026-96656 uses external control of a file path to write a malicious ELF shared object into the Codecs directory, which Plex then executes. In combination, these steps allow an unauthenticated attacker to gain code execution as the Plex server process.

Why should TPRM professionals care?

Plex Media Server is widely deployed on both consumer and enterprise networks, often with access to large libraries of media files and sometimes running with elevated OS privileges. Active in-the-wild exploitation is confirmed, with cryptominer deployment observed. Vendors in media, entertainment, IT operations, and distributed enterprise environments are at risk. Because the attack chain is unauthenticated and a public PoC exists, any Plex instance older than 1.43.3.10861 that is accessible from the network should be treated as imminently at risk. The CISA KEV designation further signals urgency for federal and regulated-sector vendors.

What questions should TPRM professionals ask vendors?

1. Do any of your corporate endpoints, servers, or managed environments run Plex Media Server, and have all instances been updated to version 1.43.3.10861 or later?
2. Is your Plex Media Server accessible from the internet or only from trusted internal networks? If internet-facing, what controls are in place to limit exposure?
3. Have you scanned your Plex-hosting systems for indicators of the XMRig cryptominer or other post-exploitation artifacts associated with Plex2Shell?
4. Do you monitor outbound network connections from Plex server processes for anomalous traffic patterns (e.g., connections to mining pool endpoints)?

Remediation recommendations

• Update Plex Media Server to version 1.43.3.10861 or later on all endpoints immediately.
• If an immediate update is not possible, restrict network access to Plex Media Server so it is not reachable from the internet or untrusted networks.
• Scan compromised or suspect hosts for XMRig installation, unexpected scheduled tasks or systemd services, and newly written files in the Plex Codecs directory.
• Review outbound network connections from Plex server hosts for connections to known mining pool addresses or residential proxy endpoints.
• Confirm CISA KEV remediation status for all four CVEs (CVE-2026-96652, -96654, -96655, -96656) within your organization's KEV tracking process.

Black Kite's Plex2Shell FocusTag® details critical insights on the event for TPRM professionals.

PAN-OS - Oct2026

What is this vulnerability?

CVE-2026-0322 is a code injection vulnerability in the Palo Alto Networks PAN-OS management interface, rated CVSS 4.0: 8.6 (High) and classified as CWE-94. An authenticated attacker with network access to the management interface can inject code that executes with root privileges on the firewall or Panorama appliance. Palo Alto Networks assigned this flaw its highest remediation urgency rating. The advisory was published October 14, 2026; patches shipped October 15. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14, with a federal remediation deadline of October 17, 2026.

Affected products include PA-Series and VM-Series firewalls and Panorama appliances (virtual and M-Series). Palo Alto confirmed 'very limited active exploitation' targeting the management interface. The primary recommended mitigation is to restrict management interface access to trusted internal IP addresses only, ideally through a hardened jump server. There is no complete workaround for CVE-2026-0322; patching is required.

Why should TPRM professionals care?

Network firewalls and security appliances represent the perimeter defense of enterprise environments. Successful exploitation of CVE-2026-0322 yields root-level access to the firewall — an adversary with root on a next-generation firewall can intercept, modify, or drop traffic, disable logging, and pivot into connected network segments. The authentication requirement is a partial constraint, but privileged credential compromise is a common precursor in nation-state and ransomware campaigns. Vendors relying on Palo Alto PAN-OS for network security — particularly those with internet-exposed management interfaces — are at elevated risk. The CISA KEV designation and Palo Alto's own highest urgency rating reflect confirmed in-the-wild exploitation.

What questions should TPRM professionals ask vendors?

1. Have your PA-Series and VM-Series firewalls and Panorama appliances been patched with the October 15, 2026 PAN-OS update addressing CVE-2026-0322?
2. Is the PAN-OS management interface restricted to trusted internal IP addresses only, and is access channeled through a dedicated, hardened jump server or bastion host?
3. Have you reviewed management interface access logs for anomalous authentication activity or configuration changes since the advisory publication date of October 14?
4. Do you maintain a compensating control process for critical firewall vulnerabilities that restricts management access while emergency patches are applied?

Remediation recommendations

• Apply the October 15, 2026 PAN-OS patches for CVE-2026-0322 to all PA-Series and VM-Series firewalls and Panorama appliances immediately.
• Restrict PAN-OS management interface access to a dedicated management VLAN with specific trusted source IP addresses; remove any internet-facing exposure of the management interface.
• Require all management plane access to route through a hardened bastion/jump host with strong multi-factor authentication.
• Audit management interface access logs for the period before patching for indicators of unauthorized access or anomalous administrative commands.
• Confirm remediation against CISA KEV requirements within your organization's SLA; federal agencies had an October 17 deadline.

Black Kite's PAN-OS - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

Drupal Core

What is this vulnerability?

On October 14, 2026, Drupal released a batch of security advisories covering its core CMS platform. The most critical is CVE-2026-108097 (SA-CORE-2026-014), a remote code execution vulnerability in the Field UI module rated 19/25 by Drupal's scoring system. While the flaw cannot be exploited through Drupal core alone, contributed modules — which are nearly universal in production Drupal deployments — can expose exploitation paths, including at least one that requires no authentication. A technical writeup and proof-of-concept were published around October 20, 2026, elevating the immediate exploitation risk. The same release addressed two moderately critical cross-site scripting issues in the Link field type.

Fixed versions: Drupal 11.4.10, 11.3.19, and 10.6.19. Drupal 12.0.0-alpha1 through 12.0.0-beta1 are also affected and must be updated. Drupal 11.2.x and earlier, 10.5.x and earlier, Drupal 9, and Drupal 8.9 are end-of-life and receive no patch. The contributed Entity List module also has a critical RCE (CVE-2026-108099, rated 19/25) fixed in version 3.0.10.

Why should TPRM professionals care?

Drupal powers a significant share of government, healthcare, nonprofit, and enterprise websites globally. An unauthenticated RCE vulnerability in a widely-used CMS translates directly to full website takeover, data exfiltration, defacement, and use as a launchpad for further attacks. With a public PoC now available, organizations running unpatched Drupal should expect active exploitation attempts. End-of-life Drupal versions (9, 8.9 and older) receive no patch and represent a permanent risk if not upgraded. Third-party vendors maintaining Drupal-based portals, extranets, or customer-facing applications are a direct supply chain exposure for TPRM teams.

What questions should TPRM professionals ask vendors?

1. Have all Drupal installations in your environment been updated to 11.4.10, 11.3.19, or 10.6.19 to address CVE-2026-108097?
2. Do any of your Drupal deployments run end-of-life branches (Drupal 9, 8.9 or older) that will not receive a patch, and if so, what is the plan for upgrade or decommissioning?
3. What contributed modules are installed on your Drupal sites, and have you assessed which ones may expose the Field UI vulnerability to unauthenticated users?
4. Has the Entity List module been updated to 3.0.10 on all affected sites?
5. Have you implemented WAF rules or web server restrictions to block exploitation of the publicly available proof-of-concept since October 20?

Remediation recommendations

• Update Drupal core to 11.4.10, 11.3.19, or 10.6.19 immediately; update Drupal 12.0 alpha/beta instances to the patched release.
• For end-of-life Drupal branches: migrate to a supported version as soon as possible; apply WAF rules as a temporary compensating control.
• Update the Entity List contributed module to version 3.0.10.
• Audit contributed modules for permissions that expose Field UI functionality to unauthenticated or low-privilege users; restrict or disable where not required.
• Deploy WAF rules targeting the CVE-2026-108097 PoC exploitation pattern, particularly for public-facing Drupal instances.

Black Kite's Drupal Core FocusTag® details critical insights on the event for TPRM professionals.

GitLab - Oct2026

What is this vulnerability?

October 2026 brought two separate CVSS 10.0 remote code execution vulnerabilities to GitLab Community Edition (CE) and Enterprise Edition (EE), alongside four additional high-severity flaws. The most critical, CVE-2026-110264, was patched on October 21 and affects every self-managed GitLab CE/EE version back to 7.0 (released in 2014). An unauthenticated attacker can exploit it to execute code on the server without logging in. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. No in-the-wild exploitation of CVE-2026-110264 has been confirmed as of October 22.

A prior CVSS 10.0 flaw, CVE-2026-97229 (patched October 12), involves a CI/CD regular expression compiler RCE. Organizations that applied only the October 12 patch remain vulnerable to CVE-2026-110264. CVE-2026-90970 (CVSS 9.9) affects self-hosted AI Gateway instances only. The batch also includes improper authorization (CVE-2026-16301, CVSS 8.5) and cache-poisoning flaws (CVE-2026-14814, CVE-2026-112212). GitLab.com and GitLab Dedicated are already patched.

Why should TPRM professionals care?

GitLab is the backbone of software development lifecycles for many vendors. A compromised self-managed GitLab instance can lead to source code theft, supply chain injection (malicious code committed to vendor repositories), CI/CD pipeline manipulation, and access to deployment secrets and credentials. With CVE-2026-110264 affecting every version since 2014 and two separate CVSS 10.0 flaws in a single month, organizations relying on GitLab-hosted repositories and pipelines for software delivered to your organization are at material supply chain risk. Organizations that patched on October 12 (CVE-2026-97229) must patch again for CVE-2026-110264 — a point of confusion that could leave many instances vulnerable.

What questions should TPRM professionals ask vendors?

1. Are all self-managed GitLab CE/EE instances updated to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 to address the October 21 CVE-2026-110264 patch?
2. Did your October 12 patch cycle address CVE-2026-97229, and have you confirmed that you also need a second patch for CVE-2026-110264 released October 21?
3. Is user self-registration disabled on your GitLab instance to prevent unauthenticated attackers from creating accounts and planting malicious CI/CD configurations?
4. Do you use a self-hosted GitLab AI Gateway, and if so, has it been updated to version 19.2.4, 19.3.2, or 19.4.1?
5. Are your CI/CD pipeline configurations monitored for unauthorized changes, and do you have integrity verification for code committed to production repositories?

Remediation recommendations

• Upgrade self-managed GitLab instances urgently to: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 — prioritize internet-exposed instances.
• Note that the October 12 patch (19.4.2, 19.3.5, 19.2.8) does NOT protect against CVE-2026-110264; a second update is required.
• Disable self-registration and restrict project creation for untrusted users where not operationally required.
• Update self-hosted AI Gateway to versions 19.2.4, 19.3.2, or 19.4.1 if applicable.
• Audit CI/CD pipeline configurations for unauthorized changes and review deploy keys and access tokens for signs of compromise.

Black Kite's GitLab - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

Oracle WebLogic - Oct2026

What is this vulnerability?

Oracle's October 2026 Critical Patch Update (CPU) addresses multiple high-severity vulnerabilities in Oracle WebLogic Server, including two unauthenticated network-reachable flaws rated 9.8 and 9.1 on CVSS v3.1. CVE-2026-91323 (CVSS 9.8) can lead to full takeover of the WebLogic Server. CVE-2026-87302 (CVSS 9.1) allows an unauthenticated attacker with network access via HTTP to compromise the server. The October 2026 CPU also includes five CVSS 10.0 flaws across other Oracle products (SOA Suite, Access Manager, E-Business Suite). Oracle's quarterly patch schedule means unpatched WebLogic instances remain exposed for up to three months between CPUs.

No confirmed in-the-wild exploitation of the October 2026 WebLogic CVEs has been reported at time of writing. However, Oracle WebLogic has a long history of being targeted immediately after CPU releases, and CVE-2026-21962 (a previously patched CVSS 10.0 WebLogic RCE from the January 2026 CPU) was added to CISA KEV in August 2026, illustrating the pattern.

Why should TPRM professionals care?

Oracle WebLogic Server underpins mission-critical Java enterprise applications across financial services, manufacturing, healthcare, and government sectors. A CVSS 9.8 unauthenticated vulnerability means full server takeover without requiring any credentials — an attacker needs only network access. Oracle's quarterly patch cycle creates a known vulnerability window exploited by ransomware actors and nation-state groups. TPRM teams should assess which vendors use WebLogic for production application delivery and whether those vendors have applied the October 2026 CPU. Historical exploitation of WebLogic CVEs by the likes of Lazarus Group and multiple ransomware operators underscores the urgency.

What questions should TPRM professionals ask vendors?

1. Have you applied the Oracle October 2026 Critical Patch Update to all WebLogic Server instances in your production environment?
2. Are any WebLogic administration ports (default 7001/7002) exposed directly to the internet without a load balancer, WAF, or application firewall in front?
3. What is your SLA for applying Oracle quarterly CPU patches, and do you have a process for emergency patching when a CPU includes critical/actively exploited flaws?
4. Have all previous Oracle WebLogic CVEs — including CVE-2026-21962 (January 2026 CPU, CVSS 10.0, CISA KEV since August) — been patched in your environment?

Remediation recommendations

• Apply the Oracle October 2026 Critical Patch Update to all WebLogic Server instances immediately; prioritize internet-accessible and externally reachable instances.
• Restrict WebLogic administration console access (ports 7001/7002) to dedicated management networks; do not expose the admin console to the internet.
• Place WebLogic servers behind a web application firewall or reverse proxy to reduce the direct attack surface for unauthenticated HTTP flaws.
• Verify that CVE-2026-21962 (January 2026 CPU, CISA KEV) has been remediated on all WebLogic instances if not already patched.
• Enable security audit logging on WebLogic for access and configuration changes to facilitate detection of exploitation attempts.

Black Kite's Oracle WebLogic - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

BeyondTrust Remote Support - Oct2026

What is this vulnerability?

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support, rated CVSS 4.0: 9.3 and classified as CWE-290 (Authentication Bypass by Spoofing). The root cause is inadequate validation of the origin of incoming messages by internal Remote Support components. BeyondTrust disclosed the vulnerability on October 15, 2026, but exploitation as a zero-day began as early as August 29, 2026. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, with a federal remediation deadline of October 19, 2026.

The exploitation campaign has been attributed to ARMORY CASTLE, also tracked as UNC5221 and WARP PANDA, a China-nexus advanced persistent threat group. Observed post-exploitation activity includes privilege escalation to root, deployment of custom malware, and credential harvesting. The patch BT26-05-RS applies to self-hosted appliances; SaaS-hosted instances were patched on October 8. Organizations on versions older than 24.3.1 must first upgrade to a supported version before applying the patch. Affected versions: BeyondTrust Remote Support 26.2.3 and earlier.

Why should TPRM professionals care?

Remote support tools by design have privileged, authenticated access to managed endpoints across an organization — compromise of BeyondTrust Remote Support effectively gives an attacker's chosen access to any system that has been, or could be, supported through the platform. The involvement of a China-nexus APT (ARMORY CASTLE/UNC5221) indicates this vulnerability is being used for targeted, high-value intelligence collection and persistent access, not opportunistic attacks. Organizations that discovered the disclosure on October 15 may have been compromised for over six weeks by that point, since zero-day exploitation began August 29. TPRM teams should assess whether any critical vendors use BeyondTrust Remote Support to manage systems that touch your organization's data or network segments.

What questions should TPRM professionals ask vendors?

1. Have you applied patch BT26-05-RS to all self-hosted BeyondTrust Remote Support appliances? If your version is earlier than 24.3.1, have you first upgraded to a supported version?
2. If you use BeyondTrust-hosted SaaS, has your instance been confirmed as patched in the October 8 SaaS deployment?
3. Have you reviewed BeyondTrust session logs and access records from August 29 through the patch application date for evidence of unauthorized privileged sessions, lateral movement, or unusual system connections?
4. Have credentials, tokens, or API keys accessible through BeyondTrust Remote Support sessions been rotated as a precaution, particularly for privileged accounts?
5. Does any vendor use BeyondTrust Remote Support to provide managed services or remote access to systems in your environment, and if so, have you verified their patch status?

Remediation recommendations

• Apply BeyondTrust patch BT26-05-RS to all self-hosted Remote Support appliances; upgrade to a supported version (24.3.1+) first if on an older release.
• Conduct a forensic review of BeyondTrust session activity from August 29 through the patch date, focusing on privileged sessions, unusual connection patterns, and connections to sensitive systems.
• Rotate all credentials, API keys, and access tokens that were accessible via BeyondTrust Remote Support sessions during the exploitation window.
• Hunt for ARMORY CASTLE/UNC5221 indicators of compromise: unexpected privilege escalation, unusual outbound network connections, and custom malware artifacts on supported endpoints.
• Verify that BeyondTrust Privileged Remote Access (PRA) has also received the precautionary patch released by BeyondTrust alongside the RS fix.

Black Kite's BeyondTrust Remote Support - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

Fortinet - Oct2026 [Suspected]

What is this vulnerability?

Two Fortinet vulnerabilities in October 2026 warrant attention: one confirmed exploited (FortiMail) and one with a public PoC and suspected imminent exploitation (FortiSIEM).

CVE-2026-104286 (FortiMail, CVSS 9.8): A critical path traversal and NULL byte injection vulnerability allowing an unauthenticated attacker to write arbitrary files to the system via crafted HTTP or HTTPS requests. Fortinet advisory FG-IR-26-175 addresses this flaw. CISA added it to the KEV catalog on October 1, 2026, with a federal remediation deadline of October 4. Affected versions: FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9. Mitigation: disable the IBE (Identity-Based Encryption) feature support, or restrict web access to the management interface.

CVE-2026-106173 (FortiSIEM, Critical): A path traversal vulnerability enabling unauthenticated remote code execution via specially crafted packets, covered by Fortinet advisory FG-IR-26-180 (published October 13). A public proof-of-concept exploit was released on October 20, 2026. No in-the-wild exploitation has been confirmed as of publication, but the combination of a critical SIEM target and a public PoC makes exploitation highly probable in the near term — hence the [Suspected] designation.

Why should TPRM professionals care?

Fortinet email gateways (FortiMail) are trusted to filter and route email for enterprise organizations — a compromised gateway can intercept emails, facilitate business email compromise, and serve as a persistence point for attackers. FortiSIEM is even more sensitive: it is the security information and event management platform. An attacker with RCE on FortiSIEM can effectively blind the security operations center, suppressing alerts and covering their tracks. The CISA KEV designation for CVE-2026-104286 confirms in-the-wild exploitation, and the public PoC for CVE-2026-106173 significantly lowers the bar for attackers targeting FortiSIEM. Vendors operating Fortinet-based email security or SIEM infrastructure should be assessed urgently.

What questions should TPRM professionals ask vendors?

1. Are any FortiMail appliances in your environment running affected versions (7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, or 8.0.0–8.0.1), and have the patches or mitigations from FG-IR-26-175 been applied?
2. If the FortiMail patch is not yet available for your version, have you disabled the IBE feature and restricted management interface access to trusted IP ranges?
3. Are your FortiSIEM instances updated per advisory FG-IR-26-180, given that a public PoC for CVE-2026-106173 was released October 20?
4. Have you reviewed FortiMail logs for evidence of unauthorized file writes or unexpected configuration changes since the exploitation window began?

Remediation recommendations

• Apply the Fortinet patch for CVE-2026-104286 to FortiMail per advisory FG-IR-26-175; check the advisory for the latest fixed versions as status may have changed since initial disclosure.
• If no patch is available for your FortiMail version: disable the IBE feature support and restrict the FortiMail management interface to trusted source IP addresses only.
• Apply the FortiSIEM fix from advisory FG-IR-26-180 immediately; now that a public PoC exists for CVE-2026-106173, treat this as urgent regardless of absence of confirmed in-the-wild exploitation.
• Restrict management interface access on all Fortinet appliances to a dedicated management VLAN with strict source IP filtering.
• Hunt for indicators of FortiMail exploitation: unexpected files written to the system, unusual web server processes, and new user accounts or configuration changes.

Black Kite's Fortinet - Oct2026 [Suspected] FocusTag® details critical insights on the event for TPRM professionals.

Apache Tomcat - Oct2026

What is this vulnerability?

On October 20, 2026, Apache published a batch of eight security fixes for Tomcat 10 and 11, covering three Important and five Low-severity issues. The most critical by third-party scoring is CVE-2026-101356 (CVSS 9.1), an HTTP/2 request/response mix-up that can lead to information disclosure and denial of service. CVE-2026-101296 is an Important-severity authentication bypass affecting the JNDIRealm component: when non-GSSAPI SASL mechanisms are configured, authentication can succeed without the correct password, affecting Tomcat 11.0.0-M1 through 11.0.26 and 10.1.0-M1 through 10.1.60. No public exploit code or in-the-wild exploitation has been confirmed for the October 20 batch.

A separate, earlier issue also warrants attention: CVE-2026-65182 (CVSS 9.1, CSA advisory August 2026) is a security-constraint bypass affecting Tomcat 11.0.0-M1 through 11.0.24. Organizations that have not patched through the full Tomcat security history should review all outstanding CVEs.

Why should TPRM professionals care?

Apache Tomcat is one of the most widely deployed Java application servers globally, serving enterprise applications across virtually every industry. The authentication bypass in JNDIRealm (CVE-2026-101296) is particularly concerning for organizations using LDAP-based authentication on Tomcat — a successful attack could allow unauthorized access to authenticated application functionality without valid credentials. The HTTP/2 mix-up (CVE-2026-101356) raises data leakage concerns for applications serving sensitive data over HTTP/2. A batch release of eight CVEs in a single advisory creates patch fatigue risk — organizations may apply the advisory incompletely or delay it, leaving specific attack paths open.

What questions should TPRM professionals ask vendors?

1. Have the October 20, 2026 Apache Tomcat security patches been applied to all Tomcat instances, specifically addressing CVE-2026-101356 and CVE-2026-101296?
2. Do any of your Tomcat instances use JNDIRealm with non-GSSAPI SASL mechanisms for authentication, and if so, have those been patched or reconfigured?
3. Is HTTP/2 enabled on your Tomcat deployments? If so, has the CVE-2026-101356 patch been applied, or has HTTP/2 been temporarily disabled as a compensating control?
4. Have all earlier Tomcat CVEs, including CVE-2026-65182 (August 2026, CVSS 9.1), been applied across your Tomcat fleet?

Remediation recommendations

• Apply the October 20, 2026 Apache Tomcat security patches for all affected versions (Tomcat 10 and 11) immediately.
• For CVE-2026-101296: if patching is delayed, switch from JNDIRealm with non-GSSAPI SASL to an alternative realm (e.g., DataSourceRealm or LockOutRealm) as a temporary measure.
• If HTTP/2 is not required, consider disabling it at the Tomcat connector level until the CVE-2026-101356 patch is applied.
• Verify that CVE-2026-65182 (August 2026 security-constraint bypass) has been patched on all Tomcat 11.0.0-M1 through 11.0.24 instances.
• Review Tomcat access logs for authentication anomalies, particularly repeated failed authentication attempts followed by unexpected successful ones, as a potential exploitation indicator for CVE-2026-101296.

Black Kite's Apache Tomcat - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

FocusTags® in the Last 30 Days

• php2shell: CVE-2026-109618, CVE-2026-109619 — Two Critical Use-After-Free RCEs in PHP Core Enabling Unauthenticated Code Execution Against mod_php and PHP-FPM; Session Upload Progress Attack Path (Active Exploitation Observed, Fixed: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12).
• Plex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 — Four-CVE Unauthenticated RCE Exploit Chain in Plex Media Server Actively Exploited for Cryptominer Deployment (CISA KEV, Fixed: 1.43.3.10861).
• PAN-OS - Oct2026: CVE-2026-0322 — Code Injection in PAN-OS Management Interface Enabling Root-Level Code Execution by Authenticated Attacker (CISA KEV Oct 14 2026, Highest Urgency, Fixed: October 15 2026 Patch).
• Drupal Core: CVE-2026-108097, CVE-2026-108515, CVE-2026-108514 — Critical RCE in Field UI Module Exploitable via Common Contributed Modules Including Unauthenticated Path; Public PoC Available (Fixed: Drupal 11.4.10, 11.3.19, 10.6.19).
• GitLab - Oct2026: CVE-2026-110264, CVE-2026-97229, CVE-2026-90970, CVE-2026-16301, CVE-2026-14814, CVE-2026-112212 — Two Unauthenticated RCEs in GitLab CE/EE Affecting All Versions Since 2014, AI Gateway Command Execution, and Cache-Poisoning Flaws (Fixed: 19.5.1, 19.4.3, 19.3.6).
• Oracle WebLogic - Oct2026: CVE-2026-91323, CVE-2026-87302, CVE-2026-91502, CVE-2026-101515 — Unauthenticated Network-Exploitable Full Server Takeover and HTTP Compromise Flaws in Oracle WebLogic Server (October 2026 CPU).
• BeyondTrust Remote Support - Oct2026: CVE-2026-102764 — Authentication Bypass by Spoofing Exploited as Zero-Day Since August 29 by China-Nexus APT ARMORY CASTLE/UNC5221 (CISA KEV Oct 16 2026, Fixed: Patch BT26-05-RS).
• Fortinet - Oct2026 [Suspected]: CVE-2026-104286, CVE-2026-106173 — FortiMail Path Traversal Enabling Unauthenticated Arbitrary File Write (CISA KEV Oct 1 2026) and FortiSIEM Unauthenticated RCE with Public PoC Released October 20.
• Apache Tomcat - Oct2026: CVE-2026-101356, CVE-2026-101296, CVE-2026-34483, CVE-2026-65182 — HTTP/2 Request/Response Mix-up and JNDIRealm Authentication Bypass; Eight-CVE Batch Release (Fixed: October 20 2026 Patch).
• Citrix NetScaler - Oct2026: CVE-2026-107406, CVE-2026-88771, CVE-2026-88772, CVE-2026-3055, CVE-2026-4368 — Third October Advisory Expansion — New Memory Overflow, SAML IdP Memory Overread, and Race-Condition Session Mixup Added to Existing KEV-Listed RCE Cluster.
• ONLYOFFICE Docs: CVE-2021-3199 — Path Traversal → Arbitrary File R/W → RCE in ONLYOFFICE Docs Server (CISA KEV Oct 9 2026, Actively Exploited by Flax Typhoon APT, Fixed: Version 6.1.0).
• MSSQL - Oct2026: CVE-2026-94512, CVE-2026-65674, and 20 additional CVEs — 22-CVE October Patch Tuesday Batch Including Heap Buffer Overflow RCE, Deserialization RCE, and Multiple Elevation of Privilege Pathways Across SQL Server 2019–2026.
• Exchange Server - Oct2026 (Latest): CVE-2026-70279, CVE-2026-70571, CVE-2026-77910, CVE-2026-87692, CVE-2026-87695, CVE-2026-87696 — Unauthenticated XSS/Spoofing and Unauthenticated Stack Buffer Overflow RCE in Microsoft Exchange Server (October 2026 Security Update).
• SharePoint - Oct2026: CVE-2026-85900, CVE-2026-88155, and 34 additional CVEs — Largest Single-Month SharePoint Disclosure Batch on Record: 7 RCE, 15 EoP, 5 Info Disclosure, 5 XSS/Spoofing, 3 SSRF, 1 Tampering — Including Unauthenticated Crypto Signature Bypass and NTLMv2 Hash Capture via SSRF (SharePoint SE / 2019 / 2016).
• NGINX UI: CVE-2026-107806, CVE-2026-42238 — Unauthenticated RCE and Authenticated RCE via Code Injection in NGINX UI Backup Restore Pipeline (Fixed: Patched Release).
• MariaDB - Oct2026: CVE-2026-107815, CVE-2026-107818, CVE-2026-107814, and 6 additional CVEs — Stack OOB Write in CONNECT Engine, Environment Variable Injection for Persistence, and TLS Hostname Validation Bypass in Connector/C (Fixed: October 2026 Release).
• ProFTPD - Oct2026: CVE-2015-3306 — Unauthenticated Arbitrary File R/W via mod_copy SITE CPFR/CPTO Commands Enabling RCE (CISA KEV Oct 8 2026, Active Exploitation, Fixed: ProFTPD 1.3.5a).
• Citrix NetScaler - Oct2026 (Latest): CVE-2025-6543, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-88778 — Updated Advisory Requiring Build 14.1-73.41 / 13.1-64.28 — Vendors Patched to 14.1-73.37 per Sep2026 Advisory Remain Exposed to Memory Overflow in Gateway Mode and Must Patch Again.
• SonicWall SMA1000 - Oct2026: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-83548, CVE-2026-83549 — Oct2026 Advisory Expands CISA KEV-Listed Pre-Auth SSRF/RCE Chain with Four New CVEs Including Zip Slip and Stored XSS in AMC.
• Exchange Server - Oct2026: CVE-2026-96940 — Weak Authorization in Microsoft Exchange Server Enabling Authenticated Network Privilege Escalation (Patched: October 2026 Security Update).
• Cisco NX-OS - Oct2026: CVE-2026-76471 and 6 additional CVEs — Unauthenticated RCE with Root Privileges via NX-API Feature and Proactively Identified High-Severity Flaws in Cisco NX-OS Data Center Switching Platform.
• Atlassian - Oct2026: CVE-2026-21589 — Critical Cross-Product Vulnerability Simultaneously Affecting All Atlassian Data Center Products — Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye.
• Langflow - Oct2026: CVE-2026-104334, CVE-2026-93674, and 19 additional CVEs — Fifth Advisory Cycle — 21-CVE IBM Batch Disclosure Including 4 Unauthenticated RCEs and 17 Authenticated RCE / Info Disclosure Vulnerabilities in Langflow OSS 1.0.0–1.12.2 (Fixed: 1.12.3).
• Elastic - Oct2026: CVE-2026-102406, CVE-2026-103007, CVE-2026-103009, and 5 additional CVEs — Kibana Cross-Tenant Authorization Bypass, Elasticsearch Privilege Escalation, Cross-Cluster Information Disclosure, and Denial of Service.
• Kiteworks: No CVE — Precautionary Shutdown Advisory Driven by Federal Intelligence Warning of Imminent Cyberattack, Advanced Forms Vulnerability Identified (Fixed: Kiteworks 9.5.1, Mandiant Engaged, Fewer Than 1% of Customers Affected).
• Citrix NetScaler - Sep2026 (Latest): CVE-2026-88771, CVE-2026-88772, and 6 additional CVEs — Two Confirmed Zero-Day Unauthenticated RCEs in All Default NetScaler Deployments and HTTP Smuggling (CISA KEV Sep 27 2026, Federal Deadline Sep 30, Fixed: 14.1-73.37, 13.1-64.23).
• MikroTik RouterOS - Sep2026: CVE-2026-84411, CVE-2026-86060, CVE-2026-67276 — Integer Underflow Enabling Unauthenticated RCE or DoS, SSH Username Argument Flaw, and SSH Key Comparison Bypass (CISA ICS Advisory ICSA-26-272-06, Fixed: RouterOS 7.24).
• OpenSSL - Sep2026: CVE-2026-84782, CVE-2026-84783, CVE-2026-72897, CVE-2026-84784 — Out-of-Bounds Read in DTLS, Use-After-Free in X.509 Certificate Caching, OOB Write in SSL_CTX Switching, and QUIC Resource Exhaustion (~1.8M Exposed Instances, Fixed: 3.0.16–3.4.1, 4.0.1).
• WordPress Core - Sep2026: CVE-2026-87902 — Pre-Authentication Path Traversal → LFI → Unauthenticated RCE via PEAR pearcmd.php, Present Since WordPress 4.7.0 (CISA KEV Sep 25 2026, Public PoC, Fixed: 7.1.2 / backports to 4.7.37).
• ScreenConnect - Sep2026: CVE-2026-84869 — Missing Authorization in ScreenConnect Client File-Transfer Enabling Worm-Like Malware Propagation to Every Connected Host Session (CISA KEV, Actively Exploited).
• Exim Mail - Sep2026: CVE-2026-94054, CVE-2026-94056 — Out-of-Bounds Write and Uninitialized Resource in Exim PROXY Protocol v1 and v2 Handling (Fixed: Exim 4.100.1).

References

https://blackkite.com/blog/php2shell-two-critical-remote-code-execution-vulnerabilities-in-the-php-core-

https://www.php.net/archive/2026.php#2026-10-21-5

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote

https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/

https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/

https://securityonline.info/plex2shell-plex-media-server-exploited/

https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html

https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html

https://cybersecuritynews.com/pan-os-vulnerability-exploited-cisa-warns/

https://securityonline.info/palo-alto-pan-os-rce-cve-2026-0322-exploited/

https://www.drupal.org/security

https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/

https://securityonline.info/drupal-rce-cve-2026-108097-poc/

https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

https://www.rescana.com/post/gitlab-cve-2026-110264-unauthenticated-rce-october-2026

https://www.oracle.com/security-alerts/cpuoct2026.html

https://www.securityweek.com/cisa-warns-of-exploited-oracle-weblogic-vulnerability/

https://securityaffairs.com/197801/security/u-s-cisa-adds-maximum-severity-oracle-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild/

https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support

https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/

https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html

https://watchtowr.com/intelligence/fortinet-fortimail-cve-2026-104286-faq/

https://tomcat.apache.org/security-10.html

https://tomcat.apache.org/security-11.html

https://securityonline.info/apache-tomcat-vulnerabilities-october-2026/

https://lists.apache.org/thread/bl52b9go9ckoov8x4v3dt6rkm573cygd