1. PHP: exploitation attempts and urgent updates (Critical)

CVE-2026-109618 (9.2), CVE-2026-109619 (9.2), CVE-2026-115560

Impact

CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated code execution on PHP web servers, including those serving WordPress. Linux, Windows and container deployments may be affected. AWS reports exploitation attempts; a matching request does not establish successful compromise.

Checks and IoCs

AWS lists 103.216.220.92 (17 October) and 31.223.184.166 (21 October) among observed source IPs. These include shared anonymisation infrastructure: investigate matches rather than treating them as definitive evidence or automatically blocking them.

Linux example — search an uncompressed web access log. Replace the path; reading protected logs may require administrator access. Behind a proxy, use logs that preserve the real client IP.

grep -nE '(^|[[:space:]])(103[.]216[.]220[.]92|31[.]223[.]184[.]166)([[:space:]]|$)' /path/to/access.log

Review captured POST bodies or WAF events for PHP_SESSION_UPLOAD_PROGRESS, then correlate with unexpected processes or file changes. Ordinary access logs usually omit request bodies. The marker can be legitimate, and no matches do not prove a server is clean.

Remediation

• Deploy PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the vendor’s equivalent backported fix. Update container images and bundled runtimes too.
• Apply PHP’s 23 October session-upload guidance below in the web runtime’s server-level configuration, then restart the affected workers using your deployment procedure.
• Confirm the running web service uses the patched runtime. Investigate suspicious activity; an upgrade does not remove an existing compromise.

PHP recommends this temporary setting for the additional session-handling vector, CVE-2026-115560. It does not replace patching the original two CVEs.

; Web runtime configuration, not a per-request application setting
session.upload_progress.enabled=0

Sources: PHP advisories and fixes · AWS indicators and investigation guidance

2. Ruby and GitLab: regular-expression fixes (Critical)

CVE-2026-89078 (9.9), CVE-2026-93577 (9.9), CVE-2026-97229 (10.0), CVE-2026-110264 (10.0)

Impact

Ruby’s 23 October releases address bugs associated with GitLab CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Applications compiling attacker-controlled patterns may be exposed to memory corruption. GitLab reports that CVE-2026-110264 can permit unauthenticated code execution under certain conditions.

Checks and IoCs

The cited notices provide no definitive compromise indicators. GitLab links detection guidance for Onigmo native-worker crashes and bursts of Org-mode rendering errors. Use these as investigation leads; the notices do not establish active exploitation of this specific flaw.

Remediation

• For standalone Ruby applications, use 4.0.9, 3.4.12 or 3.3.13, or a later fixed release. If upgrading is delayed, avoid compiling untrusted patterns; timeouts and length limits are not reliable protections.
• For self-managed GitLab, use the fixed release for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, following the supported upgrade path. Updating system Ruby alone does not update GitLab’s bundled runtime.

Sources: Ruby advisory · GitLab fixes and detection links