Zarro Technology · Security briefing
Today’s developments cover firewall management, virtualisation and Kubernetes certificate security. New exploitation reporting gives older vulnerabilities fresh urgency; the AWS issue was disclosed on 29 October.
CVE-2026-109618 (9.2), CVE-2026-109619 (9.2)
Palo Alto Networks’ 29 October update confirms active PHP2Shell exploitation against internet-exposed management interfaces. PAN-OS on PA-Series, VM-Series and Panorama is affected; GlobalProtect portals and gateways are outside this issue’s scope. This is a material development in the PHP vulnerabilities covered earlier.
Review management-interface exposure, retained threat logs and unexpected administrative or process activity. Unit 42 provides hunting queries; signature matches indicate possible attempts, not necessarily compromise. Missing alerts cannot establish that an appliance is clean.
Restrict management access to trusted internal addresses or a controlled jump host immediately. Apply the vendor hotfix for your exact maintenance branch. Newly available fixes on 29 October include 12.1.10-h3, 12.1.4-h13, 11.2.4-h23, 11.1.7-h12, 10.2.10-h42 and 10.2.7-h39. Other branches have different fixes: use the advisory’s full matrix. Appliance remediation requires vendor firmware, rather than replacing PHP manually.
Sources: Palo Alto Networks: affected versions, hotfixes and mitigations · Unit 42: 29 October attack confirmation and hunting queries
CVE-2026-41709 (2.7)
CrowdStrike’s 28 October report describes WARP PANDA using this flaw as a zero-day in intrusions continuing into early 2026. The vulnerability was patched in July: the new development is exploitation reporting. An attacker already holding administrator privileges can hide certain operations from logs. Its Low base severity does not make an exploited audit gap safe to defer.
Check affected ESX 8.0, 9.0 and 9.1 deployments against Broadcom’s matrix. Fixed builds include ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025 and ESXi-9.1.0.0-25370933, respectively; Cloud Foundation 5.x requires 5.2.4 and its async-patching guidance. Telco deployments have separate instructions. No workaround is listed.
Review administrator access and independently retained network, identity and vCenter telemetry. The cited notices provide no flaw-specific campaign IoCs. Local host logs may omit attacker activity, so an uneventful log review cannot rule out compromise.
Sources: CrowdStrike: new exploitation report, 28 October · Broadcom: CVE-specific response matrix, section 3e
CVE-2026-119115 (8.4)
AWS disclosed on 29 October that an authenticated user authorised only for a namespace-scoped issuer could, under certain conditions, obtain certificates—including subordinate CA certificates—from an unauthorised cluster-scoped issuer. The cited notices do not establish active exploitation.
Update aws-privateca-issuer versions before 1.10.1 to 1.10.1 or later; the EKS add-on fix is 1.10.1-eksbuild.1. First audit CertificateRequest, Certificate and Ingress resources: issuerRef.kind must explicitly match AWSPCAIssuer or AWSPCAClusterIssuer. Incorrect values can prevent renewal after upgrading, disrupting services when certificates expire.
If an upgrade is delayed, AWS recommends restricting approval policies and RBAC by both issuer name and issuer kind. Review available issuance and approval records for certificates inconsistent with intended permissions; these are investigation leads, not published campaign IoCs.
Sources: AWS bulletin: affected versions and renewal precautions · Maintainer advisory and scoring
Zarro Technology
