Good morning. PHP2Shell is no longer a patch-when-you-can story.
1. PHP2Shell now in CISA KEV: federal patch deadline October 29 (CVE-2026-109618, CVE-2026-109619). CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, with a federal patch deadline of October 29. Both flaws allow unauthenticated remote code execution, Apache with mod_php is the highest risk setup, and the fix is PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you cannot patch right now, take internet-facing PHP offline and hunt for shells first.
2. Apple patches exploited CoreGraphics flaw for older iPhones and iPads. iOS 18.7.11 and iPadOS 18.7.11, released October 26, patch the exploited CoreGraphics flaw CVE-2026-86950 for iPhones and iPads that cannot run newer iOS versions. Do not leave the iPhone XS and XR class of devices on the backlog.
3. University of New Mexico Health System incident, Byod claim UNVERIFIED. A cyber incident at the University of New Mexico Health System on October 26 diverted ambulances and canceled appointments at more than 30 clinics, knocking out the state's only Level I trauma center for the day. A ransomware group calling itself Byod claimed a sweeping compromise, but that claim is UNVERIFIED and UNM has not corroborated it.
4. Aokigahara infostealer steals AI app sessions. Check Point Research profiled Aokigahara, an infostealer that steals AI app sessions, Git and SSH credentials, and cloud configs from compromised endpoints. Revoke sessions and keys from a clean system, because a password change alone leaves stolen tokens usable. Fresh Aokigahara indicators are in the IoC Library.
Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library
New CISA KEV additions today: CVE-2026-109618 and CVE-2026-109619, PHP2Shell, federal due date October 29, 2026.
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com