{"slug": "two-core-rces-in-one-week-neither-needs-a-sleepless-night", "title": "Two core RCEs in one week, neither needs a sleepless night", "summary": "Two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 in PHP (patched October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12) and CVE-2026-111497, an out-of-bounds write in the Node.js Brotli decoder found by OpenAI's Codex Security team, both scored CVSS 9.2 and were reportedly discovered by LLM agents rather than human researchers. AWS observed exploitation attempts against the PHP flaws from October 17, four days before patches existed, and the Node.js flaw was later confirmed to also affect Bun, the Python brotli and brotlicffi libraries, Envoy and Istio. The same week, Microsoft attributed abuse of ConnectWise OAuth credentials via the ARTEX framework to the China-linked group Storm-0940, which probed 2,250 Microsoft 365 tenants at roughly 2,900 access attempts per minute.", "body_md": "The PHP2Shell patches shipped on October 21: two vulnerabilities in the core of the language, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 (Source: helpnetsecurity.com).\n\nThey allow unauthenticated remote code execution, meaning someone outside can run whatever they want on the server without an account or a password.\n\nThe flaw is fixed in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.\n\nWhat stands out is the timeline.\n\nAWS detected exploitation attempts from October 17, four days before the patch existed (Source: helpnetsecurity.com).\n\nAnd it reaches further than it looks. WordPress, Magento, Drupal or Nextcloud can be exposed even when their own code is clean, because the flaw lives in the interpreter that runs them.\n\nThe second case arrived almost at the same time. Node2Shell, CVE-2026-111497, also CVSS 9.2, is an out-of-bounds write in the Node.js Brotli decoder that allows unauthenticated remote code execution (Source: cryptobriefing.com).\n\nThe Codex Security team at OpenAI found it, and the patches are in versions 22.23.4, 24.22.1 and 26.12.1.\n\nOne curious detail repeats in both: LLM agents found them, not a human researcher spending weeks with a debugger.\n\nThe week closes with a third episode that fits the same pattern.\n\nOn October 24 it was confirmed that Node2Shell also affects Bun, the Python brotli and brotlicffi libraries, Envoy and Istio. A public proof of concept already demonstrates remote code execution in a lab, though there is no confirmed exploitation in production (Source: thehackernews.com).\n\nThe common shape of the three cases is clear.\n\nA flaw in an infrastructure piece almost nobody audits, a maximum score, a patch available in days, and an exposure window measured in hours, not months.\n\nAnd AI itself is accelerating the discovery.\n\nThat changes the pace at which advisories appear, not the damage each one does.\n\nThe same week brings the opposite face.\n\nMicrosoft attributed to Storm-0940, a China-linked group, the abuse of ConnectWise OAuth credentials with the ARTEX framework (Source: microsoft.com).\n\nThe numbers of the attack are what matter.\n\n2,250 Microsoft 365 tenants probed at 2,900 access attempts per minute, after a password spray against 327 accounts in 8 organizations.\n\nIt is not a core RCE: it is a poorly protected credential used at industrial scale, and the result is just as serious.\n\nMy reading is that AI accelerates the discovery of flaws, not the mass exploitation of those flaws.\n\nA CVSS 9.2 does not always demand a sleepless night, because not every flaw has a universal exploit that works against any installation. This comes up a lot in CySA+.\n\nWhat does demand a sleepless night is knowing whether your exposed surface is on the list.\n\nI would spin up a container with the vulnerable PHP version and another with the patched one, then send the same request against both.\n\nI would watch whether the response changes shape, whether the process crashes, or whether a different trace shows up in the log.\n\nWith Node.js I would do the same against the Brotli decoder, sending a malformed payload and watching whether the process restarts on its own.\n\nThe conclusion I would draw is whether my specific configuration is reachable or whether the flaw stays theoretical for my case.\n\nTwo core flaws in the same week are not an emergency if you know which version you run and what you expose; but they are an emergency if you do not.\n\nOriginally published at [https://sammideblas.com/notas/two-core-rces-in-one-week-neither-needs-a-sleepless-night](https://sammideblas.com/notas/two-core-rces-in-one-week-neither-needs-a-sleepless-night)\n\nSi has leído hasta aquí... reacciona y comparte -> \"la seguridad y la defensa en la era de la IA es cosa de todos los que la usan\" ¿No Crees?", "url": "https://wpnews.pro/news/two-core-rces-in-one-week-neither-needs-a-sleepless-night", "canonical_source": "https://dev.to/analista_83/two-core-rces-in-one-week-neither-needs-a-sleepless-night-c6p", "published_at": "2026-10-26 10:11:24+00:00", "updated_at": "2026-10-26 10:12:51.287889+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["PHP", "Node.js", "OpenAI", "Codex Security", "AWS", "Microsoft", "Storm-0940", "ConnectWise"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/two-core-rces-in-one-week-neither-needs-a-sleepless-night", "markdown": "https://wpnews.pro/news/two-core-rces-in-one-week-neither-needs-a-sleepless-night.md", "text": "https://wpnews.pro/news/two-core-rces-in-one-week-neither-needs-a-sleepless-night.txt", "jsonld": "https://wpnews.pro/news/two-core-rces-in-one-week-neither-needs-a-sleepless-night.jsonld"}}