CVEasy Weekly

This Week in Exposure

Week 45 · 2026-W45 · November 2 to November 8, 2026

This week we ranked three findings where the version string tells you less than the configuration around it. A PHP host can report a fixed build and still run old workers, and a backup NAS on its own box can still be wiped by any administrator the attacker has already stolen.

This week's checklist

1. PHP2Shell (CVE-2026-109618, CVE-2026-109619, CISA KEV): upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every worker; until then set session.upload_progress.enabled=0.
2. Veeam Backup & Replication (CVE-2024-40711, CVE-2023-27532), used by SafePay: move to a fixed, current build, rotate the Veeam configuration database secrets, and keep one immutable or offline backup copy no domain or NAS administrator can delete or reset.
3. Arista VeloCloud Orchestrator (CVE-2026-114625, CISA KEV): the October 26 deadline has passed, so confirm 5.2.3.18, 6.1.3.10 or 6.4.2.12 is running and rotate every orchestrator account active in the exposure window, including Enterprise Read Only.

Top Exposures This Week

1. PHP2Shell turns a failed allocation into a shell on mod_php

CVE-2026-109618 and CVE-2026-109619 · PHP runtime, mod_php and PHP-FPM · unauthenticated RCE, CVSS 4.0 9.2 each · CISA KEV October 26, federal deadline October 29

Exposed: internet-facing PHP hosts that accept multipart requests, at their worst on Apache prefork with mod_php, and including plain WordPress or Laravel sites because session upload progress is on by default.

What happened: an attacker drives PHP out of memory during automatic multipart parsing, and the fatal error's longjmp() leaves request memory half built (CVE-2026-109618) or leaves worker globals pointing into a freed heap that the next request reads (CVE-2026-109619). The PHP advisory demonstrated full RCE over HTTP against mod_php with default limits. Amazon's MadPot honeypots recorded attempts on October 17, four days before the October 21 fix.

Do this:

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a distribution package whose changelog names both CVEs, then restart every worker so no old child keeps running the vulnerable code.
• Until the upgrade lands, set session.upload_progress.enabled=0 and, on 8.5, fatal_error_backtraces=0. Keep upload progress off after patching if nothing uses it, because CVE-2026-115560 is not fixed by the October 21 releases.
• Block multipart requests at the frontend where the application takes no uploads, and do not set RLIMIT_AS or RLIMIT_DATA, which trigger the vulnerable jump.
• Hunt for bursts of memory fatals at Unknown on line 0 on one worker, AH00052 segfault lines, PHP_SESSION_UPLOAD_PROGRESS fields on apps that never use them, and any shell whose parent is a web or PHP process. On a hit, rotate every secret in .env or wp-config.php and rebuild the host.

Why it ranks here: KEV-confirmed exploitation, a pre-auth path that fires before your application code runs, internet exposure on every public PHP site, and a blast radius of the web worker's database and mail credentials, all invisible to composer audit and plugin scanners.

Read how one request dies and the next one pays →

2. SafePay takes Veeam first, then factory-resets the backup NAS

CVE-2024-40711 and CVE-2023-27532 · Veeam Backup & Replication · RCE as SYSTEM and stored credential disclosure · both on CISA KEV, named in joint advisory AA26-293A

Exposed: any Veeam server or backup NAS whose management interface sits on the general network under credentials the production side can reach.

What happened: CISA, the FBI, the US Secret Service, BSI and NCSC published AA26-293A on October 20, counting roughly 600 SafePay victims. The crew enters through VPN flaws, uses the Veeam bugs to take the backup server and the accounts stored in its configuration database, then signs into the NAS management plane and issues a factory reset before encryption. No NAS exploit is involved; the reset is a supported admin function run from a stolen identity.

Do this:

• Move Veeam Backup & Replication to a fixed, current build (CVE-2024-40711 affects releases before 12.2), and patch SonicOS (CVE-2024-40766) and Cisco ASA and FTD (CVE-2023-20269, CVE-2020-3259). Make MFA mandatory on every VPN and RDP path.
• Keep at least one immutable or offline backup copy that no domain or NAS administrator account can delete or reset.
• Put the NAS and backup server management interfaces on their own segment with separate credentials and MFA, alert on reset, volume delete and factory default events in the NAS audit log, and ship those logs off the device.
• Rotate the Veeam configuration database secrets and every account that touched an exposed backup or VPN appliance during the window.

Why it ranks here: all five entry CVEs are KEV-listed and tied to an active crew, and the target is the recovery plane itself, so a credential disclosure on the Veeam server decides whether you can restore at all.

Read how SafePay wipes the clean room before the ransom note →

3. The VeloCloud Orchestrator deadline passed on October 26

CVE-2026-114625 · Arista VeloCloud Orchestrator, on-prem · authenticated SQL injection, Enterprise Read Only to operator superuser, CVSS 9.9 · CISA KEV October 23

Exposed: any on-prem orchestrator still below the fixed builds, or one that was internet-reachable during the exploitation window even if it is patched now; Cloud Hosted and Dedicated orchestrators were patched by Arista directly.

What happened: a value from the signed-in session is concatenated into a query against operator records, so any session at Enterprise Read Only or above can impersonate a local operator superuser, the role that pushes config and update bundles to every edge. Arista SA 0199 reported exploitation in the wild on October 22. We covered it last week; it stays on the list because a patched orchestrator does not undo the accounts and edge configs touched before the fix.

Do this:

• Confirm 5.2.3.18 on 5.2.x, 6.1.3.10 on 6.1.x or 6.4.2.12 on 6.4.x is running; if not, pull the web interface off the public internet behind a jump host with SSO and MFA for every account.
• Rotate every orchestrator account active in the window, including Enterprise Read Only, plus shared edge SSH keys, orchestrator-issued API tokens and any update bundle signing material that transited it.
• Diff running config on each edge against the last known-good config, and verify recent update bundles against Arista's published hashes.

Why it ranks here: vendor-confirmed abuse and a lapsed federal deadline on a management-plane asset whose blast radius is every connected SD-WAN edge.

Read how a read-only login reached operator superuser →

Threat actor to watch

SafePay is a financially motivated double extortion crew active since roughly August 2024, running its own encryptor (a reworked fork of leaked LockBit 3.0 code) instead of an affiliate program. Joint advisory AA26-293A names it among the most active operations of 2026 and notes its focus on managed service providers and critical infrastructure. Its entry is valid accounts where MFA was missing, often through commercial anonymizer exits such as Mullvad, followed by the Veeam and VPN flaws above. Hardening action: move NAS and backup management onto its own segment under credentials that no production domain account holds, so a stolen domain admin cannot reach the reset button.

Signed CVEasy threat-intel IOC bundle current as of 2026-11-02. The desktop app verifies the ED25519 signature before import.

All three items this week turn on configuration a scanner does not read: which SAPI serves PHP, which segment the backup NAS sits on, and which read-only logins reached the orchestrator. Start with PHP2Shell, because it fires before any application code runs.

Patch well,
CVEasy Threat Research