Issue of Oct 28, 2026

Flaws worth knowing

PHP2Shell patch leaves one path open (CVE-2026-115560). The emergency PHP releases of October 21, versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, close the two exploited PHP2Shell flaws but not a third remote code execution path, confirmed by the PHP project in an October 23 advisory and restated by France's national CERT on October 26. Exploiting it takes a rare combination: a session serialize handler switched at runtime plus session upload progress left enabled. No exploitation has been reported so far. Until the fix ships, one setting closes the path: session.upload_progress.enabled=0, set in php.ini or the FPM pool, not via ini_set(). Custom in-house booking portals running PHP come first.

Adobe Commerce and Magento join the KEV catalog (CVE-2026-48356). CISA added this unrestricted file upload flaw, scored 9.6 by the vendor, to its Known Exploited Vulnerabilities catalog on October 27, with a remediation deadline of November 10. Sansec documented attack waves back in March 2026 that dropped web shells on stores and injected scripts into storefront pages. Magento Open Source and Adobe Commerce power hotel gift shops, ticketing and ancillary sales front ends. Confirm the July patch set (2026-jul builds) is applied, including on fully managed instances.

Trends

Rakuten Travel: the booking platform is the breach again. Rakuten Group said on October 26 that unauthorized access touched part of its overseas hotel booking site, run by subsidiary Rakuten Travel Xchange, and its multilingual booking site: up to roughly 2.6 million logged-in user identities, some 40,000 reservations with contact details and booking amounts, partial card data on 36,000 records (cardholder, expiry, last four digits, no full number or security code), and account names for around 40,000 accommodation staff. The anomaly surfaced on September 10 and was fixed on September 16; the disclosure came six weeks later. The pattern keeps repeating: the platform gets breached, the hotel absorbs the guest questions and the fake confirmation messages that follow.

On the wire

Veeam ships a critical fix for Backup for Microsoft 365. On October 27 the vendor published security advisories covering four vulnerabilities, including a cross-tenant SQL injection with code execution (CVE-2026-106076, CVSS v4.0 9.0) and a REST API authentication bypass using a forged federation token (CVE-2026-106078). The complete fix is version 8.6 Patch 1, build 8.6.0.5011; the base 8.6 release covers only two of the four. Hotel groups backing up their Microsoft 365 environment with this product should patch this week and verify the build actually installed, not just the version advertised. Backup servers remain the number one ransomware target.