PHP2Shell Fixes Reach PAN-OS as Stolen GitHub Tokens Drain CI Secrets

Palo Alto Networks has started shipping PAN-OS hotfixes for PHP2Shell as researchers track suspected North Korea-linked target staging. Wiz detailed Gheist, which turns stolen GitHub tokens into stolen CI/CD secrets. Unpatched Tailscale SSH findings and new .NET Brotli fixes round out a day about credentials and trusted tools.

Priority at a glance

PHP2Shell and Gheist are both under active, ongoing abuse and deserve attention today. Tailscale's SSH findings and the Brotli follow-on fixes have no known exploitation yet, but both are worth closing out this week before that changes.

1. PHP2Shell: PAN-OS hotfixes land as attackers build target lists

What happened. In an October 25 advisory update, Palo Alto Networks confirmed the first PAN-OS hotfixes for CVE-2026-109618 and CVE-2026-109619 (10.2.18-h13, 11.1.16-h4 and 11.2.10-h16); the rest are due October 27–30. The exposure is the management web interface (web UI and XML API) on PA-Series, VM-Series and Panorama. GlobalProtect portals and gateways are not affected, and Palo Alto knows of no exploitation against its products. CYFIRMA's October 24 update describes paced scanning from 21 compromised nodes against 216 unpatched hosts in government, finance, logistics, aviation and manufacturing. It links the activity to the Lazarus Group ecosystem with moderate confidence.

Severity. Both flaws are unauthenticated RCE rated CVSS 4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A related flaw, CVE-2026-115560, is still unpatched. On October 25, Unit 42 retracted an earlier update and said it can't confirm that a European government intrusion began through these CVEs. No successful PHP2Shell compromise has been publicly confirmed.

What to do. — click a step to check it off, click any code snippet to copy it

1. Patch and verify. Upgrade PHP or apply your distribution's backport, set session.upload_progress.enabled=0 (this also covers CVE-2026-115560) and restart every worker. Confirm the running version everywhere, including containers, then re-scan. On PAN-OS, restrict management access to trusted internal IPs, enable the advisory's Threat IDs and install the hotfix when it ships.
2. Check for compromise since October 17, when Amazon saw the first attempts. Look for PHP worker crashes, child processes of PHP, new scripts in web-root, upload and temp directories, and new accounts, cron jobs or SSH keys. Search logs for CYFIRMA's published IPs, including egress to 92.118.112[.]100, and review firewall admin accounts and configuration changes.
3. Harden. Keep management interfaces off the internet, make upload directories non-executable and filter egress from web servers.
4. If compromised, capture volatile evidence before restarting workers, then isolate the host, rebuild it from a known-good image, rotate every credential it could reach and engage incident response.

2. Gheist turns stolen GitHub tokens into stolen CI/CD secrets

What happened. On October 25, Wiz Research detailed Gheist, an automated campaign it has tracked since September 15. Using stolen tokens, the tool pushes a workflow to every repository a token can write to. The workflow prints the repository's secrets in base32, which slips past GitHub's log masking. The tool then downloads the log and deletes the run within seconds. Wiz recovered more than 13,500 planted branches from more than 850 accounts and said the campaign was still active on October 24.

Who is affected. Any organization whose people or automation hold tokens with write access. GitHub's approval hold for suspicious workflows covers only public repositories, not private ones or GitHub Enterprise Server, where Wiz saw successful runs.

What to do. — click a step to check it off

1. Check since September 15 for ci-sync- branches, the commit message "ci: sync config" adding .github/workflows/sync-check.yml, runs deleted within a minute, and the gheist user agent in audit logs. Check cloud logs for OIDC role assumptions whose subject includes ci-sync-. On self-hosted runners, search for .gdmp_* files and gdmp-pivot.
2. If you get a hit, rotate every secret the repository could use, because deleting the branch doesn't undo the exposure. Revoke the pushing tokens and check their owners' devices for infostealers. Treat any self-hosted runner involved, and its cloud role, as compromised, and review cloud logs for use of the secrets.
3. Verify that old secrets fail and revoked tokens are gone.
4. Harden. Require reviewers on production environments, scope OIDC trust to protected branches, use GitHub Apps or short-lived fine-grained tokens instead of personal access tokens, and run ephemeral runners.

3. Unpatched Tailscale SSH findings put access rules under scrutiny

What happened. Researcher Erica Windisch of Cyberdione Labs published "Tailworm," 11 findings from lab testing of Tailscale 1.104.2 and headscale 0.29.5. In the most serious chain, an attacker who already controls one device uses Tailscale SSH port forwarding to make the root-level Tailscale service reach root-only sockets on a target, gaining root. With Tailnet Lock off, the default, the chain went on to enroll a rogue node.

Status. No CVEs or fixes exist, and Tailscale's bulletins show nothing newer than October 21. Tailscale says it is fixing issues it found in the same areas but has not confirmed the specific claims. No exploitation is reported.

What to do. — click a step to check it off

1. Tighten policy now. Replace identity-wide or tag-wide SSH rules with single source-to-destination grants, never allow root as the target user and turn off port forwarding. On headscale 0.29.5 forwarding can't be disabled, so treat every SSH grant as root. Remove tailscale serve forwards to Unix sockets and enable Tailnet Lock and node-key expiry.
2. Verify the policy and each node's serve configuration, and review the device list for unknown nodes. Delete any compromised device at the control plane, because reimaging doesn't revoke copied keys.
3. Update as soon as Tailscale ships fixes.

4. Brotli decoder flaw: .NET patched, ClickHouse and Arrow still waiting

What happened. On October 25, Microsoft fixed the Brotli flaw behind "Node2Shell" (CVE-2026-111497) in .NET 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3 (CVSS 8.1). The same day, JFrog reported a single-request crash in ClickHouse, whose fix is merged but not yet released, and a denial-of-service condition in Apache Arrow, which has no fix. Node.js and upstream Brotli fixes shipped October 21. No exploitation in the wild has been reported.

What to do. — click a step to check it off

1. Update and verify. Install the patched .NET runtime, then rebuild self-contained and NativeAOT apps and container images, which bundle their own runtime. Confirm with dotnet --list-runtimes and your inventory.
2. Harden. Reject Brotli-compressed request bodies at the proxy where they aren't needed, cap decompressed sizes and alert on unexpected crashes of services that decode Brotli.

Compliance and personal data

This section is general information, not legal advice.

Also notable

Touchpoint's Take

Closing the hole is half the job. A PHP upgrade doesn't show whether a server was probed last week. Deleting a Gheist branch doesn't take back a printed secret. A Tailscale fix won't remove a rogue node that already joined.

The Unit 42 retraction is a reminder to act on vendors' and researchers' own advisories, not the first headline. Teams that know which secrets each system can reach, and keep the logs to prove what happened, recover faster and meet notification duties more easily.

Sources

• Palo Alto Networks: Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks products
• PHP Group: PHP news, security advisories and 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 releases
• PHP (GitHub): GHSA-6wmf-4rv5-p3rp
• CYFIRMA: Threat Advisory, suspected DPRK campaign staging PHP2Shell targeting
• Unit 42: Threat Brief, Critical Vulnerabilities in PHP (updated October 25)
• The Record: Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
• BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
• The Hacker News: PHP2Shell exploitation attempts continue amid suspected N. Korea global scanning activity
• Wiz Research: Gheist, attempted scaled abuse of stolen GitHub tokens stumbles
• GitHub Changelog: GitHub Actions holds potentially malicious workflows for approval
• The Hacker News: Gheist uses stolen GitHub tokens to steal private repository secrets via Actions logs
• Cyberdione Labs: Tailworm report
• Tailscale: Security bulletins
• The Hacker News: Unpatched Tailscale SSH flaws could let a hacked device reach root on other servers
• Microsoft (GitHub): GHSA-p3jp-9v83-76w9, .NET Brotli vulnerability
• JFrog Security Research: Brotli2Shell, beyond Node2Shell
• Node.js: October 2026 security releases
• The Hacker News: Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used software
• Forever Security: Hijacking AI agents via the Downloads folder
• BleepingComputer: AI coding agents hijacked using AGENTS.md file in Downloads folder
• Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
• CISA: Known Exploited Vulnerabilities catalog (official data feed)
• CISA: CISA adds one known exploited vulnerability to catalog (October 23)
• Arista Networks: Security Advisory 0199
• Collabora (GitHub): GHSA-g3vx-3m76-fghh, richdocumentscode
• BleepingComputer: Arista patches new VeloCloud Orchestrator zero-day exploited in attacks