Defcon Alerts Threat Monitor

CISA Lists Two Critical PHP Flaws as Exploited, Federal Deadline Set for October 29

Defcon Level — Tue, 27 Oct 2026 01:37:05 GMT

GLOBAL WEB SERVERS — The U.S. Cybersecurity and Infrastructure Security Agency added two critical vulnerabilities in the PHP programming language to its Known Exploited Vulnerabilities Catalog on October 26. The flaws allow an attacker with no account to run code on servers that use PHP to answer web requests.

More Cyber/Tech Alerts

CISA assigned the entries due dates of October 29 under Binding Operational Directive 26-04. That directive requires Federal Civilian Executive Branch agencies to remediate listed flaws on publicly exposed assets that grant total control after exploitation, and to check whether a system was already compromised before or while the patch is applied.

The PHP Group, the organization that maintains the language, released fixed versions on October 21. The two flaws are CVE-2026-109618, an out-of-memory handling error that can leave request memory only partly initialized, and CVE-2026-109619, a condition in which internal request state survives after its memory is freed.

Both carry a CVSS 4.0 base score of 9.2 assigned by the PHP Group. Attack complexity is high and success depends on particular worker and memory configurations. PHP rates Apache with the mod_php module as the highest-risk deployment.

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier receive no further project patches. CISA’s updated alert of October 26 directs organizations that cannot update immediately, or that still run unsupported versions, to take the PHP-based systems offline until they can be patched.

Refer a friend

Locations Affected

Global web infrastructure: All PHP installations that serve web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. No specific geographic coordinates or named sites have been published by CISA or the PHP Group.

Latest Developments

UKMTO Reports Vessel on Fire Southeast of Al-Faw, Iraq, After Tanker Struck and Disabled in Strait of Hormuz

Defcon Level — Mon, 26 Oct 2026 20:12:28 GMT

PERSIAN GULF — United Kingdom Maritime Trade Operations (UKMTO) received multiple third-party reports on October 26 of a vessel on fire 63 nautical miles southeast of Al-Faw, Iraq, with crew status, damage assessment, and environmental impact unknown at the time of the report.

More Mideast Alerts

In a separate verified time-late report issued the same day, UKMTO stated that a tanker transiting outbound in the Strait of Hormuz was struck by an unknown projectile at 8:39 AM UTC on October 23, disabling the vessel.

Refer a friend

The crew were reported safe, and no damage assessment or environmental impact report was available at the time.

Saudi-Led Coalition Reports Intercept of Houthi Ballistic Missile Directed at Riyadh

Defcon Level — Sun, 25 Oct 2026 06:34:36 GMT

RIYADH — Major General Turki Al-Maliki, spokesman for the Coalition to Restore Legitimacy in Yemen, stated on October 25 that air defenses intercepted and destroyed a ballistic missile launched by the Houthi militia toward Riyadh.

Map credits: Open Street Map, Modified Copernicus Sentinel data.

More Mideast Alerts

The spokesman said that a drone was intercepted and destroyed in the Riyadh region. Saudi Civil Defense stated that the danger had passed in Riyadh City.

These intercepts continue a series of coalition-reported actions against Houthi launches directed at Saudi territory. Between October 21 and 24 Al-Maliki’s official account stated that air defenses had intercepted and destroyed additional ballistic missiles directed at Riyadh, Taif, Yanbu, Khamis Mushait, and Najran, along with multiple drones in the Riyadh, southern, and eastern regions.

Houthi military spokesman Yahya Saree renewed a warning on October 24 that King Khalid Airport in Riyadh remains a military target and is not safe for airlines, employees, or travelers.

Locations Affected

Unclassified Memo Attributed to DNI Clayton States Iranian Lethal Plotting Against U.S. Personnel Has Reached Advanced Stages

Defcon Level — Sun, 25 Oct 2026 00:41:35 GMT

WASHINGTON — An unclassified memo dated October 23, 2026, and attributed to Director of National Intelligence Jay Clayton, is addressed to Secretary of State Marco Rubio.

Director of National Intelligence Jay Clayton

More Mideast Alerts

The memo states that the Intelligence Community has received intelligence through various channels that Iran has substantially increased efforts to target U.S. personnel. It further states that the lethal plotting efforts by the Iranians against U.S. citizens have reached advanced stages in both the Middle East and certain other countries.

SpaceX Applied Speed Limits on Starlink and Starshield in Ukraine for 10 Days Before Restoring Service

Defcon Level — Sat, 24 Oct 2026 23:46:18 GMT

UKRAINE — Ukraine’s Ministry of Defense stated on October 24 that its monitoring systems recorded the restoration of Starlink and Starshield operating speeds, with connectivity remaining stable at mo…

Trump Declines to Disclose Timing of Possible Further Action Against Iran

Defcon Level — Sat, 24 Oct 2026 22:10:56 GMT

WASHINGTON — President Donald Trump told reporters on Saturday, October 24 that he would not say whether or when the United States might take further action against Iran.

U.S. President Donald J. Trump

More Alerts

In response to a question about how far along any possible attack was, he said he would not reveal that information, called the question stupid, and then stated sarcastically that the administration was “thinking about doing it, and maybe tomorrow,” before immediately repeating that he would not disclose such details.

Refer a friend

A reporter asked, “How far along are you on a possible attack on Iran?” Trump answered, “Would you really think I’d tell you that?” He continued, “What I mean, can anybody from the Wall Street Journal ask a question so stupid?”

He then said, “How far am I? Let me tell you. Well, we’re thinking about doing it, and maybe tomorrow.” He followed at once with, “Do you really think I’m gonna tell you? If I’m going to do it, and there’s a possibility I will, there’s also a possibility we’ll have a nice, big, beautiful agreement.”

The “maybe tomorrow” statement was said after Trump had rejected the premise of answering an operational question and after he had labeled the question stupid. He then restated the refusal to disclose timing.

Some mainstream outlets published accounts that quoted the “maybe tomorrow” phrase presented it as though the strike could happen as soon as tomorrow. Those accounts match portions of the words spoken without the sarcastic context included. The video of the exchange shows the phrase occurring inside the longer refusal to answer the timing question.

Trump continued by saying Iranian leaders “wanna make a deal” but questioning “will they hold the deal?” He stated that he could have conducted the earlier B-2 strikes “a year ago and left,” but that over one to two years Iran “would have somehow figured a way to make a nuclear bomb.”

He said, “I’ve gotta make it permanent. That’s the only reason I’m doing it, as long as I’m doing.” He also described Iranian jet fighters and ships as destroyed, oil flows through the Strait of Hormuz as higher than before the conflict, and Iranian inflation as high.

No official White House or Department of War statement has expanded on the Saturday remarks as of October 25, 2026.

Latest Developments

Philippine Defense Secretary States Forcible Action Against BRP Sierra Madre Would Be an Act of War

Defcon Level — Sat, 24 Oct 2026 20:53:57 GMT

MANILA — Philippine Department of National Defense Secretary Gilberto Teodoro Jr. stated on October 23, that any use of force against the grounded BRP Sierra Madre at Ayungin Shoal would constitute a…

Latvian Forces Find Foreign UAV Drone in Liepna Parish After October 18 Report

Defcon Level — Sat, 24 Oct 2026 19:27:25 GMT

LATVIA — On October 24, Latvia’s National Armed Forces (NBS) said a foreign unmanned aerial vehicle was found in Liepna parish of Alūksne municipality, and that the vehicle likely entered Latvian air…

Yemeni Armed Forces: Coalition Airstrikes Neutralized Houthi Command Center and Destroyed Two Tanks at Abandoned Sofitel Hotel in Taiz

Defcon Level — Sat, 24 Oct 2026 01:04:34 GMT

TAIZ — Yemeni Armed Forces reported that coalition airstrikes struck key Houthi positions at the abandoned Sofitel Hotel east of Taiz city, neutralizing a command-and-control center and destroying two tanks.

More Mideast Alerts

The site served as a heavily fortified command-and-control center used by the Houthi militia to launch attacks against the civilian population, and the action was taken in response to the Houthi Militia’s targeting of civilians, according to the Yemeni Armed Forces spokesperson.

NSA and CISA Maintain Recommendation to Patch or Take Offline Systems Affected by PHP2Shell

Defcon Level — Sat, 24 Oct 2026 00:30:33 GMT

WASHINGTON — The National Security Agency issued its formal advisory on October 21 recommending immediate inventory and patching of systems running PHP, or taking them offline if an update is not feasible, after the PHP project released fixes that day for two critical remote code execution vulnerabilities nicknamed PHP2Shell.

Refer a friend

The Cybersecurity and Infrastructure Security Agency updated its alert on October 23 to reinforce the same actions, add a detection rule, and restate that organizations unable to update immediately should take PHP-based systems offline.

UKMTO: Time-Late Report Of Tanker Hit By Unknown Projectile Northeast of Limah, Oman

Defcon Level — Fri, 23 Oct 2026 19:38:02 GMT

STRAIT OF HORMUZ — United Kingdom Maritime Trade Operations received a time-late report on October 23 of an incident that occurred on October 22 at 5:15 PM UTC, in which a tanker was hit by an unknown projectile while transiting outbound in the Strait of Hormuz 7 nautical miles northeast of Limah, Oman.

Map credits: Powered By Esri, Open Street Map, Modified Copernicus Sentinel data.

More Mideast Alerts

The tanker was able to continue its voyage to the next port of call, United Kingdom Maritime Trade Operations said in Warning 181-26.

PHP Releases Emergency Patches for Two Critical Flaws That Let Attackers Run Code on Web Servers

Defcon Level — Wed, 21 Oct 2026 21:56:37 GMT

CYBER — The PHP project shipped emergency updates on October 21, 2026, that fix two critical security flaws. These flaws can let an attacker run code on a web server that uses PHP, without needing a login or any credentials.

More Cyber/Tech Alerts

The updates cover the currently supported versions of PHP. The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day urging organizations to apply the patches immediately and stated it had not observed any exploitation as of the time of publication.

The two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 on the standard severity scale for software vulnerabilities. They affect every PHP installation that serves web requests, including the common setups used with Apache, PHP-FPM, and other web servers.

The risk is highest for Apache servers running the mod_php module, where researchers showed that a simple unauthenticated web request can trigger the problem before any website code even starts running. No threat group has claimed responsibility, and CISA has not linked the flaws to any specific attacker.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older unsupported branches (PHP 8.1 and earlier) do not receive official updates from the PHP project, though limited source-level fixes were provided for some of them.

Linux distributions and long-term support vendors received the patches ahead of the public release so they could prepare their own packages.

What Is PHP?

PHP is a programming language created in 1994 that runs on web servers to build and deliver websites and web applications. When a visitor requests a page, the server executes the PHP code, generates the finished output (typically HTML), and sends that result to the browser. The PHP source code remains on the server and is never transmitted to the user.

PHP is one of the most widely deployed server-side languages on the public internet. W3Techs data as of October 21 shows that PHP is used by approximately 69.3 percent of all websites whose server-side programming language can be identified.

WordPress, which is built on PHP, accounts for roughly 40 percent of all websites. Other systems that run on PHP include Drupal, Joomla, Magento, and applications built with frameworks such as Laravel.

An internet exposure survey published on 21 October 2026 observed 5.48 million active services showing PHP indicators across about 3.34 million IP addresses worldwide.

The United States accounted for the largest share of those services. Other technology trackers have reported tens of millions of websites detected as running PHP. These figures cover publicly reachable systems and do not include internal or non-public installations.

PHP is commonly paired with the Apache web server, often through the mod_php module, or with PHP-FPM, a process manager used with servers such as Nginx.

Because PHP underpins a large share of public and internal web systems, a critical flaw that can be triggered by an ordinary web request has broad reach.

A meaningful share of sites continue to run older, unsupported versions of PHP that do not receive official patches from the PHP project.

What Unauthenticated Remote Code Execution Means

Unauthenticated remote code execution means an attacker can send a request over the network to a system and cause that system to run commands of the attacker’s choosing.

No username, password, or other credentials are required. The attacker does not need an account on the target system and does not need to interact with a logged-in user.

On a web server the practical result is that the attacker can reach the server from the internet and instruct it to perform actions that the server’s normal users are not allowed to perform.

Those actions can include reading or changing files, creating new accounts, installing additional software, or using the server to reach other systems on the same network. The exact capabilities depend on the privileges of the process that runs the vulnerable software.

In the case of the two PHP flaws, researchers have shown that an ordinary web request can trigger the problem on certain common server configurations before any of the website’s own code begins to run.

Application-level controls that sit inside the website, such as login checks or input filters written by the site owner, therefore do not see the request in time to block it. Protection depends on the version of PHP that is installed and on the configuration of the web server itself.

CISA has stated that it has not observed exploitation of these flaws as of the time of publication. The absence of confirmed exploitation does not remove the exposure.

Any internet-facing or internal system running an affected version of PHP remains reachable by an attacker who sends the right request, until that system is updated to a fixed version.

Incident Parameters

AFRICOM Conducts Airstrike Targeting al-Shabaab in Cal Madow Mountains

Defcon Level — Wed, 21 Oct 2026 19:10:40 GMT

SOMALIA — U.S. Africa Command (AFRICOM) conducted an airstrike targeting al-Shabaab on October 19 in the vicinity of the Cal Madow Mountains, approximately 23 miles (37 km) south of Bossaso, in coordination with the Federal Government of Somalia.

Map credits: Open Street Map, Modified Copernicus Sentinel data.

More Africa Alerts

A separate earlier strike on October 17 targeted al-Shabaab in the vicinity of Dhooble Airport, approximately 112 miles (180 km) northwest of Kismayo, also in coordination with the Federal Government of Somalia.

U.S. Embassy Reports Partial Curfews In France After Demonstrations That Turned Violent

Defcon Level — Mon, 19 Oct 2026 23:17:15 GMT

FRANCE — On October 19 the U.S. Embassy in Paris issued a security alert stating that, following the October 17 protests that turned violent, partial curfews were introduced for Monday, October 19 an…

Kenya: U.S. State Department Raises Travel Advisory to Level 3, Reconsider Travel

Defcon Level — Mon, 19 Oct 2026 22:47:20 GMT

KENYA — On October 19 the U.S. Department of State increased its travel advisory for Kenya from Level 2, Exercise Increased Caution, to Level 3, Reconsider Travel, due to the risk of health, crime, k…

Haiti: U.S. Embassy Alerts of Continuous Fighting in Santo and Croix-des-Bouquets

Defcon Level — Mon, 19 Oct 2026 22:06:13 GMT

HAITI — On October 19 the U.S. Embassy in Port-au-Prince reported continuous heavy fighting between gangs and security forces in the vicinity of Santo and Croix-des-Bouquets, with roads possibly bloc…

Kim Yo Jong: North Korea Considers Resuming Loudspeaker Broadcasts and Deploying More Tactical Weapons Along Southern Border

Defcon Level — Mon, 19 Oct 2026 14:17:24 GMT

KOREAN PENINSULA — Kim Yo Jong, department director of the Central Committee of the Workers’ Party of Korea and sister of leader Kim Jong Un, released a press statement through the Korean Central New…

Russia Declares Non-Negotiable Security Zone as Energy Strikes Continue and US Support Faces Friction

Defcon Level — Sun, 18 Oct 2026 20:35:41 GMT

UKRAINE — On October 18, Russian forces and Ukrainian forces continued strikes on energy infrastructure while Russian President Vladimir Putin stated that Russian forces were establishing a security zone inside Ukraine along the shared border that would not be a subject of potential peace negotiations.

Russian President Vladimir Putin. Credit: Kremlin.ru, CC BY 4.0, via Wikimedia

More Europe Alerts

The planned zone spans 660 km (410 miles), of which 70 percent was under Russian control, Kremlin spokesman Dmitry Peskov said. The zone requires Russian forces to hold land in Ukraine’s Sumy and Kharkiv regions, which Russia has not claimed as its own territory.

Ukrainian President Volodymyr Zelenskyy said on October 18 that US intelligence sharing on Russian ballistic missile launches had resumed after a temporary block lasting three days, and that he was thankful for the restoration.

President Trump and Ukranian President Zelensky at Mar-a-Lago in Palm Beach, Florida, December 28, 2025

Refer a friend

Ukrainian forces reported continued operations under Operation Vivaldi in the Donetsk region that had recaptured more territory since the start of autumn than Russian forces had captured in the same period.

Unidentified Object Enters Lithuanian Airspace Near Pasvalys, NATO Baltic Air Policing Fighters Scrambled

Defcon Level — Sun, 18 Oct 2026 13:14:40 GMT

BALTICS — On October 18, an unidentified object, possibly an unmanned aerial vehicle, entered Lithuanian airspace between 6:00 a.m. and 8:00 a.m. local time.

Map credits: Open Street Map, Modified Copernicus Sentinel data.

More Europe Alerts

It triggered red air alerts in Panevėžys and Šiauliai counties, a brief closure of Kaunas Airport, and the scramble of NATO Baltic Air Policing fighter jets that tracked the object but did not engage it, according to the Latvian National Armed Forces and Lithuanian National Crisis Management Center statements.

Debris consistent with a possible drone was later recovered near Juodzionys village in Pasvalys district near the Latvian border.

Latvian authorities activated then lifted a cell-broadcast alert in Bauska, Aizkraukle, and Ogre municipalities citing a possible threat of entry.

The Lithuanian Defense Ministry assessed the object likely entered from Polish territory.

Separately, on October 17, Romanian Air Force F-16 aircraft conducting air policing missions shot down two drones over Romanian territorial waters in the Black Sea after they entered national airspace without authorization.

Polish authorities continued verification of a possible overnight airspace violation near Lublin by an unidentified object, with no confirmation issued and search operations ongoing involving ground teams and a helicopter.

Poland’s Operational Command separately stated that preventive air operations related to Russian strikes on Ukraine had concluded with no observed violation of Polish airspace.

Lithuanian Officials Assess Object Likely Entered from Polish Territory

Canadian Armed Forces Confirm Fatalities and Injuries After Fire Spreads From CFB Wainwright Training Area

Defcon Level — Sun, 18 Oct 2026 09:43:58 GMT

ALBERTA — A fire ignited within the training area of Canadian Forces Base (CFB) Wainwright, Alberta, at approximately 4:00 p.m. local time on October 17.

More North America Alerts

The fire spread rapidly beyond the boundaries …