CVE-2026-110264

Security Week 2644: Active Exploitation of PHP2Shell Vulnerabilities Confirmed

PHP developers released patches for two critical vulnerabilities collectively known as PHP2Shell on October 20, affecting PHP 8.2 through 8.5 as well as older branches. The flaws allow unauthenticated remote code execution on affected servers, which power approximately 70 percent of websites. Despite expectations of immediate exploitation, confirmed attacks with working exploits only began on October 25. CrowdStrike noted technical difficulties in weaponizing the issues in real-world environments. Only one-fifth of top Russian websites had applied the fixes by October 25. Additional incidents included compromised eMudhra certificates, a critical GitLab flaw, and a 16-year-old Broadcom router vulnerability.

GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution

GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.

Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution

GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.

GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions

GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.