COMMZGEAR

October 30, 2026 · Podcast

Commzgear Podcast Episode 13

Show notes

Commzgear Podcast, Episode 1 (relaunch): PHP2Shell, Tailworm, WPSplinter and CMMC limbo. Current as of Oct 30, 2026.

  • PHP2Shell (CVE-2026-109618, CVE-2026-109619): Exploited in the wild and added to CISA KEV on Oct 26. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Investigate logs back to Oct 17. It’s being chained with the Linux kernel flaw Fragnesia (CVE-2026-46300), which was disclosed and patched in May 2026.
  • Tailworm: Update Tailscale to 1.104.4 or newer (bulletins TS-2026-014 to TS-2026-017). Interim mitigation: set TS_SSH_DISABLE_FORWARDING=1 in /etc/default/tailscaled on Linux and restart tailscaled. This breaks SSH tunneling and doesn’t replace the update. Headscale server-side fixes were still pending as of Oct 28.
  • WPSplinter: Broadcom legacy WPS Monitor bug, with no CVE. Disable WPS, check firmware, ask your ISP in writing, replace end-of-life gear, or bridge the ISP gateway behind your own router.
  • CMMC: Phase 2 is paused with no new date. Phase 1 self-assessments and DFARS 252.204-7012 still apply.

Sources (all opened Oct 30, 2026 JST)

  1. The Hacker News, “CISA confirms active exploitation of PHP2Shell” (Oct 27, 2026): https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
  2. Techzine, “PHP2Shell was exploited four days before disclosure, says Amazon” (Oct 22, 2026): https://www.techzine.eu/news/security/145197/php2shell-was-exploited-four-days-before-disclosure-says-amazon/
  3. IT-Connect, “PHP2Shell: Attackers Had a Four-Day Head Start Before the Patch” (Oct 23, 2026): https://www.it-connect.tech/php2shell-attackers-had-a-four-day-head-start-before-the-patch/
  4. Unite.AI, “Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers” (Oct 27, 2026): https://www.unite.ai/dream-reports-php2shell-attack-chain-that-compromised-25-servers/
  5. Tenable, “Fragnesia (CVE-2026-46300): Frequently asked questions” (May 14, 2026): https://tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc
  6. Konfirmity, “Tailworm: Tailscale SSH flaws” advisory (published Oct 25, updated Oct 28, 2026): https://www.konfirmity.com/advisories/tailscale-ssh-tailworm-vulnerabilities
  7. Techzine, “Broadcom WPSplinter vulnerability leaves millions of Belgian routers vulnerable” (Oct 19, 2026): https://www.techzine.eu/news/security/145085/broadcom-wpsplinter-vulnerability-leaves-millions-of-belgian-routers-vulnerable/
  8. PCWorld, “Millions of routers have a 16-year-old flaw that nobody plans to fix” (Oct 20, 2026): https://www.pcworld.com/article/3265053/millions-of-routers-have-a-16-year-old-flaw-that-nobody-plans-to-fix.html
  9. Federal News Network, “DoD’s reasons for CMMC pause falling apart in face of RFI responses” (Oct 26, 2026): https://federalnewsnetwork.com/defense-news/2026/10/dods-reasons-for-cmmc-pause-falling-apart-in-face-of-rfi-responses