SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked

Today's episode covers an update on the PHP2Shell vulnerabilities, a Signal flaw that kept calls alive after hang-up, critical Cisco Snort 3 vulnerabilities, and Linux kernel KSMBD vulnerability reports that were accidentally posted to a public mailing list.

PHP Vulnerability Update

Patches for the PHP remote code execution (RCE) vulnerabilities are now available from many vendors, with notable exceptions such as QNAP. Cloudflare reports a lot of exploit activity, and Amazon saw exploit attempts before public disclosure, but no simple, reliable exploit has surfaced yet. Beware of fake exploits that may attack the person running them.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Signal: Flooded Call Event Queue Blocks Local Hang-Up (CVE-2026-113380)

During a call, the other side could flood a Signal client with events and prevent it from hanging up, leaving the connection active so an attacker could keep listening through the microphone. The flaw has been patched; keep Signal updated automatically.

https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380

Cisco Snort 3 Critical Vulnerabilities

Cisco patched critical Snort 3 vulnerabilities with a base CVSS (Common Vulnerability Scoring System) score of 9.0. The four CVEs group multiple AI-discovered vulnerabilities by shared CWE (Common Weakness Enumeration), making the individual flaws less transparent. Snort is also included in several Cisco appliances.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe

Linux Kernel KSMBD Vulnerability Reports Leaked

Trend Micro's Zero Day Initiative accidentally posted unpatched Linux kernel vulnerability reports to a public kernel mailing list, including CVSS 9 remote code execution flaws in the kernel's built-in SMB file sharing server (KSMBD). No patches are available yet, and proof-of-concept exploit code was included in some reports.

https://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich