Happy Friday! Or hug-ops Friday, if you've been tasked with PHP2shell remediation. The Initial Access Intelligence team's exploit count for this week is sitting at 101 as we speak, with more coverage still coming in. Highlights from this week are below. For full details, please see the Initial Access Intelligence API.
This week, the team delivered an original exploit for PHP2shell CVE-2026-109618, along with more than a dozen network rules (including for CVE-2026-109619), a version scanner, PCAPs, and a target Docker. As of 1:30 AM ET on Thursday, October 22, the VulnCheck team had a weaponized exploit for CVE-2026-109618 that leveraged a confirmed memory leak chained into RCE on PHP 8.4.26 on x86-64 platforms with ASLR enabled and display_errors=off — i.e., the recommended production configuration. As of 7 PM ET on October 22, the exploit supported PHP 8.4.10-8.4.26 with no modifications. Today, the team added support for ARM64 and confirmed that our exploit works out of the box on a default WordPress Docker container running PHP 8.4.26.
The team has reviewed hundreds of exploits, the vast majority of which are non-functional or only exercise the vulnerability in artificial lab scenarios that would not be successful on production configurations. However, we've now seen at least one public PoC that successfully bypasses ASLR on x86 systems (for a single version of PHP); we're also seeing hundreds of exploit attempts hitting our Canary Intelligence network. It is likely adversaries will develop increasingly capable attacks over the weekend.
Read our PHP2shell blog here.
The team developed an original exploit for CVE-2026-107406, an unauthenticated SAML-processing vulnerability in Citrix NetScaler ADC and Gateway that yields remote code execution as root. NetScaler's internet-facing gateways are among the most aggressively targeted initial access surfaces, and exploitation requires no credentials and no valid signature; the only precondition is a SAML policy bound to the vserver. VulnCheck Target Intelligence identifies roughly 51,500 internet-facing Citrix NetScaler ADC and Gateway instances. VulnCheck catalogs no other public or commercial exploit for this vulnerability.
Our exploit ships with a version scanner, encrypted and unencrypted PCAPs, Suricata and Snort rules, a Sigma rule, a YARA rule, and ASM queries.
The team wrote an original exploit for CVE-2026-89035, a session-token rebinding in the MikroTik RouterOS WebFig web interface that gives an unauthenticated attacker a full admin session. The vulnerability was discovered by VulnCheck's own Valentin Lobstein. It reaches admin with no credentials on one of the most widely deployed router platforms on the internet and amplifies CVE-2025-61481 (WebFig served over cleartext HTTP by default). VulnCheck Target Intelligence sees roughly 241,000 internet-facing MikroTik RouterOS instances for this CVE. Our exploit ships with a Docker target and ASM queries.
The team also developed an exploit for CVE-2026-67281, an unauthenticated arbitrary file read in the MikroTik RouterOS WebFig web interface. We covered it because it reads any file with no credentials, including the config store that holds the admin account and device secrets. VulnCheck Target Intelligence sees roughly 29,000 internet-facing MikroTik RouterOS instances for this CVE. Our exploit ships with a Docker target, PCAPs, and Snort and Suricata rules.
The team added an exploit for CVE-2026-23702, an OS command injection that runs as root on Copeland XWEB refrigeration supervisors (Emerson/Copeland, the Dixell line); these are controllers that run cold storage, compressors, and alarms across supermarkets and industrial sites. We covered it because it gives root on the same class of OT refrigeration controllers hit in the October 2026 attacks that overheated cold storage at around 700 French supermarkets; paired with the code-of-day bypass (CVE-2026-21718) it is unauthenticated end to end. The XWEB vulnerabilities were disclosed by Claroty Team82. Our exploit ships with a Docker target, PCAPs, and Snort and Suricata rules.
The team developed an exploit chaining CVE-2025-41450 and CVE-2025-41451 for unauthenticated remote code execution in the Danfoss AK-SM 800A, the system manager that runs refrigeration, compressors, and alarms across supermarkets and cold-storage sites. We covered it because it runs commands as root with no credentials, and because these controllers were the target of the October 2026 attack that remotely overheated refrigeration at around 700 French supermarkets, spoiling food and starting fires, with losses estimated in the tens of millions of Euros in a single day and an ANSSI investigation opened. CVE-2025-41450 is in VulnCheck KEV, added October 14, 2026, ahead of CISA. Our exploit ships with a Docker target, encrypted and unencrypted PCAPs, and Snort and Suricata rules.
Finally, the team developed an exploit chaining CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 for unauthenticated remote code execution in Plex Media Server, which is widely run on home networks, NAS boxes, and cloud hosts. It runs code on the server with no credentials and is already in VulnCheck KEV (added October 18, 2026, ahead of CISA), with reported in-the-wild exploitation dropping a coin miner and a residential proxy. VulnCheck Target Intelligence identifies roughly 307,000 internet-facing Plex Media Server instances. Our exploit ships with a version scanner, a Docker target, PCAPs, Snort and Suricata rules, a YARA rule, and ASM queries.