CISA KEV Flash: 10 CVEs Added — Ivanti Connect Secure & PHP Under Active Exploitation

---
title: Ivanti Connect Secure Suspicious Authentication Activity
description: Detects potential exploitation of CVE-2026-118527 (predictable identifiers) and CVE-2026-111357 (missing authentication) through anomalous authentication patterns
author: Security Arsenal Detection Engineering
date: 2026/10/30
status: experimental
logsource:
    product: ivanti
    service: connect_secure
    category: authentication
detection:
    selection_session_anomaly:
        event_type:
            - 'session_created'
            - 'session_hijack_attempt'
            - 'token_validation_failed'
        source_ip|contains:
            - '/8'
            - '/16'
    selection_auth_bypass:
        event_type: 'authentication_success'
        auth_method: 'unknown'
        user_agent|contains:
            - 'python'
            - 'curl'
            - 'wget'
            - 'go-http'
    selection_critical_function:
        event_type: 'admin_function_invoked'
        auth_context: 'local'
        function_name|contains:
            - 'config'
            - 'user'
            - 'system'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative API automation
    - Vulnerability scanners (verify source)
level: high
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1190
    - cve.2026.118527
    - cve.2026.111357
---
title: PHP Remote Code Execution Attempt - CVE-2026-109618 and CVE-2026-109619
description: Detects potential exploitation attempts against PHP out-of-memory corruption and stale request-state vulnerabilities
author: Security Arsenal Detection Engineering
date: 2026/10/30
status: experimental
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection_memory_corruption:
        request_method: 'POST'
        request_body|contains:
            - 'memory_limit'
            - 'zend_mm'
            - '\\x00\\x00\\x00'
        response_code: '500'
    selection_request_smuggling:
        request_headers|contains:
            - 'Transfer-Encoding: chunked'
            - 'Content-Length:'
        request_uri|contains:
            - '%0d%0a'
            - '%0D%0A'
    selection_rce_indicators:
        request_uri|contains:
            - 'eval('
            - 'system('
            - 'exec('
            - 'shell_exec('
            - 'passthru('
            - 'base64_decode'
        response_code: '200'
    selection_error_pattern:
        error_log|contains:
            - 'Segmentation fault'
            - 'memory corruption'
            - 'zend_mm_heap corrupted'
            - 'double free'
    condition: 1 of selection_*
falsepositives:
    - Legitimate PHP debugging activities
    - Security scanning tools
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.109618
    - cve.2026.109619
---
title: Adobe Commerce Magento File Upload Exploitation - CVE-2026-48356
description: Detects malicious file upload attempts and web shell deployment on Adobe Commerce/Magento platforms
author: Security Arsenal Detection Engineering
date: 2026/10/30
status: experimental
logsource:
    category: webserver
    product: adobe
    service: commerce
detection:
    selection_upload_attempt:
        request_method: 'POST'
        request_uri|contains:
            - '/admin/'
            - '/api/'
            - '/media/'
            - '/pub/'
            - '/downloader/'
        request_body|contains:
            - 'filename='
            - '.php'
            - '.phtml'
            - '.php3'
            - '.php4'
            - '.php5'
            - '.pht'
    selection_webshell_deployment:
        file_path|contains:
            - '/pub/media/'
            - '/var/'
            - '/app/'
        file_extension:
            - '.php'
            - '.phtml'
        file_content|contains:
            - 'eval('
            - 'base64_decode('
            - 'shell_exec('
            - '$_POST'
            - '$_GET'
            - '$_REQUEST'
    condition: selection_upload_attempt or selection_webshell_deployment
falsepositives:
    - Legitimate theme/extension uploads (verify source and hash)
    - Development activities in staging environments
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - cve.2026.48356

// Security Arsenal — CISA KEV Active Exploitation Hunt
// Targets: CVE-2026-118527, CVE-2026-111357, CVE-2026-109618, CVE-2026-109619, CVE-2026-48356
// Timeframe: Last 7 days (adjust as needed)

let LookbackPeriod = 7d;
let HighRiskPorts = dynamic([443, 8443, 4443, 10443]);
let SuspiciousUserAgents = dynamic(["python", "curl", "wget", "go-http-client", "nikto", "sqlmap", "nuclei", "masscan"]);
let WebShellIndicators = dynamic(["eval(", "base64_decode(", "shell_exec(", "passthru(", "system(", "$_POST[", "$_GET[", "$_REQUEST["]);
let PHPExploitPaths = dynamic(["/index.php", "/api/", "/graphql", "/rest/", "/admin/", "/pub/", "/downloader/", "/media/"]);

// Hunt 1: Ivanti Connect Secure exploitation indicators
let IvantiExploitation = union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(LookbackPeriod)
    | where DeviceVendor =~ "Ivanti" or DeviceProduct contains "Connect Secure"
    | where Activity contains "auth" or Activity contains "session"
    | where Message contains "predictable" or Message contains "bypass" or Message contains "unauthorized"
    | extend ExploitIndicator = "Ivanti Auth Anomaly"
    | project TimeGenerated, SourceIP, DestinationIP, Activity, Message, ExploitIndicator),
    (Syslog
    | where TimeGenerated > ago(LookbackPeriod)
    | where SyslogMessage contains "ivanti" or SyslogMessage contains "connect_secure"
    | where SyslogMessage contains "session" and (SyslogMessage contains "invalid" or SyslogMessage contains "hijack")
    | extend ExploitIndicator = "Ivanti Session Anomaly"
    | project TimeGenerated, Computer, SyslogMessage, ExploitIndicator);

// Hunt 2: PHP RCE exploitation attempts
let PHPExploitation = W3CIISLog
    | where TimeGenerated > ago(LookbackPeriod)
    | where csMethod == "POST" or csMethod == "PUT"
    | where csUserAgent has_any (SuspiciousUserAgents)
       or csUriStem has_any (PHPExploitPaths)
    | where scStatus in (200, 500, 502)
    | extend ExploitIndicator = case(
        scStatus == 500, "PHP Memory Corruption Attempt",
        csUserAgent has_any (SuspiciousUserAgents), "Suspicious Scanner Activity",
        "Potential PHP Exploitation"
    )
    | project TimeGenerated, sIP, cIP, csUriStem, csMethod, scStatus, csUserAgent, ExploitIndicator;

// Hunt 3: Magento/Adobe Commerce file upload exploitation
let MagentoExploitation = union isfuzzy=true
    (W3CIISLog
    | where TimeGenerated > ago(LookbackPeriod)
    | where csUriStem contains "/admin" or csUriStem contains "/downloader" or csUriStem contains "/api"
    | where csMethod == "POST"
    | where csUriQuery has_any (WebShellIndicators) or csUserAgent has_any (SuspiciousUserAgents)
    | extend ExploitIndicator = "Magento Upload Exploitation"
    | project TimeGenerated, sIP, cIP, csUriStem, csMethod, csUriQuery, ExploitIndicator),
    (AzureDiagnostics
    | where TimeGenerated > ago(LookbackPeriod)
    | where requestUri_s contains "magento" or requestUri_s contains "/pub/media"
    | where httpMethod_s == "POST"
    | where httpStatus_d in (200, 201)
    | extend ExploitIndicator = "Magento Suspicious Upload"
    | project TimeGenerated, clientIp_s, requestUri_s, httpMethod_s, httpStatus_d, ExploitIndicator);

// Hunt 4: Linux Kernel exploitation precursor activity
let KernelExploitation = Syslog
    | where TimeGenerated > ago(LookbackPeriod)
    | where Facility == "kern"
    | where SyslogMessage contains "BUG" or SyslogMessage contains "WARNING" or SyslogMessage contains "Oops"
    | where SyslogMessage contains "page" or SyslogMessage contains "memory" or SyslogMessage contains "uninitialized"
    | extend ExploitIndicator = "Kernel Memory Anomaly"
    | project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage, ExploitIndicator;

// Hunt 5: Network perimeter exploitation (Cisco ASA/FTD DoS indicators)
let NetworkExploitation = CommonSecurityLog
    | where TimeGenerated > ago(LookbackPeriod)
    | where DeviceVendor =~ "Cisco"
    | where DeviceProduct contains "ASA" or DeviceProduct contains "FTD"
    | where Activity contains "deny" or Activity contains "drop" or Activity contains "restart"
    | summarize ConnectionCount = count(), UniqueSources = dcount(SourceIP) by DestinationIP, DestinationPort, bin(TimeGenerated, 5m)
    | where ConnectionCount > 1000 or UniqueSources > 100
    | extend ExploitIndicator = "Potential DoS Against Firewall"
    | project TimeGenerated, DestinationIP, DestinationPort, ConnectionCount, UniqueSources, ExploitIndicator;

// Combine all hunts
union isfuzzy=true IvantiExploitation, PHPExploitation, MagentoExploitation, KernelExploitation, NetworkExploitation
| sort by TimeGenerated desc
| summarize count() by ExploitIndicator, bin(TimeGenerated, 1h)
| render timechart

<#
.SYNOPSIS
    Security Arsenal — CISA KEV Wave 2026-10-26 to 2026-10-30 Inventory & Remediation Script

.DESCRIPTION
    Scans the environment for systems potentially vulnerable to the 10 newly added CISA KEV CVEs.
    Checks for Ivanti Connect Secure, PHP, GitLab, Adobe Commerce/Magento, Cisco ASA indicators,
    VMware ESXi, Linux kernel versions, and Brotli library presence.

.PARAMETER OutputPath
    Path for the vulnerability assessment report (default: .\KEV_Assessment_Report.html)

.PARAMETER Credential
    PSCredential for remote system queries

.EXAMPLE
    .\Invoke-KEVAssessment.ps1 -OutputPath "C:\Reports\KEV_Report.html"

.NOTES
    Author: Security Arsenal Detection Engineering
    Date: 2026-10-30
    Version: 1.0
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [string]$OutputPath = ".\KEV_Assessment_Report.html",

    [Parameter(Mandatory=$false)]
    [PSCredential]$Credential
)

$ErrorActionPreference = "Continue"
$ReportData = @()

Write-Host "==============================================" -ForegroundColor Cyan
Write-Host "  Security Arsenal — CISA KEV Assessment Tool" -ForegroundColor Cyan
Write-Host "  Wave: 2026-10-26 to 2026-10-30" -ForegroundColor Cyan
Write-Host "==============================================" -ForegroundColor Cyan
Write-Host ""

# Function to check PHP version
function Test-PHPVulnerability {
    Write-Host "[*] Checking for PHP installations..." -ForegroundColor Yellow

    $PHPPaths = @(
        "C:\php\php.exe",
        "C:\Program Files\PHP\php.exe",
        "C:\inetpub\wwwroot\php\php.exe",
        "/usr/bin/php",
        "/usr/local/bin/php"
    )

    $results = @()
    foreach ($path in $PHPPaths) {
        if (Test-Path $path) {
            try {
                $version = & $path -v 2>$null | Select-Object -First 1
                $versionMatch = [regex]::Match($version, 'PHP (\d+\.\d+\.\d+)')
                if ($versionMatch.Success) {
                    $phpVersion = $versionMatch.Groups[1].Value
                    $results += [PSCustomObject]@{
                        Product = "PHP"
                        Path = $path
                        Version = $phpVersion
                        CVEs = "CVE-2026-109618, CVE-2026-109619"
                        Risk = "CRITICAL"
                        Action = "Update to latest PHP security release immediately"
                    }
                    Write-Host "  [!] Found PHP $phpVersion at $path" -ForegroundColor Red
                }
            } catch {
                Write-Verbose "Error checking PHP at $path : $_"
            }
        }
    }
    return $results
}

# Function to check for Magento/Adobe Commerce
function Test-MagentoVulnerability {
    Write-Host "[*] Checking for Adobe Commerce/Magento installations..." -ForegroundColor Yellow

    $MagentoPaths = @(
        "C:\inetpub\wwwroot\magento",
        "C:\inetpub\wwwroot\app\etc\env.php",
        "/var/www/html/magento",
        "/var/www/html/app/etc/env.php",
        "/srv/magento"
    )

    $results = @()
    foreach ($path in $MagentoPaths) {
        if (Test-Path $path) {
            $version = "Unknown"
            $composerPath = Join-Path (Split-Path $path -Parent) "composer.json"
            if (Test-Path $composerPath) {
                try {
                    $composer = Get-Content $composerPath | ConvertFrom-Json
                    if ($composer.version) { $version = $composer.version }
                } catch { }
            }
            $results += [PSCustomObject]@{
                Product = "Adobe Commerce/Magento"
                Path = $path
                Version = $version
                CVEs = "CVE-2026-48356"
                Risk = "CRITICAL"
                Action = "Apply Adobe security patch immediately; audit upload directories"
            }
            Write-Host "  [!] Found Magento installation at $path" -ForegroundColor Red
        }
    }
    return $results
}

# Function to check for GitLab
function Test-GitLabVulnerability {
    Write-Host "[*] Checking for GitLab installations..." -ForegroundColor Yellow

    $results = @()

    # Check for GitLab service
    $gitlabService = Get-Service -Name "gitlab*" -ErrorAction SilentlyContinue
    if ($gitlabService) {
        $results += [PSCustomObject]@{
            Product = "GitLab"
            Path = "Service: $($gitlabService.Name)"
            Version = "Unknown - check GitLab admin panel"
            CVEs = "CVE-2026-97229"
            Risk = "HIGH"
            Action = "Update GitLab to latest security release"
        }
        Write-Host "  [!] Found GitLab service: $($gitlabService.Name)" -ForegroundColor Red
    }

    # Check common GitLab paths
    $GitLabPaths = @("/opt/gitlab", "/etc/gitlab", "C:\GitLab")
    foreach ($path in $GitLabPaths) {
        if (Test-Path $path) {
            $results += [PSCustomObject]@{
                Product = "GitLab"
                Path = $path
                Version = "Unknown - check /opt/gitlab/version-manifest.txt"
                CVEs = "CVE-2026-97229"
                Risk = "HIGH"
                Action = "Update GitLab to latest security release"
            }
            Write-Host "  [!] Found GitLab installation at $path" -ForegroundColor Red
        }
    }
    return $results
}

# Function to check for Ivanti Connect Secure
function Test-IvantiVulnerability {
    Write-Host "[*] Checking for Ivanti Connect Secure indicators..." -ForegroundColor Yellow

    $results = @()

    # Check for Ivanti registry keys
    $IvantiRegPaths = @(
        "HKLM:\SOFTWARE\Ivanti",
        "HKLM:\SOFTWARE\Pulse Secure",
        "HKLM:\SOFTWARE\WOW6432Node\Ivanti"
    )

    foreach ($regPath in $IvantiRegPaths) {
        if (Test-Path $regPath) {
            $results += [PSCustomObject]@{
                Product = "Ivanti Connect Secure"
                Path = $regPath
                Version = "Check ICS admin console"
                CVEs = "CVE-2026-118527, CVE-2026-111357"
                Risk = "CRITICAL"
                Action = "Apply Ivanti security update immediately"
            }
            Write-Host "  [!] Found Ivanti registry presence at $regPath" -ForegroundColor Red
        }
    }
    return $results
}

# Function to check Linux kernel version (if running on Linux/WSL)
function Test-KernelVulnerability {
    Write-Host "[*] Checking kernel version..." -ForegroundColor Yellow

    $results = @()

    if ($IsLinux -or $IsMacOS) {
        try {
            $kernelVersion = uname -r
            $results += [PSCustomObject]@{
                Product = "Linux Kernel"
                Path = "N/A"
                Version = $kernelVersion
                CVEs = "CVE-2026-46300"
                Risk = "HIGH"
                Action = "Update kernel via distribution package manager"
            }
            Write-Host "  [!] Linux Kernel version: $kernelVersion" -ForegroundColor Yellow
            Write-Host "      Check with your distribution for patched kernel availability" -ForegroundColor Yellow
        } catch { }
    } else {
        Write-Host "  [-] Windows system - kernel check not applicable" -ForegroundColor Gray
    }
    return $results
}

# Function to check for Brotli library
function Test-BrotliVulnerability {
    Write-Host "[*] Checking for Brotli library presence..." -ForegroundColor Yellow

    $results = @()

    # Common Brotli locations
    $BrotliPaths = @(
        "C:\Windows\System32\brotli*.dll",
        "/usr/lib/libbrotli*",
        "/usr/local/lib/libbrotli*"
    )

    foreach ($path in $BrotliPaths) {
        $found = Get-Item $path -ErrorAction SilentlyContinue
        if ($found) {
            foreach ($file in $found) {
                $results += [PSCustomObject]@{
                    Product = "Google Brotli Library"
                    Path = $file.FullName
                    Version = "Check application dependencies"
                    CVEs = "CVE-2026-111497"
                    Risk = "MEDIUM"
                    Action = "Update applications using Brotli; check vendor advisories"
                }
                Write-Host "  [!] Found Brotli library: $($file.FullName)" -ForegroundColor Yellow
            }
        }
    }
    return $results
}

# Function to check VMware ESXi (requires PowerCLI)
function Test-VMwareVulnerability {
    Write-Host "[*] Checking for VMware ESXi connectivity (requires PowerCLI)..." -ForegroundColor Yellow

    $results = @()

    if (Get-Module -ListAvailable -Name VMware.PowerCLI) {
        Write-Host "  [*] PowerCLI detected. Connect manually to check ESXi hosts." -ForegroundColor Cyan
        Write-Host "      Run: Connect-VIServer -Server <vCenter> then check host versions" -ForegroundColor Cyan
        $results += [PSCustomObject]@{
            Product = "VMware ESXi"
            Path = "PowerCLI Available"
            Version = "Connect to vCenter to enumerate"
            CVEs = "CVE-2026-41709"
            Risk = "MEDIUM"
            Action = "Apply VMware patches; review logging configurations"
        }
    } else {
        Write-Host "  [-] PowerCLI not installed - skipping VMware check" -ForegroundColor Gray
    }
    return $results
}

# Execute all checks
Write-Host ""
Write-Host "Starting vulnerability assessment..." -ForegroundColor Green
Write-Host ""

$ReportData += Test-PHPVulnerability
$ReportData += Test-MagentoVulnerability
$ReportData += Test-GitLabVulnerability
$ReportData += Test-IvantiVulnerability
$ReportData += Test-KernelVulnerability
$ReportData += Test-BrotliVulnerability
$ReportData += Test-VMwareVulnerability

# Generate summary
Write-Host ""
Write-Host "==============================================" -ForegroundColor Cyan
Write-Host "  ASSESSMENT SUMMARY" -ForegroundColor Cyan
Write-Host "==============================================" -ForegroundColor Cyan

if ($ReportData.Count -eq 0) {
    Write-Host "[+] No vulnerable products detected on this system." -ForegroundColor Green
} else {
    $criticalCount = ($ReportData | Where-Object { $_.Risk -eq "CRITICAL" }).Count
    $highCount = ($ReportData | Where-Object { $_.Risk -eq "HIGH" }).Count
    $mediumCount = ($ReportData | Where-Object { $_.Risk -eq "MEDIUM" }).Count

    Write-Host "[!] CRITICAL Risk Items: $criticalCount" -ForegroundColor Red
    Write-Host "[!] HIGH Risk Items: $highCount" -ForegroundColor Yellow
    Write-Host "[!] MEDIUM Risk Items: $mediumCount" -ForegroundColor Magenta
}

# Generate HTML report
$htmlReport = @"
<!DOCTYPE html>
<html>
<head>
    <title>CISA KEV Assessment Report</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        h1 { color: #333; }
        table { border-collapse: collapse; width: 100%; margin-top: 20px; }
        th, td { border: 1px solid #ddd; padding: 12px; text-align: left; }
        th { background-color: #4a5568; color: white; }
        .critical { background-color: #fed7d7; }
        .high { background-color: #feebc8; }
        .medium { background-color: #fefcbf; }
        .timestamp { color: #666; font-size: 0.9em; }
    </style>
</head>
<body>
    <h1>CISA KEV Vulnerability Assessment Report</h1>
    <p class="timestamp">Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC')</p>
    <p>Assessment for CISA KEV additions: 2026-10-26 to 2026-10-30</p>
    <table>
        <tr>
            <th>Product</th>
            <th>Path/Location</th>
            <th>Version</th>
            <th>CVEs</th>
            <th>Risk</th>
            <th>Recommended Action</th>
        </tr>
"@

foreach ($item in $ReportData) {
    $rowClass = switch ($item.Risk) {
        "CRITICAL" { "critical" }
        "HIGH" { "high" }
        "MEDIUM" { "medium" }
        default { "" }
    }
    $htmlReport += "<tr class='$rowClass'><td>$($item.Product)</td><td>$($item.Path)</td><td>$($item.Version)</td><td>$($item.CVEs)</td><td>$($item.Risk)</td><td>$($item.Action)</td></tr>`n"
}

$htmlReport += @"
    </table>
    <p><em>Report generated by Security Arsenal KEV Assessment Tool</em></p>
</body>
</html>
"@

$htmlReport | Out-File -FilePath $OutputPath -Encoding UTF8
Write-Host ""
Write-Host "[+] Report saved to: $OutputPath" -ForegroundColor Green
Write-Host ""
Write-Host "REMEDIATION PRIORITIES:" -ForegroundColor Cyan
Write-Host "1. PHP (CVE-2026-109618, CVE-2026-109619) - Unauthenticated RCE - PATCH IMMEDIATELY" -ForegroundColor Red
Write-Host "2. Adobe Commerce/Magento (CVE-2026-48356) - Unrestricted File Upload - PATCH IMMEDIATELY" -ForegroundColor Red
Write-Host "3. Ivanti Connect Secure (CVE-2026-118527, CVE-2026-111357) - Apply vendor patches" -ForegroundColor Yellow
Write-Host "4. GitLab (CVE-2026-97229) - Update to latest release" -ForegroundColor Yellow
Write-Host "5. Linux Kernel (CVE-2026-46300) - Apply distribution updates" -ForegroundColor Yellow
"@

### Validation Commands

After applying patches, validate remediation with these commands:

**PHP Version Check:**
```bash
php -v
# Verify version is at or above patched release from PHP security advisory

# Check applied patches
cd /var/www/html/magento
bin/magento setup:upgrade
bin/magento setup:di:compile
# Review var/log/system.log for errors

# Log into ICS admin console
# Navigate to: System > Status > Software Version
# Verify version matches patched release in Ivanti advisory

sudo gitlab-rake gitlab:env:info
# Verify version matches patched release from GitLab security advisory

uname -r
# Compare against distribution security advisory for patched kernel version