[{"data":1,"prerenderedAt":1331},["ShallowReactive",2],{"post-en-fortinet-hardening-release-patchen-ohne-advisory":3,"related-en-fortinet-hardening-release-patchen-ohne-advisory":313},{"id":4,"title":5,"author":6,"body":7,"category":283,"date":284,"description":285,"draft":286,"extension":287,"faq":288,"image":298,"imageAlt":299,"lang":300,"legacyUrl":301,"meta":302,"navigation":303,"path":304,"readingTime":305,"seo":306,"sitemap":307,"stem":308,"tags":309,"translation":311,"updated":301,"__hash__":312},"insightsEn\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.md","Fortinet hardening release: patching without an advisory","blacklens.io Team",{"type":8,"value":9,"toc":271},"minimark",[10,14,19,30,112,133,137,140,154,158,166,169,173,176,184,188,191,220,223,227,243,247,263],[11,12,13],"p",{},"Fortinet is shipping security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, a day after FortiMail and FortiAuthenticator. Rated critical and high severity — but with no CVE id, no CVSS score and no description of the attack. The advisories only follow on 10 November. Anyone patching this week is closing holes they cannot name.",[15,16,18],"h2",{"id":17},"what-fortinet-shipped-on-22-october","What Fortinet shipped on 22 October",[11,20,21,22,29],{},"The security hardening release is a bundled set of security updates for five product lines, announced on 21 October 2026 by Fortinet CISO Carl Windsor on ",[23,24,28],"a",{"href":25,"rel":26},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Ffortinet-releases-security-hardening-release-for-multiple-products",[27],"nofollow","Fortinet's CISO blog",". On the contents, one sentence: \"These releases include critical and high-severity fixes.\"",[31,32,33,49],"table",{},[34,35,36],"thead",{},[37,38,39,43,46],"tr",{},[40,41,42],"th",{},"Branch",[40,44,45],{},"FortiOS",[40,47,48],{},"FortiManager and FortiAnalyzer",[50,51,52,68,82,97],"tbody",{},[37,53,54,58,64],{},[55,56,57],"td",{},"8.0",[55,59,60],{},[61,62,63],"code",{},"8.0.2",[55,65,66],{},[61,67,63],{},[37,69,70,73,78],{},[55,71,72],{},"7.6",[55,74,75],{},[61,76,77],{},"7.6.8",[55,79,80],{},[61,81,77],{},[37,83,84,87,92],{},[55,85,86],{},"7.4",[55,88,89],{},[61,90,91],{},"7.4.13",[55,93,94],{},[61,95,96],{},"7.4.12",[37,98,99,102,107],{},[55,100,101],{},"7.2",[55,103,104],{},[61,105,106],{},"7.2.14",[55,108,109],{},[61,110,111],{},"7.2.13",[11,113,114,115,117,118,121,122,125,126,121,129,132],{},"Everything below each fixed version is affected. FortiMail is fixed in ",[61,116,63],{},", ",[61,119,120],{},"7.6.7"," and ",[61,123,124],{},"7.4.9",", FortiAuthenticator in ",[61,127,128],{},"8.0.4",[61,130,131],{},"6.6.11","; FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself, while FortiManager Cloud may need a manual step.",[15,134,136],{"id":135},"why-there-are-no-cve-ids","Why there are no CVE ids",[11,138,139],{},"The advisories only appear at the next Patch Tuesday, 10 November, on the advisory page of Fortinet's Product Security Incident Response Team — part of an \"ongoing commitment to responsible transparency while balancing customer security\".",[11,141,142,143,148,149,153],{},"The origin of the flaws explains the bundling: not outside researchers, but Fortinet's own AI-assisted testing programme, with thanks to Anthropic, OpenAI, Google and SpaceX for the collaboration. Windsor ",[23,144,147],{"href":145,"rel":146},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Fupdate-on-fortinet-use-of-frontier-ai",[27],"described the process in June 2026",": frontier models review the source code against a threat model of the firmware built beforehand; what survives is validated in penetration testing. Of the source-code findings from more than 100 tests across 30 product families, 40 per cent were true positives and 30 per cent false positives. What ",[23,150,152],{"href":151},"\u002Fen\u002Finsights\u002Fclaude-mythos-wenn-schwachstellen-schneller-kommen-als-patches","Claude Mythos"," sketched out in April now arrives as a firmware update.",[15,155,157],{"id":156},"a-patch-without-a-cve-id-is-invisible-to-scanners-and-policies","A patch without a CVE id is invisible to scanners and policies",[11,159,160,161,165],{},"Vulnerability scanners, patch policies and ticket systems all work from CVE ids. Without the id, everything attached to it is missing too: no NVD entry, no EPSS score, no entry in the ",[23,162,164],{"href":163},"\u002Fen\u002Fwissen\u002Fcisa-kev","CISA KEV catalogue",", no CVSS score for a patch policy to trigger on. A change request that normally draws its justification from a CVE id and a severity rating has nothing but the vendor announcement for 19 days.",[11,167,168],{},"The question shifts: no longer which CVE affects us, but which version runs on which reachable device, and whether it is older than the fixed one. The risk assessment loses its basis too: nothing can be said about attack prerequisites or exploitability before 10 November. What remains is reachability from outside: a FortiManager sitting on the internet is the problem, with or without a CVE id.",[15,170,172],{"id":171},"patch-diffing-the-clock-starts-at-release","Patch diffing: the clock starts at release",[11,174,175],{},"The head start withholding the advisories is meant to create applies only to readers, not to attackers who compare. Fortinet names the risk itself: once the update is public, the fix shows where the code changed. Per the June post, this is exactly what the models excel at — \"analyzing firmware, assessing changes between versions, and developing proof-of-concept exploits\". Fortinet expects exploits in hours or days rather than weeks; the FortiGuard 2026 report puts time to exploit for critical outbreaks at 24 to 48 hours, down from 4.76 days on average in 2024.",[11,177,178,179,183],{},"That Fortinet devices are a preferred target is on record: the CISA KEV catalogue held 32 entries for Fortinet products as of 21 October 2026, two of them added this month. ",[23,180,182],{"href":181},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","FortiBleed"," showed how methodically attackers work through exposed management interfaces. No exploitation is known for the flaws in this release; Fortinet calls the fixes pre-emptive.",[15,185,187],{"id":186},"what-to-do-now","What to do now",[11,189,190],{},"Fortinet recommends treating the release as a priority change rather than routine maintenance, and names four steps:",[192,193,194,202,208,214],"ul",{},[195,196,197,201],"li",{},[198,199,200],"strong",{},"Inventory:"," identify every FortiManager installation and FortiOS instance, internet-facing ones first.",[195,203,204,207],{},[198,205,206],{},"Maintenance windows:"," schedule 22 and 23 October for exposed systems.",[195,209,210,213],{},[198,211,212],{},"Back up configurations:"," before the upgrade, not after.",[195,215,216,219],{},[198,217,218],{},"Check logs:"," for unusual administrative access and unapproved configuration changes, before and after patching.",[11,221,222],{},"Where an immediate upgrade is not possible: restrict management access over HTTPS and SSH to trusted addresses, keep FortiManager off the internet entirely, and enforce MFA on every administrator account. Fortinet on that: \"These steps reduce risk but do not replace the need for a timely upgrade.\"",[15,224,226],{"id":225},"not-to-be-confused-php2shell-runs-in-parallel","Not to be confused: PHP2Shell runs in parallel",[11,228,229,230,233,234,237,238,242],{},"The two PHP flaws from 21 October are not part of this release. Fortinet tracks them separately in advisory ",[61,231,232],{},"FG-IR-26-186"," and rates ",[61,235,236],{},"CVE-2026-109618"," critical at CVSS 9.8 there. According to an overview by Help Net Security on 22 October, Fortinet lists twelve products as not affected, among them FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiWeb, and twelve more as under review. Palo Alto Networks reports PAN-OS and Panorama as affected in all versions, still without a fix. Mechanism and immediate measures are in our ",[23,239,241],{"href":240},"\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php","PHP2Shell post",". Fortinet operators are running two separate patch tracks.",[15,244,246],{"id":245},"what-helps-and-why-visibility-decides","What helps – and why visibility decides",[11,248,249,250,254,255,259,260,262],{},"As long as the CVE ids are missing, the version inventory is the only solid basis. Through ",[23,251,253],{"href":252},"\u002Fen\u002Fplatform\u002Fattack-surface-management","Attack Surface Management",", blacklens.io records from the outside which services are reachable and which technologies run on them in which version; the inventory filters by vendor and product, and the ",[23,256,258],{"href":257},"\u002Fen\u002Fplatform\u002Fsentry","Sentry Agent"," covers internal installations. That answers the question that matters this week: where is a version older than ",[61,261,77],{}," running, and is it reachable from the internet?",[11,264,265,266,270],{},"The ",[23,267,269],{"href":268},"\u002Fen\u002Fplatform\u002Femerging-threats","Threat Center"," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product — for this release that starts on 10 November, because before then there are no ids to match. This week the release is an inventory question. The vulnerability question arrives in November.",{"title":272,"searchDepth":273,"depth":273,"links":274},"",3,[275,277,278,279,280,281,282],{"id":17,"depth":276,"text":18},2,{"id":135,"depth":276,"text":136},{"id":156,"depth":276,"text":157},{"id":171,"depth":276,"text":172},{"id":186,"depth":276,"text":187},{"id":225,"depth":276,"text":226},{"id":245,"depth":276,"text":246},"threat","2026-10-22","Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.",false,"md",[289,292,295],{"q":290,"a":291},"What is Fortinet's October 2026 security hardening release?","The security hardening release is a bundled set of security updates that Fortinet shipped on 21 and 22 October 2026 for FortiMail, FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer. Fortinet rates the fixed flaws critical and high severity, but publishes no CVE ids, no CVSS scores and no attack prerequisites for now. The advisories are announced for 10 November 2026. The flaws came out of Fortinet's own AI-assisted testing programme.",{"q":293,"a":294},"Which Fortinet versions fix the vulnerabilities?","According to Fortinet's announcement the fixes ship in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and in FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. FortiMail is fixed in 8.0.2, 7.6.7 and 7.4.9, FortiAuthenticator in 8.0.4 and 6.6.11. FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself; FortiManager Cloud may need a manual step.",{"q":296,"a":297},"Why is a patch without a CVE id a problem for vulnerability scanners?","A patch without a CVE id stays invisible to everything that steers vulnerabilities by CVE id: vulnerability scanners, patch policies, ticket systems. Without the id there is no NVD entry, no EPSS score, no CISA KEV status and no CVSS score for a patch policy to trigger on. Until the advisories appear, only the version comparison is left: which Fortinet version runs on which reachable system? A continuously updated technology inventory answers that question.","\u002Fimages\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.webp","Tablet showing the Fortinet website in front of a blurred monitor displaying source code","en",null,{},true,"\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",5,{"title":5,"description":285},{"loc":304},"en\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",[310],"Threat landscape","fortinet-hardening-release-patchen-ohne-advisory","QyzVByPDaT-j8SlgBQrV6xv8fCW8Qn5_n4hTJ6WGhm8",[314,546,1128],{"id":315,"title":316,"author":6,"body":317,"category":283,"date":284,"description":525,"draft":286,"extension":287,"faq":526,"image":536,"imageAlt":537,"lang":300,"legacyUrl":301,"meta":538,"navigation":303,"path":539,"readingTime":305,"seo":540,"sitemap":541,"stem":542,"tags":543,"translation":544,"updated":301,"__hash__":545},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch.md","PHP2Shell: the attacks began four days before the patch",{"type":8,"value":318,"toc":518},[319,322,326,335,342,346,355,417,420,424,427,433,437,440,488,497,500,503,506],[11,320,321],{},"Four days before PHP disclosed the two flaws, the first exploitation attempt was running. Amazon Threat Intelligence found it in the telemetry of its MadPot honeypot network, dated 17 October 2026. Close PHP2Shell the moment the version number is right and you have checked four days too few.",[15,323,325],{"id":324},"what-amazon-saw-before-disclosure","What Amazon saw before disclosure",[11,327,328,329,334],{},"Amazon Threat Intelligence published on 21 October that the earliest PHP2Shell exploitation attempt in its ",[23,330,333],{"href":331,"rel":332},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Famazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\u002F",[27],"MadPot telemetry"," dates to 17 October 2026 — four days before disclosure, three days before the leak. The request came from a commercial anonymisation network and hit a honeypot, which Amazon reads as a sign of a threat actor rather than research. How the actor obtained exploit information beforehand is unclear.",[11,336,337,338,341],{},"From 02:00 UTC on 21 October, twelve hours before the 14:00 UTC release, MadPot saw several proof-of-concept exploits from further anonymised infrastructure. Payloads and origins differed, which points to several independent actors; whether any would have worked against real systems is left open. CJ Moses, CISO of Amazon Integrated Security, sums up the state after the release: \"PHP2Shell is now being broadly exploited in the wild.\" Mechanism, fixed versions and interim measures are in ",[23,339,340],{"href":240},"yesterday's post",".",[15,343,345],{"id":344},"how-exploits-arrived-before-the-patch","How exploits arrived before the patch",[11,347,348,349,354],{},"17 October remains unexplained. The twelve hours before the release do not. The PHP Foundation laid out that chain in its ",[23,350,353],{"href":351,"rel":352},"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F",[27],"postmortem of 21 October",":",[31,356,357,367],{},[34,358,359],{},[37,360,361,364],{},[40,362,363],{},"Time (UTC)",[40,365,366],{},"Event",[50,368,369,377,385,393,401,409],{},[37,370,371,374],{},[55,372,373],{},"17 Oct",[55,375,376],{},"First exploitation attempt in Amazon's honeypot telemetry, source unknown",[37,378,379,382],{},[55,380,381],{},"20 Oct, 15:00",[55,383,384],{},"CVE numbers circulate in forums, with the wrong release time and a wrong CVSS of 10.0",[37,386,387,390],{},[55,388,389],{},"20 Oct, 20:00",[55,391,392],{},"Calif accidentally publishes a video of its own exploit",[37,394,395,398],{},[55,396,397],{},"20 Oct, 23:00",[55,399,400],{},"Mitigation guidance to critical infrastructure operators may have leaked as well",[37,402,403,406],{},[55,404,405],{},"21 Oct, 07:41",[55,407,408],{},"Chainguard publishes container images carrying the fix, six hours early",[37,410,411,414],{},[55,412,413],{},"21 Oct, 14:00",[55,415,416],{},"Coordinated release of advisories and fixed versions",[11,418,419],{},"The Foundation objects not to the early fix but to its comparability: \"Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.\" Chainguard CEO Dan Lorenc does not dispute the timing, but he does dispute the reading: \"I made the call to get these out early when exploits hit in the wild.\" The Foundation's own security team had identified no functional public exploit by release time, and calls the delay since the first signs in 2024 \"a structural failure\".",[15,421,423],{"id":422},"status-on-22-october-millions-of-attempts-no-confirmed-breach","Status on 22 October: millions of attempts, no confirmed breach",[11,425,426],{},"No successful break-in through PHP2Shell has been confirmed. The number of attempts has. Cloudflare CEO Matthew Prince reports thousands across his network in the ten hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions by now. Cloudflare also sees attackers varying payloads and reading which requests the web application firewall blocks.",[11,428,429,430,432],{},"Volume is not success. Jake Knott of watchTowr says none of the circulating proof-of-concepts achieves code execution: they fail, measure timing differences, or crash the target process. VulnCheck saw at least one address trying, unsuccessfully, to drop a web shell. Germany's BSI states in version 1.1 of its 21 October warning that no confirmed exploitation is known so far. Neither number appears in the ",[23,431,164],{"href":163}," as of 22 October. JFrog also found fake exploits and prank malware in public repositories — test that code against your own systems and you may be testing something other than the flaw.",[15,434,436],{"id":435},"what-this-means-for-your-investigation","What this means for your investigation",[11,438,439],{},"Amazon recommends starting the investigation window on 17 October, not on patch day. In practice the first step is preserving evidence before rotation deletes it: web server logs and the process and file state of every reachable PHP system from 16 October.",[192,441,442,456,476,482],{},[195,443,444,447,448,451,452,455],{},[198,445,446],{},"Requests:"," POST requests carrying the string ",[61,449,450],{},"PHP_SESSION_UPLOAD_PROGRESS"," in ",[61,453,454],{},"multipart\u002Fform-data"," bodies, plus clusters of HTTP 500 responses and crashed PHP workers.",[195,457,458,461,462,117,465,117,468,471,472,475],{},[198,459,460],{},"Processes:"," any shell, interpreter or download tool started by ",[61,463,464],{},"php-fpm",[61,466,467],{},"php-cgi",[61,469,470],{},"httpd"," or ",[61,473,474],{},"apache2",", plus new files in the web root.",[195,477,478,481],{},[198,479,480],{},"Detection without signatures:"," Amazon recommends detections that do not depend on CVE-specific signatures — first exploitation regularly precedes the first signature.",[195,483,484,487],{},[198,485,486],{},"Indicators:"," Amazon publishes six addresses from its telemetry. They belong to shared anonymisation infrastructure and are not exclusive to this activity: a reason to investigate, not a block list.",[489,490,495],"pre",{"className":491,"code":493,"language":494},[492],"language-text","103.216.220.92     17.10.2026\n31.223.184.166     21.10.2026\n37.19.200.5        21.10.2026\n134.209.159.64     21.10.2026\n103.114.163.188    21.10.2026\n95.217.98.37       21.10.2026\n","text",[61,496,493],{"__ignoreMap":272},[11,498,499],{},"On the deadline such cases set, Amazon's driest sentence matters most: \"A 7-day or 30-day SLA assumes a delay that no longer exists.\" The reason is structural and not limited to PHP: AI-assisted analysis makes it cheaper to turn a patch diff or an advisory into a working exploit.",[15,501,502],{"id":245},"What helps — and why visibility decides",[11,504,505],{},"A deadline measured in hours assumes the inventory exists when the advisory lands. Between 17 and 21 October it was the only usable information there was.",[11,507,508,509,511,512,514,515,517],{},"blacklens.io uses ",[23,510,253],{"href":252}," to track which services and web applications are reachable from outside and which technologies run on them; internal systems are covered by the ",[23,513,258],{"href":257},". The ",[23,516,269],{"href":268}," matches new CVEs against that inventory and shows, per hit, the EPSS score, KEV membership, available exploits and whether the match rests on the exact version or only on the product. Hunting on the host itself is not part of that; logs and monitoring on the system cover it.",{"title":272,"searchDepth":273,"depth":273,"links":519},[520,521,522,523,524],{"id":324,"depth":276,"text":325},{"id":344,"depth":276,"text":345},{"id":422,"depth":276,"text":423},{"id":435,"depth":276,"text":436},{"id":245,"depth":276,"text":502},"Amazon found the first PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure. That changes the window your investigation must cover.",[527,530,533],{"q":528,"a":529},"Was PHP2Shell exploited before public disclosure?","Yes, according to Amazon Threat Intelligence. The earliest exploitation attempt in the telemetry of its MadPot honeypot network dates to 17 October 2026, four days before PHP's advisory, and came from a commercial anonymisation network. How the actor obtained exploit information beforehand is unclear. Further proof-of-concept attempts followed from 02:00 UTC on 21 October, twelve hours before the release.",{"q":531,"a":532},"How far back should I hunt for compromise?","Amazon recommends taking PHP2Shell investigations back to at least 17 October 2026 rather than only to patch day. In practice that means preserving web server logs and the process and file state of every reachable PHP system from 16 October onwards, before log rotation deletes them. Look for POST requests carrying the string PHP_SESSION_UPLOAD_PROGRESS, for processes started by a PHP worker, and for new files in the web root.",{"q":534,"a":535},"How fast does a critical update have to be installed?","Amazon recommends measuring patch and mitigation timelines in hours for critical vulnerabilities on internet-facing systems: a 7-day or 30-day SLA assumes a delay that no longer exists. That assumes the inventory already exists on advisory day. blacklens.io matches new CVEs in the Threat Center against the technologies it has recorded and shows CVSS, EPSS, KEV membership and whether an exploit is public for each hit.","\u002Fimages\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch-en.webp","Timeline showing the first exploitation attempt on 17 October and the PHP patch on 21 October 2026",{},"\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",{"title":316,"description":525},{"loc":539},"en\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",[310],"php2shell-angriffe-vor-dem-patch","CmoIJqrLGf2ifl1_EZ7uomptiOZ8ogKLBf8XMEszWeY",{"id":547,"title":548,"author":6,"body":549,"category":283,"date":1105,"description":1106,"draft":286,"extension":287,"faq":1107,"image":1119,"imageAlt":1120,"lang":300,"legacyUrl":301,"meta":1121,"navigation":303,"path":240,"readingTime":965,"seo":1122,"sitemap":1123,"stem":1124,"tags":1125,"translation":1126,"updated":284,"__hash__":1127},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.md","PHP2Shell: the patches are out, the cause was something else",{"type":8,"value":550,"toc":1095},[551,554,560,564,593,596,600,609,615,619,628,631,686,700,704,707,768,771,775,784,873,888,891,895,909,980,983,1013,1016,1020,1026,1039,1048,1070,1072,1075,1091],[11,552,553],{},"PHP published out-of-band security releases on 21 October 2026 for two critical flaws circulating under the name PHP2Shell: versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both allow remote code execution without authentication, both sit in the PHP core rather than in an application. And both have a different cause from the one that travelled through forums and newsletters after the leak of 20 October.",[11,555,556],{},[557,558,559],"em",{},"Updated on 21 October 2026, after the release: this post previously described an unreleased patch and followed the reading of the time, that session upload progress was the cause. PHP's advisory disproves that. The mechanism, the interim measures and the version details now follow the official advisories.",[15,561,563],{"id":562},"what-is-php2shell","What is PHP2Shell?",[11,565,566,567,121,573,580,581,585,586,121,589,592],{},"PHP2Shell is the unofficial name for two critical vulnerabilities in the PHP core, tracked as ",[23,568,571],{"href":569,"rel":570},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w",[27],[61,572,236],{},[23,574,577],{"href":575,"rel":576},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp",[27],[61,578,579],{},"CVE-2026-109619",". Both allow unauthenticated remote code execution, meaning an attacker runs their own commands on the server with the privileges of the web server process. PHP rates both ",[23,582,584],{"href":583},"\u002Fen\u002Fwissen\u002Fcvss","CVSS"," 9.2 under version 4.0. The vector explains why it is not 10.0: ",[61,587,588],{},"AC:H",[61,590,591],{},"AT:P"," record high attack complexity and additional requirements. The exploit does not succeed on every attempt — but attackers may try as often as they like.",[11,594,595],{},"According to the advisories, every installation that serves web requests is affected, regardless of the application on top: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. The highest risk sits with mod_php. W3Techs reports that 69 per cent of all websites with a known server-side language run PHP, for example under WordPress, TYPO3, Magento or Shopware. The acknowledgements in the advisories credit the researcher lcfr-hax along with researchers at Wiz, Areion and OpenAI; four members of the PHP team developed the fix.",[15,597,599],{"id":598},"flaw-1-when-php-runs-out-of-memory","Flaw 1: when PHP runs out of memory",[11,601,602,604,605,608],{},[61,603,236],{}," abuses the way PHP leaves a request when memory runs out. It jumps out via ",[61,606,607],{},"longjmp()",". At certain moments a request's memory is already reachable but not yet fully initialised. If an allocation fails at exactly that point, PHP does not account for the early exit, and the memory is left in an invalid state. Request shutdown then reads that state and branches on it.",[11,610,611,612,341],{},"The attacker triggers the memory exhaustion themselves, during multipart form parsing: through unbounded headers, empty file controls or nested field names. No form in the application is required, and no login. The patch replaces the hard jump: on memory exhaustion PHP now ends the request at the next safe point in the virtual machine, and only above a higher threshold does it abort via ",[61,613,614],{},"_exit()",[15,616,618],{"id":617},"flaw-2-when-remnants-of-the-previous-request-stay-behind","Flaw 2: when remnants of the previous request stay behind",[11,620,621,623,624,627],{},[61,622,579],{}," concerns state that outlives the request it belongs to. A PHP worker handles many requests in sequence and holds global state for error handling, sessions, objects and extensions. Some of that state points to memory owned by the request and must be reset before the request frees it. Some operations, however, run ",[557,625,626],{},"before"," the next request is properly initialised and read the old references — a use-after-free.",[11,629,630],{},"The advisory separates producers from consumers, and that separation is why a single setting is not enough:",[192,632,633,643,649,659],{},[195,634,635,638,639,642],{},[198,636,637],{},"Producers:"," fatal errors such as parse and compile failures, uncaught errors, a failed ",[61,640,641],{},"require"," or exceeding the maximum execution time; also memory exhaustion and diagnostics emitted during shutdown or extension cleanup.",[195,644,645,648],{},[198,646,647],{},"Consumers:"," INI diagnostics raised before request initialisation, and session upload progress handling, which is enabled by default.",[195,650,651,654,655,658],{},[198,652,653],{},"Confirmed as RCE:"," the route via ",[61,656,657],{},"fatal_error_backtraces"," on PHP 8.5, and the session upload progress path, triggered there through memory exhaustion.",[195,660,661,664,665,121,668,671,672,671,675,678,679,121,682,685],{},[198,662,663],{},"Reachable through:"," ",[61,666,667],{},".htaccess",[61,669,670],{},"php_value","\u002F",[61,673,674],{},"php_flag",[61,676,677],{},"php_admin_*"," under Apache mod_php; conditionally under PHP-FPM via ",[61,680,681],{},"PHP_VALUE",[61,683,684],{},"PHP_ADMIN_VALUE"," from a frontend; LSAPI is considered a candidate. For FrankenPHP, PHP found no early consumer in the default configuration.",[11,687,688,689,117,692,695,696,699],{},"What does not help: hiding error messages. ",[61,690,691],{},"error_reporting",[61,693,694],{},"display_errors"," and the ",[61,697,698],{},"@"," prefix suppress the output, not the error — the producer remains.",[15,701,703],{"id":702},"what-the-leak-got-wrong","What the leak got wrong",[11,705,706],{},"On 20 October an anonymous post on the Hacker News forum announced two PHP flaws, with no evidence beyond the author's trust in their source. watchTowr confirmed the same day that the flaws were real, and PHP moved the release planned for 22 October forward by a day. Anyone working from Monday's screenshots is working from several wrong figures:",[31,708,709,722],{},[34,710,711],{},[37,712,713,716,719],{},[40,714,715],{},"Topic",[40,717,718],{},"Leak of 20 October",[40,720,721],{},"PHP advisory of 21 October",[50,723,724,735,746,757],{},[37,725,726,729,732],{},[55,727,728],{},"Severity",[55,730,731],{},"CVSS 10.0",[55,733,734],{},"CVSS 9.2 under v4.0",[37,736,737,740,743],{},[55,738,739],{},"Cause",[55,741,742],{},"session upload progress",[55,744,745],{},"two core flaws; upload progress is one consumer of several",[37,747,748,751,754],{},[55,749,750],{},"Mitigation",[55,752,753],{},"turning off upload progress is enough",[55,755,756],{},"only the update closes both flaws",[37,758,759,762,765],{},[55,760,761],{},"Affected",[55,763,764],{},"all versions from PHP 5",[55,766,767],{},"everything before 8.2.35, 8.3.36, 8.4.27 and 8.5.12",[11,769,770],{},"For internal communication, use the advisories, not Monday's screenshots.",[15,772,774],{"id":773},"which-versions-get-a-patch","Which versions get a patch",[11,776,777,778,783],{},"According to ",[23,779,782],{"href":780,"rel":781},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php",[27],"PHP's release announcement",", PHP ships security updates for its four supported branches. For the end-of-life branches 7.4, 8.0 and 8.1 the security team additionally provided minimal source backports, intended for self-built installations and for operators without an LTS vendor.",[31,785,786,798],{},[34,787,788],{},[37,789,790,792,795],{},[40,791,42],{},[40,793,794],{},"Fixed release",[40,796,797],{},"Updates until",[50,799,800,813,826,839,852,863],{},[37,801,802,805,810],{},[55,803,804],{},"8.5",[55,806,807],{},[61,808,809],{},"8.5.12",[55,811,812],{},"end of 2029",[37,814,815,818,823],{},[55,816,817],{},"8.4",[55,819,820],{},[61,821,822],{},"8.4.27",[55,824,825],{},"end of 2028",[37,827,828,831,836],{},[55,829,830],{},"8.3",[55,832,833],{},[61,834,835],{},"8.3.36",[55,837,838],{},"end of 2027",[37,840,841,844,849],{},[55,842,843],{},"8.2",[55,845,846],{},[61,847,848],{},"8.2.35",[55,850,851],{},"31 December 2026",[37,853,854,857,860],{},[55,855,856],{},"8.1, 8.0, 7.4",[55,858,859],{},"source backport or distro package",[55,861,862],{},"end of life",[37,864,865,868,871],{},[55,866,867],{},"7.3 and older",[55,869,870],{},"no patch",[55,872,862],{},[11,874,875,876,879,880,883,884,887],{},"Three points on this cost real time in practice. First, Debian, Ubuntu and Red Hat backport the fix into their packages without raising the version number: ",[61,877,878],{},"php -v"," still shows the old number, and the package changelog is what counts. Second, PHP explicitly notes that the volunteer-maintained ",[61,881,882],{},"rpms.remirepo.net"," repository had no update on release day, and advises moving to distribution packages; AlmaLinux initially published its packages in ",[61,885,886],{},"testing",". Third, 8.2 is only covered for a limited time — patch an 8.2 server today and plan the upgrade in the same breath.",[11,889,890],{},"How many systems run without a vendor fix was counted by the security firm Mallory on 20 October, using publicly visible HTTP banners: more than 880,000 internet-facing hosts reported PHP 8.1 or older, 59 per cent of the roughly 1.5 million hosts that state a version. Around 740,000 more showed PHP without a version. In German-speaking Europe the share without an official patch is 41 per cent in Germany, 53 per cent in Austria and 64 per cent in Switzerland, according to Mallory. The figures describe banners, not confirmed vulnerable systems.",[15,892,894],{"id":893},"interim-measures-when-the-update-has-to-wait","Interim measures when the update has to wait",[11,896,897,898,901,902,121,905,908],{},"PHP is unambiguous on this point: only the update is a complete mitigation. The settings below, taken from the advisories, reduce exposure but do not make an installation safe. They belong in ",[61,899,900],{},"php.ini",", the FPM pool or the server configuration — somewhere the application cannot override them. ",[61,903,904],{},"ini_set()",[61,906,907],{},".user.ini"," apply too late. Restart every worker afterwards, and rebuild containers.",[489,910,914],{"className":911,"code":912,"language":913,"meta":272,"style":272},"language-ini shiki shiki-themes material-theme-lighter github-light github-dark","; against CVE-2026-109618 (memory exhaustion)\nmemory_limit = -1          ; as php_admin_value, not overridable\npost_max_size = 8M         ; 32M if uploads are required\nupload_max_filesize = 8M   ; must stay below post_max_size\n\n; against CVE-2026-109619 (stale state)\nsession.upload_progress.enabled = 0\nfatal_error_backtraces = 0 ; PHP 8.5 only\n\n; optional, costs performance\npm.max_requests = 1        ; FPM: one request per worker\n","ini",[61,915,916,924,929,934,940,945,951,957,963,968,974],{"__ignoreMap":272},[917,918,921],"span",{"class":919,"line":920},"line",1,[917,922,923],{},"; against CVE-2026-109618 (memory exhaustion)\n",[917,925,926],{"class":919,"line":276},[917,927,928],{},"memory_limit = -1          ; as php_admin_value, not overridable\n",[917,930,931],{"class":919,"line":273},[917,932,933],{},"post_max_size = 8M         ; 32M if uploads are required\n",[917,935,937],{"class":919,"line":936},4,[917,938,939],{},"upload_max_filesize = 8M   ; must stay below post_max_size\n",[917,941,942],{"class":919,"line":305},[917,943,944],{"emptyLinePlaceholder":303},"\n",[917,946,948],{"class":919,"line":947},6,[917,949,950],{},"; against CVE-2026-109619 (stale state)\n",[917,952,954],{"class":919,"line":953},7,[917,955,956],{},"session.upload_progress.enabled = 0\n",[917,958,960],{"class":919,"line":959},8,[917,961,962],{},"fatal_error_backtraces = 0 ; PHP 8.5 only\n",[917,964,966],{"class":919,"line":965},9,[917,967,944],{"emptyLinePlaceholder":303},[917,969,971],{"class":919,"line":970},10,[917,972,973],{},"; optional, costs performance\n",[917,975,977],{"class":919,"line":976},11,[917,978,979],{},"pm.max_requests = 1        ; FPM: one request per worker\n",[11,981,982],{},"Three things are easy to get wrong here:",[192,984,985,994,1007],{},[195,986,987,993],{},[198,988,989,992],{},[61,990,991],{},"memory_limit = -1"," is not a typo."," The memory limit is the trigger the attacker wants to reach. Cap memory through containers or cgroups instead, and check that no pool, directory or application sets a finite limit.",[195,995,996,1006],{},[198,997,998,999,1002,1003,341],{},"No ",[61,1000,1001],{},"RLIMIT_AS"," and no ",[61,1004,1005],{},"RLIMIT_DATA"," PHP advises against them explicitly: such limits make the attack easier, not harder.",[195,1008,1009,1012],{},[198,1010,1011],{},"Remove errors from reachable paths."," That includes execution timeouts an attacker can trigger predictably, and warnings from obsolete INI directives raised before request initialisation. Large multipart requests can additionally be capped at the web server or in the web application firewall.",[11,1014,1015],{},"End-of-life systems that cannot be updated immediately belong behind a VPN or off the public network — as CERT-EU recommended before the release.",[15,1017,1019],{"id":1018},"exploitation-what-had-been-seen-by-21-october","Exploitation: what had been seen by 21 October",[11,1021,1022,1023,1025],{},"Several vendors report exploitation attempts; confirmed compromises, so far, none. watchTowr saw the first attempts on its sensors at roughly the time of the release, and Jake Knott, who leads threat intelligence there, told SecurityWeek: \"Whilst nobody has been successful to date, we don't expect that will last long.\" Hadrian reported exploitation \"at scale\" a few hours before the release and names the session upload progress path as the one most used. Patchstack, Cloudflare and Vega also observed attempts, Vega with publicly available proof-of-concept code. Neither flaw appears in the ",[23,1024,164],{"href":163}," as of 21 October.",[11,1027,1028,1029,1032,1033,1038],{},"That it moved quickly was to be expected. The update makes the corrected source public, and a comparison with the previous version shows where the flaw sat. When ",[61,1030,1031],{},"CVE-2024-4577",", a PHP flaw in CGI mode on Windows, became public in June 2024, ",[23,1034,1037],{"href":1035,"rel":1036},"https:\u002F\u002Fwww.akamai.com\u002Fblog\u002Fsecurity-research\u002F2024-php-exploit-cve-one-day-after-disclosure",[27],"Akamai"," saw exploitation attempts on its honeypots within 24 hours. Here the leak came before the patch.",[11,1040,1041,1044,1045,341],{},[198,1042,1043],{},"Update, 22 October:"," Amazon Threat Intelligence has since reported an exploitation attempt from 17 October, four days before disclosure. What that means for logs, hunting and patch deadlines is in the ",[23,1046,1047],{"href":539},"follow-up post",[11,1049,1050,1051,117,1053,117,1055,471,1057,1059,1060,117,1063,471,1066,1069],{},"A successful attack is ultimately detectable because a process starts: alert when ",[61,1052,464],{},[61,1054,467],{},[61,1056,470],{},[61,1058,474],{}," invokes a shell, an interpreter or tools such as ",[61,1061,1062],{},"curl",[61,1064,1065],{},"wget",[61,1067,1068],{},"certutil.exe",". Unusually frequent HTTP 500 responses and crashed PHP workers are a second signal — the exploits do not always succeed, and many crashes mean many attempts. Once a web server has started a shell, treat the system as compromised: disconnect it first, do not power it off, then preserve logs, the process list and connections, search for web shells, new files in the web root, cron jobs and accounts, rebuild, and rotate every credential held in configuration files. Assume they are known.",[15,1071,502],{"id":245},[11,1073,1074],{},"On patch day the problem is rarely the updating. It is the question of where PHP runs. Beyond the obvious web servers, that means hosting panels such as Plesk and cPanel, which bring several parallel PHP versions with them, Docker images, appliances with a web interface from the phone system to time tracking, Windows software with PHP built in, and intranet tools nobody has touched in years. If you do not run the web server yourself, ask your host for its patch date.",[11,1076,508,1077,1079,1080,1082,1083,1085,1086,121,1088,1090],{},[23,1078,253],{"href":252}," to track continuously, from the outside, which domains, services and web applications are reachable and which technologies run on them; the ",[23,1081,258],{"href":257}," covers internal systems. The ",[23,1084,269],{"href":268}," matches new CVEs such as ",[61,1087,236],{},[61,1089,579],{}," against that inventory in real time and shows whether a match rests on the exact version or only on the product, for example because a server hides its version. Without a check template for a verification scan, it flags the match for manual review. What a PHP process starts on the server is not something blacklens.io sees; that remains the job of monitoring on the host.",[1092,1093,1094],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":272,"searchDepth":273,"depth":273,"links":1096},[1097,1098,1099,1100,1101,1102,1103,1104],{"id":562,"depth":276,"text":563},{"id":598,"depth":276,"text":599},{"id":617,"depth":276,"text":618},{"id":702,"depth":276,"text":703},{"id":773,"depth":276,"text":774},{"id":893,"depth":276,"text":894},{"id":1018,"depth":276,"text":1019},{"id":245,"depth":276,"text":502},"2026-10-21","PHP released patches for two critical RCE flaws on 21 October 2026. The cause sits in the PHP core, not in session upload progress.",[1108,1110,1113,1116],{"q":563,"a":1109},"PHP2Shell is the unofficial name for two critical vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619, both of which allow unauthenticated remote code execution. PHP rates them CVSS 9.2 under version 4.0 and published patches on 21 October 2026. One flaw occurs when PHP runs out of memory; the other when state from one request survives in the worker and a later request reuses it.",{"q":1111,"a":1112},"Which PHP versions get a patch for PHP2Shell?","The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the GitHub advisories list every earlier release as affected. For the end-of-life branches 7.4, 8.0 and 8.1 the PHP security team published minimal source backports, and PHP 7.3 and older get no fix. Debian, Ubuntu and Red Hat ship the patch without raising the version number, so the package changelog counts, not the output of php -v.",{"q":1114,"a":1115},"Is turning off session upload progress enough?","No. That setting circulated as the fix after the leak, but PHP's advisory disagrees: session upload progress is only one of several routes into CVE-2026-109619, and it plays no part in CVE-2026-109618. PHP names the update as the only complete mitigation. The recommended settings reduce exposure, but they do not make an installation safe.",{"q":1117,"a":1118},"How do I find every PHP system in my organisation?","On patch day the problem is rarely the patching. It is knowing where PHP runs, often unnoticed in appliances, hosting panels and old intranet tools. blacklens.io uses Attack Surface Management to track continuously which domains, services and web applications are reachable from outside and which technologies run on them; the Sentry Agent covers internal systems. The Threat Center matches new CVEs against that inventory.","\u002Fimages\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.webp","Abstract illustration of overlapping lines of source code in blue and red on a dark background",{},{"title":548,"description":1106},{"loc":240},"en\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php",[310],"php2shell-kritische-rce-lucken-in-php","UmqdoDcNTRg2Lt5hvczHcBVqeEXNJZpXxYiHw5AsdiU",{"id":1129,"title":1130,"author":6,"body":1131,"category":1307,"date":1308,"description":1309,"draft":286,"extension":287,"faq":1310,"image":1320,"imageAlt":1321,"lang":300,"legacyUrl":301,"meta":1322,"navigation":303,"path":1323,"readingTime":936,"seo":1324,"sitemap":1325,"stem":1326,"tags":1327,"translation":1329,"updated":301,"__hash__":1330},"insightsEn\u002Fen\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten.md","REA: What AI reverse engineering finds in your applications",{"type":8,"value":1132,"toc":1301},[1133,1136,1140,1149,1162,1166,1169,1184,1187,1218,1222,1235,1238,1241,1245,1248,1280,1283,1298],[11,1134,1135],{},"Reverse engineering used to be specialist work: driving a disassembler, reading pseudocode, testing hypotheses, often for days. The open-source project REA (Reverse Engineer Anything) hands that work to AI agents, and in October 2026 it became one of the fastest-growing repositories on GitHub. Whatever ships inside an app, a desktop client or a firmware image was never secret, only expensive to read. That barrier is now falling.",[15,1137,1139],{"id":1138},"what-is-rea","What is REA?",[11,1141,1142,1143,1148],{},"REA (Reverse Engineer Anything) is an open-source MCP server that lets AI coding agents such as Claude Code, Codex, Cursor or Gemini CLI analyse software without access to its source code. The Model Context Protocol (MCP) is the interface an agent uses to call external tools. Through it, REA drives established tools such as Ghidra or IDA as well as its own parsers. According to the ",[23,1144,1147],{"href":1145,"rel":1146},"https:\u002F\u002Fgithub.com\u002Fmorluto\u002Frea",[27],"project documentation",", it covers native binaries, JavaScript and Electron apps, .NET assemblies, Android apps, firmware images, websites and network captures. The agent decides what to examine; REA runs the tools and returns the evidence.",[11,1150,1151,1152,1155,1156,1161],{},"The project is MIT-licensed and distributed as the npm package ",[61,1153,1154],{},"rea-agents",". According to the tracking service OSSInsight, as cited by Startup Fortune, its GitHub stars rose from under 10,000 to around 234,000 between 6 and 14 October 2026. The ",[23,1157,1160],{"href":1158,"rel":1159},"https:\u002F\u002Fgithub.com\u002Fmorluto\u002Frea\u002Fblob\u002Fmain\u002FDISCLAIMER.md",[27],"usage policy"," names security research, malware analysis and interoperability as its purpose and explicitly rules out unauthorised access. The tool itself is freely available, to defenders and attackers alike.",[15,1163,1165],{"id":1164},"what-attackers-can-read-from-your-applications","What attackers can read from your applications",[11,1167,1168],{},"Reverse engineering exposes what a vendor considers hidden in shipped code. For Electron and JavaScript apps REA lists modules, routes and source maps; for Android apps, the manifest and decompiled methods; for websites and network captures, the data in transit.",[11,1170,1171,1172,1177,1178,1183],{},"Embedded secrets have the most serious consequences. In 2022 ",[23,1173,1176],{"href":1174,"rel":1175},"https:\u002F\u002Fwww.security.com\u002Fthreat-intelligence\u002Fmobile-supply-chain-aws",[27],"Symantec"," found hard-coded AWS credentials in 1,859 Android and iOS apps. More than three-quarters of those apps contained valid tokens for private cloud services. Often the tokens came from shared libraries and SDKs rather than the vendors' own code. A ",[23,1179,1182],{"href":1180,"rel":1181},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2606.12212",[27],"study from June 2026"," found exploitable credentials for AI services in the network traffic of 282 of 444 iOS apps examined. Three months after disclosure, 72% of them were still exploitable.",[11,1185,1186],{},"Four more findings come within reach of people without specialist skills once AI does the analysis:",[192,1188,1189,1200,1206,1212],{},[195,1190,1191,1194,1195,1199],{},[198,1192,1193],{},"Hidden interfaces and hosts:"," every API endpoint an app calls is public, documented or not. Code often also points to test, staging or admin systems, extending the ",[23,1196,1198],{"href":1197},"\u002Fen\u002Fwissen\u002Fexternal-attack-surface-management","external attack surface"," with systems never meant for the public.",[195,1201,1202,1205],{},[198,1203,1204],{},"Security logic in the client:"," role checks, feature flags and input validation that only run in the app can be read and bypassed. The attacker talks to the back end directly.",[195,1207,1208,1211],{},[198,1209,1210],{},"Outdated components:"," binaries reveal embedded libraries and their versions; REA, for example, reads module versions from Go programs. Matching them against known CVEs is then routine.",[195,1213,1214,1217],{},[198,1215,1216],{},"Intellectual property:"," REA itself advertises that you can have a feature from someone else's app investigated and rebuilt for your own project. Whatever edge sits in your code can now be copied faster.",[15,1219,1221],{"id":1220},"software-you-only-operate-becomes-readable-too","Software you only operate becomes readable too",[11,1223,1224,1225,1230,1231,1234],{},"The same analysis applies to products you buy and run at the perimeter. Anyone who wants to exploit a fixed vulnerability has to understand what the update changed, and that analysis is reverse engineering. ",[23,1226,1229],{"href":1227,"rel":1228},"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ftime-to-exploit-trends-2023",[27],"Mandiant"," measured an average of just five days between disclosure and first observed exploitation for 2023 (excluding outliers; 2018–19: 63 days). Every tool that makes the analysis cheaper squeezes that window further, much as ",[23,1232,1233],{"href":151},"AI-driven vulnerability discovery"," does on the zero-day side.",[11,1236,1237],{},"VPN gateways, firewalls and IoT devices are particularly exposed. They run closed firmware, and REA takes apart firmware images and native binaries. A hard-coded password or an outdated component in the firmware affects every device in that series that is reachable from the internet.",[11,1239,1240],{},"The project documentation itself states that decompilation and AI-assisted analysis may be incomplete or incorrect. For attackers that is a small price: one hit is enough.",[15,1242,1244],{"id":1243},"what-helps-and-where-blacklensio-comes-in","What helps – and where blacklens.io comes in",[11,1246,1247],{},"Five measures work regardless of any product:",[192,1249,1250,1256,1262,1268,1274],{},[195,1251,1252,1255],{},[198,1253,1254],{},"No secrets in the client:"," keys belong on the server. Where the app needs access, use short-lived tokens with minimal rights, and rotate any key that has ever shipped.",[195,1257,1258,1261],{},[198,1259,1260],{},"Trust nothing from the client:"," authorisation and validation always run on the server.",[195,1263,1264,1267],{},[198,1265,1266],{},"Inventory your interfaces:"," treat every endpoint an app calls as public. Debug and staging systems are not reachable from the internet.",[195,1269,1270,1273],{},[198,1271,1272],{},"Know your dependencies:"," keep a bill of materials (SBOM) for every library you ship, including third-party SDKs, and update promptly.",[195,1275,1276,1279],{},[198,1277,1278],{},"Patch exposed systems faster:"," the window between update and exploit keeps shrinking.",[11,1281,1282],{},"Obfuscating the code raises the effort but replaces none of these measures.",[11,1284,1285,1286,1288,1289,1292,1293,1297],{},"blacklens.io shows which findings of such an analysis can actually be attacked from outside. ",[23,1287,253],{"href":252}," continuously discovers domains, subdomains, IP addresses, services and web applications reachable from the internet. A staging host referenced in your app's code appears there as an asset as soon as it is reachable under your domains, not only once an attacker finds it. The ",[23,1290,1291],{"href":268},"early warning system"," in the Threat Center matches new CVEs in real time against the technologies and versions detected by fingerprinting, and checks matches with a verification scan where a verification template exists. With ",[23,1294,1296],{"href":1295},"\u002Fen\u002Fplatform\u002Fpenetration-testing","Penetration Testing as a Service",", OSCP-certified pentesters test your web applications, APIs and infrastructure; findings appear as verified in the same platform, and retests are included in the pentest licence price.",[11,1299,1300],{},"Reverse engineering is becoming a standard capability. Plan as if your software were readable, because for far more people it now is.",{"title":272,"searchDepth":273,"depth":273,"links":1302},[1303,1304,1305,1306],{"id":1138,"depth":276,"text":1139},{"id":1164,"depth":276,"text":1165},{"id":1220,"depth":276,"text":1221},{"id":1243,"depth":276,"text":1244},"analysis","2026-10-20","With REA, AI agents take apart apps, binaries and firmware without source code. Which keys, interfaces and flaws that exposes, and what helps.",[1311,1314,1317],{"q":1312,"a":1313},"What is REA (Reverse Engineer Anything)?","REA (Reverse Engineer Anything) is an open-source MCP server under the MIT licence that lets AI coding agents such as Claude Code, Codex or Cursor analyse software without access to its source code. REA drives tools such as Ghidra or IDA alongside its own parsers and covers native binaries, Electron and JavaScript apps, .NET assemblies, Android apps, firmware and websites. It is distributed as the npm package rea-agents and was one of the fastest-growing repositories on GitHub in October 2026.",{"q":1315,"a":1316},"What are the risks of reverse engineering applications?","Reverse engineering makes whatever ships inside software readable. Attackers find embedded API keys and access tokens, undocumented interfaces and test or staging hosts, bypass checks that only run in the client, and spot outdated libraries with known vulnerabilities. For software that organisations only operate, such as VPN gateway firmware, analysing an update reveals which flaw the vendor has fixed. Tools such as REA make all of these analyses considerably cheaper.",{"q":1318,"a":1319},"How does blacklens.io help against the risks of reverse engineering?","blacklens.io shows which findings of such an analysis can actually be attacked from outside. Attack Surface Management continuously discovers domains, subdomains, services and web applications reachable from the internet, including forgotten staging systems. The Threat Center matches new CVEs in real time against the detected technologies and versions and checks matches with a verification scan where a verification template exists. With Penetration Testing as a Service, OSCP-certified pentesters test web applications, APIs and infrastructure, retests included.","\u002Fimages\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten.webp","Schematic lens over a grid of binary data, which appears behind it as ordered, indented lines of code",{},"\u002Fen\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten",{"title":1130,"description":1309},{"loc":1323},"en\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten",[1328],"Analysis","rea-reverse-engineer-anything-ki-agenten","X-Ksp6_la8KzUewhxrB1gCOIFDu4kuuo0Y_wDOpS8uQ",1792681472240]