{"id":3755,"date":"2026-11-01T07:57:01","date_gmt":"2026-11-01T15:57:01","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3755"},"modified":"2026-11-01T08:50:05","modified_gmt":"2026-11-01T16:50:05","slug":"deadline-day-mag212-cyber-november-1-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/deadline-day-mag212-cyber-november-1-2026\/","title":{"rendered":"Date limite : PHP2Shell, Ivanti, une extension empoisonn\u00e9e et GitLab : MAG212 CYBER Daily Edition, 1er novembre 2026"},"content":{"rendered":"<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212-CYBER-2026-11-01-Daily-Edition-B.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the full edition (PDF, 8 pages, 0.2 MB) \u2192<\/a><\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Deadline day: the federal remediation deadline for GitLab CVE-2026-97229 is today and Ivanti&#8217;s falls tomorrow, PHP2Shell is under active exploitation, and a trojanized Claude Code extension pushed SSH backdoors to developer machines. This companion edition covers five exploited footholds with attack-path diagrams, fixed versions and read-only check commands for Linux, macOS, Windows, PAN-OS and ESXi.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Qu&#039;est-ce qui requiert notre attention aujourd&#039;hui ?<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Histoire<\/th><th>IDENTIFIANT<\/th><th>Gravit\u00e9<\/th><th>Exploit\u00e9<\/th><th>Action<\/th><\/tr><\/thead><tbody><tr><td>PHP2Shell (PHP runtime)<\/td><td>CVE-2026-109618 \/ 109619<\/td><td>CVSS 9.2<\/td><td>Yes, CISA KEV (26 Oct)<\/td><td>PHP 8.2.35 \/ 8.3.36 \/ 8.4.27 \/ 8.5.12, then restart every worker<\/td><\/tr><tr><td>Ivanti Connect Secure chain<\/td><td>CVE-2026-104935 \/ 111357 \/ 118527<\/td><td>8.6 \/ 8.8 \/ 4.3<\/td><td>Yes, CISA KEV; federal deadline 2 Nov<\/td><td>Upgrade to 25.1.1.3 or 22.8R2.6 (no workaround)<\/td><\/tr><tr><td>Trojanized Claude Code extension (Cursor marketplace)<\/td><td>Aucun CVE<\/td><td>Haut<\/td><td>Yes, 29 Oct; up to 5,000 users<\/td><td>Hunt for 2.1.312 \/ 2.1.313; remove key, startup item and tunnel<\/td><\/tr><tr><td>GitLab CI regex RCE<\/td><td>CVE-2026-97229 (+ CVE-2026-110264)<\/td><td>CVSS 10.0<\/td><td>Yes, CISA KEV; federal deadline 1 Nov<\/td><td>Latest patch: 19.5.3 \/ 19.4.5 \/ 19.3.7 \/ 19.2.10 (21 Oct builds 19.5.1 \/ 19.4.3 \/ 19.3.6 \/ 19.2.9 are the minimum)<\/td><\/tr><tr><td>PAN-OS GlobalProtect<\/td><td>CVE-2026-0257<\/td><td>CVSS 9.1<\/td><td>Yes, Qilin and Inc ransomware<\/td><td>Confirm May fixes; dedicated Authentication Override certificate<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Dans cette \u00e9dition<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Aujourd&#039;hui en bref\u00a0:<\/strong> KEV deadline board, CVSS chart and a weekend patch order.<\/li>\n\n\n<li><strong>PHP2Shell:<\/strong> how an out-of-memory crash path becomes a shell, exposure by SAPI, and interim FPM hardening.<\/li>\n\n\n<li><strong>Ivanti Connect Secure:<\/strong> the three-bug chain to root, a timeline back to 3 October, and a SIEM hunt for the X-DSCGI-PATH header.<\/li>\n\n\n<li><strong>The extension update that planted SSH keys:<\/strong> payload sequence, affected sources and triage commands for macOS, Linux and Windows.<\/li>\n\n\n<li><strong>GitLab:<\/strong> one regular expression, CVSS 10, why the 12 October builds are not enough, and what to rotate.<\/li>\n\n\n<li><strong>From VPN gateway to hypervisor:<\/strong> the PAN-OS to vCenter to ESXi path, the PoC log fingerprint, and the execInstalledOnly check.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Feuilletez l&#039;\u00e9dition<\/h2>\n\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212-CYBER-2026-11-01-Daily-Edition-B.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">How we report: every story was checked against vendor advisories, CISA and named research teams on 1 November 2026, with secondary reporting used where primary pages were unavailable. Diagrams are schematic illustrations, not indicators of compromise, and console panels are illustrative layouts. Commands are proposed read-only checks, not tests run by MAG212 on affected systems. Advisories and fixed versions change, so verify with the vendor before acting. Corrections and tips: consultant@mag212.com.<\/p>\n\n\n\n<h2 class=\"wp-block-heading mag212-related\">Articles connexes sur MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list mag212-related-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/broken-trust-mag212-cyber-november-1-2026\/\">Fi\u00e8vre et confiance bris\u00e9es\u00a0: LXD, Polymarket, Binance et NetamLoader\u00a0: MAG212 CYBER Daily Edition, 1er novembre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/gitlab-cve-2026-97229-investigation-guide\/\">Au c\u0153ur de la faille GitLab\u00a0: de la configuration CI \u00e0 l\u2019ex\u00e9cution sur le serveur (CVE-2026-97229)<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/heists-hijacked-scripts-hostile-regex-mag212-cyber-october-30-2026\/\">Braquages, scripts pirat\u00e9s et expressions r\u00e9guli\u00e8res hostiles\u00a0: MAG212 CYBER Daily Edition, 30 octobre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/the-edge-the-cloud-and-the-code-mag212-cyber-october-29-2026\/\">L&#039;Edge, le Cloud et le Code : MAG212 CYBER Daily Edition, 29 octobre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/borrowed-trust-mag212-cyber-weekly-october-31-2026\/\">Fiducie emprunt\u00e9e : MAG212 CYBER Weekly, 31 octobre 2026<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>GitLab CVE-2026-97229 hits its federal deadline today and Ivanti tomorrow, PHP2Shell is in CISA KEV, a trojanized Claude Code extension planted SSH backdoors via Cursor, and ransomware crews ride PAN-OS CVE-2026-0257 to the hypervisor.<\/p>","protected":false},"author":1,"featured_media":3758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15,14],"tags":[62,141,142,150,148,34,35,73,146,147,122,126,66,145,138,33,24,149],"class_list":["post-3755","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","category-vulnerabilities","tag-cisa-kev","tag-claude-code","tag-cursor","tag-cve-2026-0257","tag-cve-2026-104935","tag-cve-2026-109618","tag-cve-2026-109619","tag-cve-2026-110264","tag-cve-2026-111357","tag-cve-2026-118527","tag-cve-2026-97229","tag-daily-edition","tag-gitlab","tag-ivanti-connect-secure","tag-pan-os","tag-php2shell","tag-ransomware","tag-supply-chain"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3755"}],"version-history":[{"count":3,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3755\/revisions"}],"predecessor-version":[{"id":3767,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3755\/revisions\/3767"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3758"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}