Nov 3, 20262d ago
Cogent reports fewer than 1% of affected Fortune 500 assets patched on disclosure day
On November 3, Cogent Security reported that the average Fortune 500 company had 2,266 PHP2Shell-affected assets and had patched fewer than 1% by 5 p.m. Pacific on October 21, 2026. Its analysis narrowed that average environment to 16 systems with PHP loaded at runtime that were internet-facing and supported critical business functions.
Cogent Security Makes the Fortune Cyber 60 for a Second Year, With a Plan to Run Cyber Defense Like a FactoryNov 2, 20263d ago
Intigriti triages 37 PHP2Shell reports without validated RCE or sensitive-data access
As of November 2, Intigriti had received 37 PHP2Shell submissions across 24 bug bounty programs, filtering out 31, accepting three and leaving three in triage. None of the accepted reports included a working proof of concept demonstrating remote code execution or sensitive-data access.
PHP2Shell revisited: What Intigriti’s insights tell us about real-world riskReported Oct 30, 20265d ago
Additional government websites and online platforms suspend services over PHP2Shell
The article reports precautionary shutdowns affecting Finnish Valtori-operated services, Belgian foreign-ministry websites, French prefecture websites, and the Netherlands' Overheid.nl and NCSC website. Cygames reportedly suspended Granblue Fantasy, Umamusume and Princess Connect for emergency maintenance; these actions do not establish successful compromise.
Часть 2. PHP2Shell (CVE-2026-109618 и 109619) - Форум информационной безопасности - Codeby.netReported Oct 30, 20265d ago
Varonis analysis identifies four underlying bugs grouped under PHP2Shell CVEs
According to the article's account of Varonis research, PHP2Shell encompasses four underlying bugs, including memory disclosure through a PHPSESSID cookie and an OPcache allocation-accounting flaw that can supply another worker with an incorrectly typed pointer. Exploitation details for the OPcache flaw were not publicly disclosed.
Часть 1. PHP2Shell (CVE-2026-109618 и 109619) - Форум информационной безопасности - Codeby.netReported Oct 30, 20265d ago
Halborn reports 35 successful PHP2Shell exploits observed by honeypot operators
Halborn reported that honeypot operators observed 35 successful in-the-wild PHP2Shell exploits resulting in attacker command execution. The reference does not identify when these occurred or establish whether they overlap with previously reported observations.
PHP2Shell Explained: What CVE-2026-109618 and CVE-2026-109619 Mean for Digital Asset OrganizationsReported Oct 30, 20265d ago
ESET patches Endpoint Encryption Server and adds Cloud Proxy security controls
ESET released an updated Endpoint Encryption Server addressing both PHP2Shell vulnerabilities, which affect versions earlier than 3.8.7.0, and added security controls to Endpoint Encryption Cloud Proxy. ESET recommended manually updating the embedded PHP runtime if the server update could not be installed immediately; no exploitation specifically targeting ESET products was known.
ESET: aggiornamenti e mitigazioni per le vulnerabilità "PHP2Shell" - ACNReported Oct 30, 20265d ago
Palo Alto reports PHP2Shell impact on 0.02% of installed base and contacts customers
Palo Alto Networks said approximately 0.02% of its global installed base had publicly exposed management interfaces and was impacted, and that its teams contacted those customers individually. It limited the affected surface to management HTTPS and XML API interfaces.
Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management InterfacesReported Oct 30, 20266d ago
Tenable reproduces PHP2Shell RCE on PHP 7.4.33 and tests detection probes
Tenable achieved remote code execution on PHP 7.4.33 using an environment-tuned exploit and reproduced exploitation in specifically configured PHP 8.4 and 8.5 environments. It also tested allocation-size and session upload-progress crash-and-recovery signals, but its stateful detection probe produced both false positives and false negatives.
php2shell: Why One Exploit Doesn't Work EverywhereOct 30, 20266d ago
Hunt.io identifies 616 PHP2Shell-related files across exposed infrastructure
As of October 30, Hunt.io's open-directory investigation identified 616 PHP2Shell-related files spanning exploit development, shared toolkits, scanning infrastructure and post-exploitation staging, including PAN-OS-focused scripts. The investigation distinguished heap-corruption exploits from tools requiring a separate local file inclusion flaw and cautioned that exposed artifacts do not establish successful production compromise.
PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto FirewallsReported Oct 29, 20266d ago
GreyNoise reports at least six successful PHP2Shell exploitations
GreyNoise reported observing at least six successful exploitations involving the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The reference does not identify the affected systems or specify when the exploitations occurred.
Limited reports of PHP bug exploitation emerge | The Record from Recorded Future NewsReported Oct 29, 20266d ago
Palo Alto Networks' Unit 42 verifies Dream's firewall compromise findings
Dream identified the compromised firewalls as Palo Alto Networks devices running PAN-OS 12.1 and 12.2 with PHP 8.0.30. Dream worked with Palo Alto Networks to investigate, and Unit 42 independently verified the attackers' tooling and confirmed Dream's reported results.
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 serversReported Oct 29, 20266d ago
Infoblox finds fewer than 1% of monitored PHP instances running fixed releases
Infoblox's analysis of EASM-monitored tenants found fewer than 1% of detected PHP instances at or above the PHP2Shell-fixed releases, approximately 62% on end-of-life branches, and approximately 38% on supported but unpatched branches. Infoblox characterized these statistics as an exposure baseline, not evidence of exploitation.
PHP2Shell Mitigation: Exposure, DNS and Network VisibilityReported Oct 29, 20266d ago
CISA adds Fragnesia to exploited vulnerabilities catalog
CISA added CVE-2026-46300 (Fragnesia) to its Known Exploited Vulnerabilities catalog, stating that attackers can chain it with the PHP2Shell vulnerabilities to implant PHP web shells and execute commands as root. It directed federal agencies to apply fixes by October 31, 2026.
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management InterfacesOct 29, 20267d ago
CERT-AGID survey finds potentially vulnerable URLs fell from 650 to 382
CERT-AGID's October 29 survey found 382 potentially vulnerable URLs, down from 650 on October 22, with 1.7% of examined IPA addresses reporting a potentially vulnerable PHP version. The decrease is consistent with software updates, but remediation requires verification directly on the servers.
PHP2Shell: diminuiscono le URL potenzialmente vulnerabili. Disponibili gli strumenti AgID - Malware News - Malware Analysis, News and IndicatorsReported Oct 29, 20267d ago
KS Digital, Digitaliseringsdirektoratet and OsloMet temporarily shut down services
KS Digital, Digitaliseringsdirektoratet and OsloMet temporarily shut down services as a precaution while investigating potential PHP2Shell exposure. The reference does not establish that their systems were vulnerable or compromised.
AI-driven vulnerabilities: Why attack surface mattersReported Oct 29, 20267d ago
Palo Alto Networks releases PAN-OS fixes for both PHP2Shell vulnerabilities
Palo Alto Networks released security updates addressing CVE-2026-109618 and CVE-2026-109619 in PHP bundled with PAN-OS. The KISA notice lists affected versions and fixed releases across PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 and advises users to install the appropriate update.
Palo Alto Networks 제품 보안 업데이트 권고 > 보안공지 > 알림마당 : KISA 보호나라&KrCERT/CCReported Oct 29, 20267d ago
Synology releases PHP2Shell fixes for Calendar, Mail Station and PHP packages
Synology released updates addressing CVE-2026-109618 and CVE-2026-109619 in Calendar, Mail Station and its distributed PHP packages under advisory Synology_SA_26_14. Users must install the applicable package fixes, while users of Synology PHP 7.3 must migrate to a fixed version; Synology package versions differ from official PHP Group release numbers.
Synology 제품 보안 업데이트 권고 > 보안공지 > 알림마당 : KISA 보호나라&KrCERT/CCReported Oct 28, 20267d ago
ANSSI warns PHP2Shell risks persist in products embedding vulnerable PHP
In a message transmitted to AFP, France's ANSSI warned that website fixes did not definitively resolve PHP2Shell risks because third-party products could still embed vulnerable PHP versions. It highlighted routers, firewalls and connected devices and urged prompt updates to affected equipment.
Il ne faut pas "considérer que le problème est définitivement résolu": l'Anssi alerte sur des "impacts secondaires" liés aux failles PHPReported Oct 28, 20267d ago
OffSec launches free PHP2Shell lab
OffSec launched a free PHP2Shell lab following discovery of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery - Cyber Security NewsReported Oct 28, 20267d ago
Aryaka remediates PHP exposure and deploys updated IDPS signatures
Aryaka reported assessing and remediating potential PHP exposure across its environment and deploying updated IDPS signatures to all Unified SASE customer sites with IDPS enabled. It stated that its SD-WAN and Unified SASE services were not impacted and required no customer action.
Critical PHP Vulnerabilities: Aryaka’s Security ResponseReported Oct 28, 20267d ago
Corelight provides open-source PHP2Shell detections for Zeek and Suricata
Corelight made an open-source PHP2Shell detection repository available with Zeek and Suricata detections for monitoring visible HTTP traffic. Maintainers warn that the rules are incomplete and may also match benign traffic.
Security Advisory - PHP2Shell: Critical Remote Code Execution Vulnerabilities Affecting PHP Servers - Malware Analysis - Malware Analysis, News and IndicatorsReported Oct 28, 20267d ago
CSIRT-ITA warns of PHP2Shell exposure in products with embedded PHP
CSIRT-ITA issued a follow-up warning urging administrators to identify embedded PHP components, verify exposure through vendor advisories, and apply available updates or mitigations. It highlighted NCSC-NL's continuously updated inventory of potentially affected products, noting that inclusion does not confirm vulnerability and absence does not establish safety.
PHP2Shell: verificare i prodotti che Integrano PHP - ACNReported Oct 28, 20267d ago
Researcher reportedly discovers and exploits original PHP2Shell bug using GPT 5.6-Sol
A repost of @calif_io's statement credited @lcfr_hax with discovering and exploiting the original PHP2Shell bug using the publicly available GPT 5.6-Sol model.
AndreGironda: RT @calif_io: @lcfr_hax discovered and exploited the original php2shell bug using the publicly available GPT 5.6-Sol mod...Reported Oct 28, 20267d ago
Morphisec reports PHP2Shell attack on Windows IIS server and blocks reverse-shell payload
Morphisec reported PHP2Shell post-exploitation activity on a customer's Windows IIS server, where w3wp.exe spawned php-cgi.exe, followed by cmd.exe and a packed payload attempting an outbound reverse shell. Its protection blocked the payload during in-memory execution but did not prevent the underlying PHP vulnerability from being exploited.
PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It. | Morphisec BlogReported Oct 28, 20267d ago
Snyk adds PHP2Shell testing to its external scan profile
Snyk reported adding PHP2Shell testing to its full external scan profile within 24 hours of PHP's October 21 release. It also published advisories before the release and added affected ranges and fixed versions within approximately 30 minutes afterward.
PHP2Shell: Prepare for the Next Vulnerability | SnykOct 28, 20268d ago
Previdian observes PHP2Shell code execution on four honeypots
Previdian observed successful remote code execution on four PHP/Apache honeypots configured with highly favorable exploitation conditions. Apache launched an attacker-supplied shell command and download process, but outbound routing restrictions prevented the download; the payload identified on the attacker's infrastructure contained only `sleep 5`, consistent with an exploitation-verification probe.
PHP2Shell Activity Across Previdian Network : r/netsecOct 28, 20268d ago
Splunk creates correlated PHP2Shell exploitation-attempt detection
Splunk created a Cisco Secure Firewall detection correlating PHP memory-disclosure events with serialized-request or upload-activity signatures from the same source to the same destination within five-minute buckets. The analytic is disabled by default and identifies potential exploitation attempts, not confirmed compromise.
Detection: Cisco Secure Firewall - PHP2Shell Exploitation Attempt | Splunk Security ContentOct 28, 20268d ago
Splunk creates Cisco Secure Firewall detection for PHP2Shell upload activity
Splunk created an analytic using Cisco Secure Firewall Threat Defense intrusion events with SignatureID 67360 to detect suspicious PHP upload activity associated with session-handling resource exhaustion. Annotated with CVE-2026-109619, the detection is disabled by default and requires investigation because legitimate load testing and unusual multipart uploads can also trigger it.
Detection: Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity | Splunk Security ContentOct 28, 20268d ago
Splunk creates PHP2Shell detection using Cisco Secure Firewall intrusion events
Splunk created a detection analytic matching Cisco Secure Firewall Threat Defense intrusion events with SignatureID 67359 to identify suspicious serialized PHP requests potentially associated with PHP2Shell exploitation. The analytic is disabled by default and requires investigation to distinguish exploitation attempts from legitimate submissions or security testing.
Detection: Cisco Secure Firewall - PHP2Shell Serialized Payload Activity | Splunk Security ContentOct 28, 20268d ago
Palo Alto Networks reports PHP2Shell attacks against PAN-OS management interfaces
According to the post, Palo Alto Networks reported attacks against internet-exposed PAN-OS management interfaces in connection with PHP2Shell. The report did not establish whether those attacks successfully compromised devices.
php2shell is in CISA KEV with a federal deadline tomorrow (Oct 29): fixed PHP is 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and the patch does not take effect until the workers restart : r/sysadminReported Oct 27, 20268d ago
Two PHP-driven online games close permanently
Two unnamed PHP-driven online games reportedly closed permanently following the emergence of the vulnerabilities.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 27, 20268d ago
Wikimedia Foundation and Internet Archive take protective action
The Wikimedia Foundation and Internet Archive took protective action following the PHP2Shell warnings. The source did not specify the measures taken.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 27, 20268d ago
NSA advises updates or taking affected systems offline
The NSA advised organizations using PHP to prepare updates addressing both vulnerabilities. It recommended taking affected systems offline until fully mitigated if immediate updates were not feasible.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 27, 20268d ago
Honeypot records confirmed PHP2Shell remote code execution
Detection and response lead Adel Karimi reported confirmed remote code execution against Apache mod_php running PHP 8.4.26. He cautioned that the single-worker honeypot configuration was deliberately favorable to attackers.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 27, 20268d ago
Cloudflare observes exploitation attempts surge around public announcement
Cloudflare reported thousands of exploitation attempts in the 10 hours before the announcement, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours, subsequently reaching millions. These figures measured attempts, not confirmed compromises.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 27, 20268d ago
Censys reports more than 10 million PHP services patched against PHP2Shell
Censys reported that more than 10 million of the over 40 million affected internet-facing PHP services identified when patches were released had been patched in less than a week.
No Major PHP2Shell Exploits Seen Yet | DecipherReported Oct 27, 20268d ago
Citrix publishes PHP2Shell advisories and NetScaler protection guidance
Citrix published advisories addressing both PHP2Shell vulnerabilities and guidance for protecting NetScaler management access. Praetorian had not independently confirmed NetScaler exploitability.
php2shell Is Exploitable: Why It's No Log4ShellReported Oct 27, 20268d ago
Palo Alto Networks confirms exposure and accelerates patch releases
Palo Alto Networks issued an advisory confirming exposure to CVE-2026-109618 and accelerated planned patch releases while reviewing product exposure. Praetorian independently confirmed that the PAN-OS management interface uses PHP with Apache mod_php.
php2shell Is Exploitable: Why It's No Log4ShellReported Oct 27, 20268d ago
Praetorian develops behavioral and exposure scanners
Praetorian developed scanners that attempt to trigger out-of-memory conditions and examine subsequent responses, alongside checks for exposed phpinfo pages and version information.
php2shell Is Exploitable: Why It's No Log4ShellReported Oct 27, 20268d ago
Praetorian demonstrates mod_php exploitation and explains reliability limits
Praetorian achieved remote code execution against PHP 8.4.26 under Apache mod_php and detailed the information leak and heap manipulation needed to bypass ASLR. It found exploitation highly dependent on build and runtime conditions and had not validated the separate PHP-FPM exploitation path.
php2shell Is Exploitable: Why It's No Log4ShellReported Oct 27, 20268d ago
Bishop Fox reproduces PHP2Shell RCE across three PHP branches and tests other SAPIs
Bishop Fox reproduced unauthenticated HTTP remote code execution with ASLR enabled against stock Apache mod_php Docker images for PHP 8.3, 8.4 and 8.5. Its direct pre-application memory-exhaustion tests against PHP-FPM and php-cgi caused worker crashes rather than code execution, while the report identified a separate application-dependent PHP-FPM RCE path.
Responder Guidance for PHP2Shell (CVE-2026-109618 and… | Bishop FoxOct 27, 20269d ago
Censys identifies 32.5 million PHP services reporting potentially vulnerable versions
As of October 27, Censys counted 32.5 million internet-facing PHP services reporting versions potentially vulnerable to PHP2Shell. It also identified more than 60 million additional PHP services that did not report a version, leaving their vulnerability status undetermined.
Even after PHP2Shell, blast radius matters more than a CVSS scoreReported Oct 27, 20269d ago
Fortinet reports major product lines unaffected
Fortinet reported that FortiOS, FortiManager, FortiAnalyzer and FortiWeb were unaffected. Assessment continued for other products, including FortiDDoS and FortiSOAR.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsReported Oct 27, 20269d ago
Cisco patches Expressway and Duo Access Gateway products
Cisco patched affected Expressway Series devices and Duo Access Gateway products. It also published mitigations for affected Ultra-Reliable Wireless Backhaul products, where exploitation requires existing administrator-level access.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsReported Oct 27, 20269d ago
Tester wins PHP exploitation contest and publishes proof of concept
A British vulnerability tester exploited PHP 8.4.26 within 19 hours of the Saturday launch of a 'Steal My Bitcoin' contest. The tester subsequently published proof-of-concept code on GitHub.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsReported Oct 26, 20269d ago
Matt Green publishes Velociraptor YARA artifact for PHP2Shell hunting
Matt Green published Generic.Detection.Yara.PHP2Shell on the Velociraptor Artifact Exchange, providing five YARA rules to hunt for exploit query strings, shell errors, clustered memory-exhaustion events and PHPSESSID memory leaks. The accompanying report cautions that its automatically extracted indicators require validation before operational use.
PHP2Shell (CVE-2026-109618/109619) : artefact Velociraptor YARA pour détecter l'exploitation in-the-wild | CyberVeilleReported Oct 26, 20269d ago
AndrewMohawk demonstrates PHP2Shell execution on Apache, WordPress and PHP-FPM
AndrewMohawk independently demonstrated command execution through both PHP2Shell vulnerabilities, including against WordPress with display_errors disabled. A separate nginx-to-PHP-FPM demonstration redirected a session write into an executable PHP file, requiring specific session settings, worker preparation, calibrated allocator offsets and a writable PHP-executable location.
Picking apart PHP2Shell · AndrewMohawkReported Oct 26, 20269d ago
LinkedIn author reports Sophos and Palo Alto retracted PHP2Shell activity claims
A LinkedIn author reported that Sophos and Palo Alto Networks retracted claims concerning PHP2Shell activity in the wild. The supplied post does not include the underlying retraction statements or evidence confirming exploitation.
last week Sophos said they had seen PHP2SHELL in in the wild and then retracted, PALO ALTO have just had to do the same thing.... | Daniel C.Reported Oct 26, 20269d ago
Sophos blocks attempts to deliver Potassium malware through PHP2Shell
Sophos reported blocking attempts to deliver Potassium, described as a likely Mirai botnet variant, in connection with PHP2Shell exploitation. It found no evidence of successful compromise.
Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoCOct 26, 202610d ago
First exploitation of separate Brotli flaw recorded after PHP2Shell patches
The first attack exploiting CVE-2026-111497 was reportedly recorded on October 26; the Brotli flaw can enable code execution when PHP processes a specially crafted compressed response from an external server. Initial PHP2Shell updates did not address it, but PHP builds dated October 25 included a patched Brotli library.
PHP2Shell: what we know about the threat two weeks later | Kaspersky official blogOct 26, 202610d ago
Ox Security finds 93.6% of assessed instances still exposed
Ox Security reported that 93.6% of the instances it assessed remained exposed five days after disclosure. The findings indicated slow remediation despite public concern and exploitation in the wild.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackOct 26, 202610d ago
CISA adds both PHP2Shell vulnerabilities to its exploited flaws catalog
CISA confirmed active exploitation and added both vulnerabilities to its Known Exploited Vulnerabilities catalog. It directed federal civilian agencies to remediate within three days and conduct forensic triage, with an October 29 deadline.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsReported Oct 26, 202610d ago
Dream notifies affected firewall vendor
Dream notified the vendor whose firewall software was targeted by the chained exploitation campaign. The researchers withheld the vendor's identity and affected software versions.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchReported Oct 26, 202610d ago
Attacker steals credentials and keys and attempts identity-system attacks
Recovered artifacts showed LDAP credential recovery, Active Directory enumeration, password spraying, attempted backdoor account creation, and theft of firewall and certificate keys. Attempts to extract SAML signing keys and bypass Keycloak authentication were also documented, but several attack outcomes could not be established.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchReported Oct 26, 202610d ago
Attacker establishes persistent access to internal services
The attacker established an eight-port reverse SSH tunnel exposing domain-controller services, firewall management and VPN infrastructure, plus a SOCKS5 proxy. A systemd service and rc.local boot hook provided persistence across reboots.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchReported Oct 26, 202610d ago
PHP2Shell and Fragnesia chain compromises 24 perimeter firewalls
An automated exploitation runner chained PHP2Shell code execution with Fragnesia privilege escalation to obtain root access and plant PHP webshells on 24 firewalls. Two firewalls associated with a US government-affiliated organization received additional attention.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchReported Oct 26, 202610d ago
Firewall attacker narrows roughly 19,000 exposed devices to 240 targets
The attacker used FOFA and a custom scanner to identify exposed firewall management interfaces, then filtered targets by geography and software version. The resulting 240 targets were in the United States, Japan, Taiwan and South Korea.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchOct 25, 202611d ago
Dream discovers artifacts documenting 25 compromised servers
Dream researchers discovered exploitation logs, target lists, approximately 40 custom post-exploitation scripts and evidence of 25 compromised servers. The researchers assessed a possible Chinese nexus but did not attribute the operation to a named actor.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchOct 24, 202612d ago
Community backport announced for PHP2Shell flaws in legacy PHP 5.x
Roman Kuligin announced a community-developed patch for CVE-2026-109618 and CVE-2026-109619 targeting unsupported PHP 5.4, 5.5 and 5.6, publishing the patch and installation instructions on GitHub. Kuligin said the backport changes internal memory allocation to prevent memory exhaustion and crashes during file upload progress tracking.
oss-sec: Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)Oct 24, 202612d ago
Internal firewall management server becomes the 25th compromised server
At 11:35 UTC, the attacker reused PHP2Shell and Fragnesia through the tunnel to compromise the internal firewall management server. The compromise exposed managed firewall configurations and credentials and provided an LDAP-connected launch point for further attacks.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchOct 24, 202612d ago
Second government-affiliated firewall is compromised
The attacker compromised a second firewall at the same government-affiliated organization at 10:09 UTC after it had timed out during the original exploitation batch.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchOct 23, 202613d ago
Splunk creates Suricata detection for PHP opening tags in upload filenames
Splunk created an analytic detecting PHP opening tags in HTTP POST upload filenames using Suricata telemetry, potentially indicating PHP2Shell exploitation attempts. Disabled by default, it requires additional request-body inspection and investigation; matches do not establish successful exploitation.
Detection: PHP Opening Tag in Upload Filename - Suricata | Splunk Security ContentOct 23, 202613d ago
Splunk creates Suricata-based PHP2Shell upload-filename detection
Splunk created an analytic that searches Suricata telemetry for PHP serialization tokens in HTTP POST upload filenames, potentially indicating PHP2Shell exploitation attempts. Disabled by default, it requires contextual investigation and additional request-body inspection to verify the PHP_SESSION_UPLOAD_PROGRESS field; matches do not establish successful exploitation.
Detection: Serialized PHP Token in Upload Filename - Suricata | Splunk Security ContentOct 23, 202613d ago
PHP discloses third RCE vulnerability, CVE-2026-115560
PHP disclosed CVE-2026-115560, a third remote code execution vulnerability affecting unusually configured applications. PHP considered exploitation unlikely and did not issue an out-of-band release, instead providing a configuration mitigation pending the next regular bugfix release.
PHP2Shell, one week on: The patch does not cover the secrets already exposed | by Jost Faganel | Oct, 2026 | MeetCyberOct 23, 202613d ago
Suspected North Korean operators conduct targeted PHP2Shell scanning
Cyfirma reported that suspected North Korean operators had progressed to low-and-slow scanning by Friday, using 21 compromised nodes to check 216 selected hosts. Its tentative Lazarus Group association relied on behavioral and linguistic indicators rather than infrastructure or malware overlap.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsOct 23, 202613d ago
First government-affiliated firewall is compromised
At 18:14 UTC, the attacker compromised a firewall associated with a US government-affiliated organization and exposed its internal configuration. After the device stopped responding, the attacker issued 240 recovery probes over two hours.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchReported Oct 22, 202614d ago
Siemens identifies RUGGEDCOM APE1808 as affected by PHP2Shell
Siemens identifies RUGGEDCOM APE1808 as affected by CVE-2026-109619 and references ProductCERT advisory SSA-566512. The supplied supplier data does not specify a fixed version.
CVE-2026-109619 - Vulnerability-LookupOct 22, 202614d ago
Belden discloses PHP2Shell vulnerabilities in macmon and NRSW
Belden published a security bulletin identifying CVE-2026-109618 and CVE-2026-109619 in NRSW versions before 5.0.0.104 and macmon 6.x and 7.x without the latest security patch. Remediation requires updating NRSW or applying the macmon security patch, with macmon 6.x users first upgrading to 7.x.
Multiples vulnérabilités dans macmon et NRSW - CERT-FROct 22, 202614d ago
Wordfence detects coordinated PHP2Shell probing from 27 IP addresses
On October 22, Wordfence observed coordinated PHP2Shell probing from 27 IP addresses, with 26 beginning requests within a 13-minute window. Its monitoring subsequently recorded approximately 77,600 related requests from more than 2,000 IP addresses during October 23–27, but Wordfence reported no confirmed WordPress compromises as of October 28.
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most - Malware News - Malware Analysis, News and IndicatorsOct 22, 202614d ago
Flare finds widespread use of unsupported PHP branches
Flare's October 22 report found that nearly three quarters of the 2.2 million PHP service records it tracked advertised branches no longer supported by the PHP project.
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response - The New StackReported Oct 21, 202614d ago
PHP publishes source-only PHP2Shell backports for legacy branches
PHP published source-only backports addressing PHP2Shell for PHP 7.4, 8.0 and 8.1. Blackpoint's advisory also reported that some Linux distributions and long-term-support vendors were providing backported packages.
PHP2Shell: Critical PHP RCE CVE-2026-109618 & CVE-2026-109619 - Blackpoint CyberOct 21, 202615d ago
eSentire detects PHP2Shell attempts using rapidly adapted public exploits
eSentire identified PHP2Shell exploitation attempts using public proof-of-concept code beginning October 21, 2026; one initial observation involved a modified exploit appearing less than an hour after the original code was posted to GitHub. It reported no evidence of successful compromise in its customer environments.
PHP2Shell: Two Critical PHP Flaws Explained | eSentireOct 21, 202615d ago
Cato detects and blocks PHP2Shell scanning and exploitation attempts
Cato first observed external PHP2Shell scanning or invalid proof-of-concept requests in sampled customer traffic on October 21, 2026. Across its October 17–26 observation window, approximately 41% of blocked attempts sought remote code execution and 59% were scanning or invalid-PoC activity; these observations did not establish successful compromises.
Cato CTRL: Blocking PHP2Shell Exploitation | Cato NetworksOct 21, 202615d ago
Ubuntu releases PHP2Shell fixes across security-maintained releases
On October 21 at 14:00 UTC, after the revised embargo lifted, the Ubuntu Security Team published notices USN-8948-1 and USN-8948-2 and patched PHP packages. Canonical backported and tested fixes for security-maintained Ubuntu releases from 14.04 LTS through 26.10.
Why embargoes matter for open source security | CanonicalOct 21, 202615d ago
VertexIT deploys PHP2Shell patches within two minutes of availability
Hosting provider VertexIT reported deploying patched PHP packages within two minutes of their availability on October 21, 2026, without outages.
Thoughts on Vulnerability Response in the Era of the Vulnpocalypse and PHP2Shell - CensysOct 21, 202615d ago
PHP Foundation releases fixes for both PHP2Shell vulnerabilities
The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two vulnerabilities, which can enable unauthenticated remote code execution.
PHP2Shell Actively Exploited, US Cybersecurity Agency WarnsOct 21, 202615d ago
Wordfence detects PHP2Shell-specific probes before public disclosure
Wordfence observed requests using vulnerability-specific tools on October 21, approximately four hours before public disclosure. The observation establishes early probing, not successful compromise.
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing MostOct 21, 202615d ago
Chainguard publishes patched PHP images before coordinated release
Chainguard published rebuilt PHP images containing PHP2Shell fixes on October 21, more than six hours before the coordinated release. The PHP Foundation publicly accused Chainguard of breaking the embargo by making patched binaries available for attackers to examine.
Censys takes census of the Internet like no one else - CensysOct 20, 202616d ago
PHP Foundation warns of forthcoming PHP2Shell patches
The PHP Foundation issued an advisory warning that patches were forthcoming after researchers discovered the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
CISA urges federal agencies to patch after PHP exploits observed | IT ProOct 20, 202616d ago
PHP2Shell details leak ahead of coordinated disclosure
Details of CVE-2026-109618 and CVE-2026-109619 reportedly leaked before coordinated disclosure. Affected-version advisories and public proof-of-concept exploits subsequently appeared, although many exploits were nonfunctional.
php2shell Is Exploitable: Why It's No Log4ShellReported Oct 13, 202623d ago
Amazon honeypots record PHP2Shell exploitation attempt before disclosure
Amazon Threat Intelligence recorded a PHP2Shell exploitation attempt in its honeypots on October 17, 2026, four days before PHP released emergency fixes and three days before vulnerability details leaked online.
PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619Oct 8, 202628d ago
Attacker begins preparing firewall exploitation campaign
Recovered campaign artifacts showed preparation beginning October 8 for an operation that chained PHP2Shell with the Fragnesia Linux kernel vulnerability.
Chained PHP2Shell Exploit Roots 25 Servers | Dream ResearchOct 2026
Criminal forums issue emergency PHP2Shell notices and restrict operations
Within 48 hours of the article's stated October 20 disclosure, BreachForums issued a security advisory, DarkForums announced a shutdown pending patching, and Dread published maintenance notices naming both vulnerabilities. Some unnamed forums restricted registrations or shifted communications to Telegram; the report does not establish successful compromise of these forums.
Adversary Economy Reacts to PHP2Shell | CSAAug 20, 20263mo ago
Wiz demonstrates PHP2Shell compromise of Drupal and WordPress
Wiz researchers reportedly demonstrated unauthenticated compromise of a Drupal site on August 20, 2026, followed by a WordPress site on August 21. These demonstrations followed their reported AI-assisted discovery of the first PHP2Shell vulnerability on August 19.
OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery | Cryptika CybersecurityAug 14, 20263mo ago
Calif shares working PHP2Shell proof of concept after reporting vulnerability
Calif reported CVE-2026-109618 on August 11, 2026, and shared a working proof of concept on August 14. These disclosure steps preceded the October leak and patch releases.
PHP2Shell and Node2Shell: Inside October’s RCE Wave | by Muhammad Haider Tallal | Oct, 2026 | MeetCyber2024
OSTIF and Quarkslab audit identifies issue later linked to PHP2Shell
An OSTIF and Quarkslab audit identified the out-of-memory issue underlying the first PHP2Shell vulnerability in 2024. The issue remained unfixed because its exploitability had not been demonstrated.
Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster2020
Underlying PHP2Shell out-of-memory flaw first discovered
The article reports that the out-of-memory flaw later linked to PHP2Shell was originally discovered in 2020. It remained unfixed because exploitability had not been demonstrated and was rediscovered during a 2024 PHP audit.
PHP2Shell: Exploring the Impact of CVE-2026-109618 and CVE-2026-109619 | by Criminal IP | Oct, 2026 | Medium
