PHP PHP2Shell critical RCE flaws (CVE-2026-109618, CVE-2026-109619): exploitation from Oct 17, patches Oct 21, mass exploitation attempts, public PoC lab, broad vendor and government response

Linha do tempo

1. gbhackers.com ↗ · pub. 31/10/2026 04:59 · coletado 31/10 05:00

   PHP2Shell RCE chained with Fragnesia (CVE-2026-46300) to root 25 Palo Alto PAN-OS firewalls, including a US government-affiliated network

   ler a análise desta fonte ocultar

   Attackers chained the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 4.0 9.2) with the Fragnesia Linux kernel flaw (CVE-2026-46300) to gain root on Palo Alto Networks PAN-OS firewalls. The campaign reportedly compromised 24 internet-facing firewalls, then pivoted through a persistent reverse SSH tunnel into a United States government-affiliated environment and reused the chain against an internal firewall management server, for a total of 25 systems. The compromise exposed management configurations and directory-service credentials. Hunt.io reports the findings, citing Dream Research's campaign analysis, and describes a shift from honeypot exploitation to production compromises. The findings do not establish reliable mass exploitation across arbitrary PHP servers, because differing builds and memory layouts complicate attacks.

   Technical Details

   • PHP2Shell comprises two memory-safety flaws in PHP session-upload handling and in memory cleanup during out-of-memory conditions.
   • The attack abuses the session.upload_progress mechanism with attacker-controlled multipart upload data. Crafted requests manipulate heap allocations, leak memory addresses to bypass ASLR, and forge internal structures that redirect execution to PHP's system() function.
   • For PAN-OS, the operator built a custom, non-public exploit targeting the appweb management server, using version-dependent offsets and calibrated heap layouts instead of an unchanged public PoC.
   • Initial code execution ran in the restricted web-server context. Fragnesia (CVE-2026-46300) was then used to escalate to root. Hunt.io tied the chain's reliability to the uniform PHP 8.0.30 build in the targeted management environment.
   • Targeting: about 19,000 exposed firewalls were identified via FOFA, about 5,000 responded to fingerprinting, and geographic and version filtering cut the pool to 240 targets. Automated exploitation compromised 24 perimeter firewalls.
   • Hunt.io also found panos_rce_poc.py and prce.py in an exposed directory at 130.94.67[.]235. These show PHP2Shell being adapted to PAN-OS, but exposed tooling alone does not prove compromise of any given target.

   Remediation

   • Prioritize vendor-supported PAN-OS remediation and restrict exposure of management interfaces.
   • Move standalone PHP deployments to fixed releases: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on branch.
   • Where patching must wait, set session.upload_progress.enabled to off as a temporary mitigation.
   • Hunt for anomalous multipart uploads, oversized PHPSESSID cookies, web-server processes launching shells, and unexpected outbound connections. Correlate these with management access logs and evidence of unauthorized persistence or lateral movement.
2. securityweek.com ↗ · pub. 30/10/2026 12:09 · coletado 30/10 13:00

   PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

   ler a análise desta fonte ocultar

   Threat actors have been hammering servers vulnerable to PHP2Shell for over a week, but only a few successful compromises have been confirmed to date.

   Standing out are Palo Alto Networks firewalls, which have been rooted by a China-linked hacking group in attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.

3. infosecurity-magazine.com ↗ · pub. 30/10/2026 09:00 · coletado 30/10 10:01

   Chinese Actor Compromises US Government Network Via Chained PHP2Shell

   ler a análise desta fonte ocultar

   A suspected Chinese nation-state actor chained the PHP2Shell exploit with a Linux kernel privilege-escalation vulnerability to gain root access to 25 Palo Alto Network (PAN) firewall and management servers.

   The campaign rooted 25 PAN servers across the United States, Japan, Taiwan, and South Korea, according to an investigation by cyber defense platform provider Dream.

4. tenable.com ↗ · pub. 29/10/2026 22:42 · coletado 30/10 01:00

   php2shell: Why One Exploit Doesn't Work Everywhere

   ler a análise desta fonte ocultar

   php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it. Key takeaways The five vulnerable PHP sites we exposed to the internet were not compromised, and public proofs-of-concept (PoCs) that go beyond version checks do not reliably confirm whether a host is vulnerable. Exploitation has been confirmed elsewhere, on researcher honeypots and on some network appliances. In realistic environments, turning php2shell into remote code execution usually takes an exploit built for the specific target. That is hard, not impossible, and it puts php2shell in a different category from Log4Shell, even though both received near-maximum severity ratings. Where many systems share one build, such as network appliances, a single calibrated exploit can work against all of them. Patch now, starting with internet-facing management interfaces, network appliances, and end-of-life PHP branches. Tenable Nessus and Tenable One Web App Scanning have had version-based detection since October 21. Background On October 20, 2026, PHP announced two vulnerabilities, and on October 21 released fixes for flaws that can allow unauthenticated remote code execution. CVE-2026-109618 i...

5. theregister.com ↗ · pub. 29/10/2026 16:05 · coletado 29/10 18:00

   Dream: China-nexus actors chained custom PHP2Shell exploit with Fragnesia to root 25 servers including US government-affiliated PAN-OS firewalls

   The Register adds that the previously unnamed firewall vendor is **Palo Alto Networks**, that the affected devices ran **PAN-OS 12.1 and 12.2** with PHP 8.0.30, and that **Unit 42 independently verified** the attacker tooling and confirmed Dream's results while working with Dream on the investigation. New operational detail: the first US government-affiliated firewall was rooted on October 23 but crashed under ~900 MB of exploit traffic and remained unresponsive across 240 automated checks over two hours; a second firewall was successfully exploited on October 24. Dream now says the attackers "likely still" retain persistent remote access, the custom PHP2Shell exploit matches no known public PoC, and the ~19,000 FOFA-fingerprinted firewalls are explicitly Palo Alto Networks devices. CISA and the FBI declined to comment.

   ler a análise desta fonte ocultar

   The Register adds that the previously unnamed firewall vendor is Palo Alto Networks, that the affected devices ran PAN-OS 12.1 and 12.2 with PHP 8.0.30, and that Unit 42 independently verified the attacker tooling and confirmed Dream's results while working with Dream on the investigation. New operational detail: the first US government-affiliated firewall was rooted on October 23 but crashed under ~900 MB of exploit traffic and remained unresponsive across 240 automated checks over two hours; a second firewall was successfully exploited on October 24. Dream now says the attackers "likely still" retain persistent remote access, the custom PHP2Shell exploit matches no known public PoC, and the ~19,000 FOFA-fingerprinted firewalls are explicitly Palo Alto Networks devices. CISA and the FBI declined to comment.

   Researchers at Dream report that suspected Chinese attackers built a custom, non-public PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619) and chained it with the Fragnesia Linux kernel privilege-escalation flaw (CVE-2026-46300) to obtain root on 25 internet-facing servers between October 23 and 24, 2026. Victims span the US, Japan, Taiwan and South Korea, and include Palo Alto Networks PAN-OS firewalls belonging to US government-affiliated organizations. Within hours of rooting one government-affiliated firewall, the actors tunneled into the internal network, compromised a third server with the same exploit and launched a full Active Directory attack campaign. Dream warns the persistent tunnel is "likely still" running and the actor retains roughly 19,000 fingerprinted PAN-OS targets identified via the Chinese FOFA search engine. Unit 42 independently verified the attacker tooling and confirmed Dream's findings; CISA and the FBI declined to comment.

   Technical Details

   The four-stage exploit targets PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit enabling the memory-corruption stages. Crafted multipart POST requests corrupt PHP memory and force a predictable layout; a second request forges a stale session ID length to trigger an out-of-bounds read leaking the base address of libphp.so; memory is exhausted again to force mod_data=NULL, creating a stale reference forged in the final stage to execute commands as the nobody user. Fragnesia, affecting the Linux kernel's XFRM ESP-in-TCP subsystem, escalates to root, after which a webshell is planted in a publicly accessible directory. The full chain completes in under 15 minutes, followed by roughly 40 custom post-exploitation scripts. With root, the actors decrypted the LDAP service account password (hardcoded into subsequent scripts), enumerated all domain users and groups via LDAP, password-sprayed every account, and attempted backdoor AD account creation and SAML signing key extraction — outcomes unknown, as results stayed on the local filesystem. The first targeted firewall crashed after roughly 900 MB of exploit traffic and stayed unresponsive through 240 automated checks. Tooling included Anthropic's Claude Code, the aiscan offensive platform configured with DeepSeek and Kimi models, and FOFA API keys; Dream stresses this was AI-assisted, not autonomous.

   Remediation

   Patch PHP to fixed releases and apply Palo Alto Networks guidance; remove management interfaces from internet exposure, hunt for PHP webshells in web-accessible directories on PAN-OS, review reverse SSH tunnels and systemd/rc.local persistence, and rotate LDAP service account and SAML signing credentials where firewalls may have been rooted.

6. cert.cyber.gouv.fr ↗ · pub. 27/10/2026 21:00 · coletado 29/10 13:01

   CERT-FR: actively exploited RCE flaws in Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)

   ler a análise desta fonte ocultar

   CERT-FR published advisory CERTFR-2026-AVI-1402 on 28 October 2026 covering multiple vulnerabilities in Palo Alto Networks PAN-OS allowing remote arbitrary code execution. Palo Alto Networks states that CVE-2026-109618 and CVE-2026-109619 are actively exploited in the wild. A third CVE, CVE-2026-115560, is also referenced. Fixes are available for many 10.2.x, 11.1.x, 11.2.x, 12.1.x and 12.2.x hotfix branches, while patches for several branches (12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.1.7-h12, 10.2.7-h39, 10.2.10-h42) are still pending. CERT-FR previously issued alert CERTFR-2026-ALE-014 on 21 October 2026 on this topic.

   Technical Details

   • Fixed versions include PAN-OS 10.2.13-h27, 10.2.16-h12, 10.2.18-h13, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.1.4-h38, 11.1.6-h40, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1, 11.2.7-h23, 12.1.7-h11 and 12.2.4-h1.
   • Vendor bulletin for CVE-2026-109618 published 27 October 2026.

   Remediation

   • Apply the PAN-OS hotfixes listed in the Palo Alto Networks security bulletins immediately; prioritise internet-exposed management interfaces given active exploitation.
7. infoblox.com ↗ · pub. 29/10/2026 10:00 · coletado 29/10 11:01

   Infoblox outlines PHP2Shell containment: EASM data shows <1% of monitored PHP instances patched, 62% end-of-life

   Infoblox adds a new exposure baseline from its EASM telemetry: across monitored tenants, fewer than 1% of detected PHP instances were at or above the fixed releases, about 62% were on end-of-life branches requiring an upgrade and 38% were on supported branches below the fixed point release — a far bleaker patch-adoption picture than Wiz's reported 67% drop in exposed vulnerable machines. It also adds that Check Point Research reported attempted exploitation globally and that the FBI, alongside CISA, issued urgent patching guidance, and provides defender-side containment guidance focused on DNS-layer disruption of C2/payload delivery and network flow analysis while patching continues.

   ler a análise desta fonte ocultar

   Infoblox adds a new exposure baseline from its EASM telemetry: across monitored tenants, fewer than 1% of detected PHP instances were at or above the fixed releases, about 62% were on end-of-life branches requiring an upgrade and 38% were on supported branches below the fixed point release — a far bleaker patch-adoption picture than Wiz's reported 67% drop in exposed vulnerable machines. It also adds that Check Point Research reported attempted exploitation globally and that the FBI, alongside CISA, issued urgent patching guidance, and provides defender-side containment guidance focused on DNS-layer disruption of C2/payload delivery and network flow analysis while patching continues.

   Infoblox published mitigation guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the unauthenticated, zero-click RCE flaws in PHP core, arguing that patching alone cannot close the exposure window. Across tenants monitored by Infoblox Exposure Management EASM, fewer than 1 percent of detected PHP instances were at or above the fixed releases, about 62 percent were on end-of-life branches needing a full upgrade, and the remaining 38 percent were on supported branches below the fixed point release. Infoblox restates that CISA added both CVEs to the KEV catalog on October 26, 2026, that Check Point Research reported attempted exploitation worldwide and Cloudflare reported early attack attempts, and that Wiz Research demonstrated RCE against WordPress, Drupal and Joomla. Infoblox frames the event as AI-accelerated, citing Wiz's credit to OpenAI GPT-5.6 Sol and Google DeepMind Gemini 4 Argon for reducing exploit-development effort on flaws present for over a decade. The recommended posture is exposure discovery, rapid patching, and DNS and network-flow visibility to contain post-compromise activity.

   Technical Details

   The flaws are memory-safety bugs in PHP itself rather than in any single CMS, so exposure spans all PHP-based services. Exploitation requires no credentials and no user interaction. Infoblox describes the expected post-exploitation chain: reverse shell establishment, DNS-based command and control, secondary payload or ransomware download, and DNS tunneling for exfiltration — all points where DNS-layer blocking and behavioral analytics can interrupt the chain. Network observability (Kentik) is proposed for north-south and east-west anomaly detection, with RTBH or FlowSpec as containment actions.

   Remediation

   Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; PHP 8.1 and earlier are unsupported and must be upgraded to a supported release. Inventory internet-facing PHP including forgotten services, containers and vendor products that bundle PHP. Ask WAF/CDN providers for PHP2Shell-specific rules and treat them as temporary mitigation only. Per CISA, take PHP-based systems offline if they cannot be updated, or restrict and segment access. Map the blast radius of each PHP server and monitor DNS and network traffic beyond the original host.

8. bleepingcomputer.com ↗ · pub. 29/10/2026 10:59 · coletado 29/10 11:00

   CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

   ler a análise desta fonte ocultar

   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.

   Tracked as CVE-2026-46300 and known as Fragnesia, this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that lets attackers run malicious code with root permissions.

9. thehackernews.com ↗ · pub. 29/10/2026 02:50 · coletado 29/10 05:00

   Palo Alto Networks confirms active exploitation of PHP2Shell flaws against internet-exposed PAN-OS management interfaces

   Palo Alto Networks confirmed active exploitation of PHP2Shell against internet-exposed PAN-OS management interfaces, which is consistent with, but not explicitly tied to, Dream's unnamed firewall vendor. The article also adds CISA's KEV listing of Fragnesia (CVE-2026-46300) with an October 31 deadline, the PAN-OS fixed-version matrix with ETAs, mitigations and Threat ID 543004 virtual patching.

   ler a análise desta fonte ocultar

   Palo Alto Networks confirmed active exploitation of PHP2Shell against internet-exposed PAN-OS management interfaces, which is consistent with, but not explicitly tied to, Dream's unnamed firewall vendor. The article also adds CISA's KEV listing of Fragnesia (CVE-2026-46300) with an October 31 deadline, the PAN-OS fixed-version matrix with ETAs, mitigations and Threat ID 543004 virtual patching.

   Palo Alto Networks warned on October 28, 2026 that threat actors are actively exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) against PAN-OS management interfaces exposed to the internet. The flaws allow unauthenticated remote code execution in affected PHP versions and were patched upstream on October 21, 2026. The advisory follows a Dream report of a suspected China-nexus actor chaining PHP2Shell with the Linux kernel flaw Fragnesia (CVE-2026-46300, CVSS 7.8) to root 25 servers in the U.S., Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. Dream did not name the firewall vendor, but the timing and the absence of exploitation reports from other vendors suggest the events are related (The Hacker News inference, not confirmed). CISA added CVE-2026-46300 to its KEV catalog with a federal deadline of October 31, 2026.

   Technical Details

   • No special configuration is required to be affected. Risk is highest on PAN-OS when the management interface is reachable from external IP addresses.
   • The issue strictly affects the management web interface (HTTPS web UI and XML API service). The dataplane interface is affected only if a management profile is attached to it.
   • CISA states the Fragnesia bug can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root.
   • Dream reported that after rooting the devices the attacker attacked Active Directory; recovered artifacts confirm credential extraction and directory enumeration.
   • Affected: PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 (and Panorama). Fixed builds include 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1, 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13. Several fixes have ETAs of October 29-30.

   Remediation

   • Restrict management interface access to trusted internal IP addresses, per Palo Alto Networks best practice.
   • Apply fixed PAN-OS versions as they become available. Where no fix exists yet, route incoming MGT port traffic through a data-plane port using a management profile, replace the certificate for inbound management traffic, decrypt inbound management traffic for inspection, and enable threat prevention on inbound management services.
   • Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 and later received advance coverage via Threat ID 543004, released October 20.
   • U.S. federal agencies must remediate CVE-2026-46300 by October 31, 2026.
10. gbhackers.com ↗ · pub. 29/10/2026 01:59 · coletado 29/10 03:00

    Chinese-nexus actor chains PHP2Shell and Fragnesia to root 25 firewall servers, including US government-affiliated systems

    gbhackers.com adds technical detail on the Dream findings: the four-stage PHP2Shell memory-corruption chain (libphp.so pointer leak via Set-Cookie, forged HashTable entry redirecting a cleanup callback to system()), the Fragnesia mechanism (XFRM ESP-in-TCP, page cache write to /etc/pam.d/su), a root webshell in under 15 minutes, 103-byte webshells, systemd and rc.local persistence, a SOCKS5 proxy, SAML signing key extraction attempts, the October 25 discovery date, and a count of three systems tied to the US government-affiliated environment.

    ler a análise desta fonte ocultar

    gbhackers.com adds technical detail on the Dream findings: the four-stage PHP2Shell memory-corruption chain (libphp.so pointer leak via Set-Cookie, forged HashTable entry redirecting a cleanup callback to system()), the Fragnesia mechanism (XFRM ESP-in-TCP, page cache write to /etc/pam.d/su), a root webshell in under 15 minutes, 103-byte webshells, systemd and rc.local persistence, a SOCKS5 proxy, SAML signing key extraction attempts, the October 25 discovery date, and a count of three systems tied to the US government-affiliated environment.

    Dream researchers report that an operator chained the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Linux kernel privilege escalation bug Fragnesia (CVE-2026-46300) to gain root on 25 firewall servers. Three of the systems were associated with a United States government-affiliated environment. The activity was discovered on October 25 and ran from exposed firewall management interfaces to credential theft, persistent tunneling and Active Directory reconnaissance. Compromises spanned the United States, Japan, Taiwan and South Korea. Dream withheld the firewall vendor and software versions and says the vendor has been notified. It did not attribute the operation to a named actor, but language and infrastructure artifacts point to a Chinese nexus, with AI tooling assisting the operator.

    Technical Details

    • The custom PHP2Shell exploit abuses PHP's session.upload_progress mechanism in the firewall's appweb management server. It uses memory corruption to run commands without authentication.
    • Stage 1: multipart requests exhaust memory and manipulate PHP's allocation behavior. Stage 2: an information leak exposes a libphp.so pointer through a Set-Cookie response header, which lets the attacker compute the addresses needed later.
    • Stage 3: further memory pressure creates a stale reference. A forged PHP HashTable entry then redirects a cleanup callback to system(), giving command execution as the unprivileged nobody account. Stage 4: the final request launches Fragnesia.
    • Fragnesia targets the Linux kernel XFRM ESP-in-TCP subsystem. Page cache writes altered /etc/pam.d/su to permit authentication, allowing passwordless elevation to root. The full chain produced a root webshell in under 15 minutes.
    • The operator used FOFA to identify about 19,000 exposed firewalls. Version scanning returned about 5,000 responsive devices, and geographic and software filtering cut the list to 240 targets. Automated attacks rooted 24 firewalls and installed 103-byte PHP webshells.
    • Two perimeter devices were of particular interest because their configurations indicated a government-affiliated environment. One crashed. On the second, the operator set up reverse SSH tunnels and a SOCKS5 proxy, with persistence through systemd and rc.local.
    • The tunnel exposed an internal firewall management server, which was rooted with the same chain, bringing the total to 25.
    • From that server the operator decrypted an LDAP service account password and enumerated domain users and groups. Scripts also attempted password spraying, backdoor account creation, Active Directory privilege escalation analysis and SAML signing key extraction. Results were unavailable, so broader domain compromise cannot be confirmed.
    • Dream recovered the exploit, targeting lists, exploitation logs and about 40 post-exploitation scripts. Chinese-language prompts, UTC+8 timestamps, FOFA access and configured DeepSeek and Kimi models suggest a Chinese nexus. Installed AI tools and consistent scripting suggest AI assistance, not proven autonomous exploitation.

    Remediation

    • Restrict exposure of firewall management interfaces.
    • Investigate downstream identity access (LDAP, Active Directory, SAML signing keys) after any perimeter compromise. Remediating the firewall alone is not sufficient containment.
    • Apply the PHP and Linux kernel fixes for the chained CVEs and watch for the vendor's advisory.
11. aikido.dev ↗ · pub. 29/10/2026 06:36 · coletado 28/10 14:01

    PHP2Shell: Actively exploited flaws in the PHP runtime (CVE-2026-109618, CVE-2026-109619) force mass patching after leak

    ler a análise desta fonte ocultar

    The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) lay dormant in the PHP runtime for about twenty years. Calif and Wiz found them independently in 2026, each with a proof of exploitation. The CVE IDs leaked on October 20, so PHP pre-announced that evening and moved the patch release up to 14:00 UTC on October 21. Exploitation attempts are now widespread, a few have succeeded, and Amazon reports the first attempts on October 17, before the pre-announcement. As of October 27, Censys counted about 32.5 million PHP services still on an affected version versus 11.2 million moved to a fixed one. More than 60 million services do not report a version. The article is an Aikido vendor blog arguing that AI is compressing the time from discovery to exploitation, so coordinated disclosure and patching must get faster.

    Technical Details

    • The out-of-memory issue behind the first of the two vulnerabilities was already noted in a 2024 audit by OSTIF and Quarkslab, but it stayed unfixed because no one had shown it was exploitable.
    • A public test by researcher James Pavur used an unpatched PHP 8.4.26 server with about $2,000 in bitcoin as the prize. A participant broke in roughly three hours after the server began serving a PHP page.
    • Trail of Bits built a working exploit from the patches in a day using Codex. Aikido estimates a skilled person could do so with an LLM in a few hours.
    • Aikido's AI Code Analysis rediscovered PHP2Shell in a few hours after disclosure.
    • Downstream patch lag: on release day, SUSE and Fedora updates were still in testing, and Debian unstable still shipped the vulnerable 8.4.26. Shared-hosting customers depend on their provider to patch.
    • Cloudflare extended its WAF rules for this issue to every plan, including free, before the patch was public.

    Remediation

    • Upgrade PHP to a patched version immediately. Check exposure with the Censys PHP2Shell page and Aikido's checker at php2shell.aikido.io.
    • Inventory every PHP runtime, including those inside container base images, CI images, hosting panels and vendor software.
    • Aikido offers backported fixed images (PHP 5.5, 5.6, 7.x and 8.2 through 8.5) via its public ECR, so teams can patch in place without a major PHP upgrade.
    • Shared-hosting users should press their provider for patches. Use lock files and upgrade as CVEs appear, rather than auto-upgrading everything.
    • Plan for urgent overnight patch cycles and live incident alerting.
12. thehackernews.com ↗ · pub. 28/10/2026 13:02 · coletado 28/10 14:00

    AI-assisted China-nexus actor chains PHP2Shell with Fragnesia to root 25 firewalls and breach a U.S. government-affiliated network

    The article adds detail on the Dream-reported firewall intrusion: a custom non-public exploit build abusing session.upload_progress on the appweb server (PHP 8.0.30), evidence of AI-assisted tooling (Claude Code, FOFA and aiscan API keys with DeepSeek and Kimi, about 40 scripts), funnel numbers (19,000 → about 5,000 → 240 targets), the status of the remaining 22 rooted firewalls and the tunnel, vendor notification, and an underground forum view that PHP2Shell is hard to weaponize.

    ler a análise desta fonte ocultar

    The article adds detail on the Dream-reported firewall intrusion: a custom non-public exploit build abusing session.upload_progress on the appweb server (PHP 8.0.30), evidence of AI-assisted tooling (Claude Code, FOFA and aiscan API keys with DeepSeek and Kimi, about 40 scripts), funnel numbers (19,000 → about 5,000 → 240 targets), the status of the remaining 22 rooted firewalls and the tunnel, vendor notification, and an underground forum view that PHP2Shell is hard to weaponize.

    Dream disclosed an apparently AI-assisted intrusion, attributed to a suspected China-nexus actor, that chained the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with the Fragnesia Linux kernel local privilege escalation (CVE-2026-46300, CVSS 7.8). The activity, observed around October 23-25, 2026, rooted 25 internet-facing firewall servers in the U.S., Japan, Taiwan and South Korea, including three systems in a U.S. government-affiliated environment. From there the attacker went after the victim's Active Directory: it decrypted the LDAP service account password, enumerated users and ran password spraying. The vendor was not named but was notified by Dream, and the full extent of the compromise is unknown.

    Technical Details

    • The exploit is a custom, non-public build tailored to the firewall platform, not a copy of a public PHP2Shell PoC. It targets PHP's session.upload_progress mechanism on the firewall's appweb management server, which runs PHP 8.0.30 with a high memory limit that enables the memory corruption stages.
    • The attacker used FOFA to identify about 19,000 firewalls with exposed management interfaces. A custom version scanner got about 5,000 responses. Filtering to the four countries and to newer release branches running PHP 8.0.30 left 240 targets.
    • An automated batch runner exploited the chain, planted a PHP webshell in a publicly accessible directory, verified root and logged hostname and IP to a CSV file. It rooted 24 servers, and one more was rooted in a dedicated effort.
    • Two government-affiliated systems were compromised. The first crashed after being rooted on October 23 (18:14 UTC) and never came back. A second was rooted on October 24 (10:09 UTC) and used to set up a reverse SSH tunnel into the internal network. At 11:35 UTC a third, an internal firewall management server reachable only through the tunnel, was rooted with the same method.
    • Post-exploitation included decrypting the LDAP service account password, enumerating users, spraying organization-themed passwords and attempting to create backdoor AD accounts. It is unclear whether valid credentials were obtained or backdoor accounts created.
    • AI links: Anthropic's Claude Code was installed in the attack infrastructure, along with API keys for FOFA and the AI-powered offensive platform aiscan configured with DeepSeek and Kimi LLMs. The code structure, commenting style and consistency across nearly 40 scripts also suggest AI-assisted development.
    • Dream says the focus on the U.S., Japan, Taiwan and South Korea points to potential nation-state activity. The 22 other rooted firewalls remain parked with active webshells, the tunnel into the U.S. organization is likely still running, and the attacker retains 19,000 fingerprinted targets.
    • A forum user (c0d3x on XSS, via Flare) called PHP2Shell "unexploitable" in practice because it needs build-specific offsets from libphp.so. Limited in-the-wild exploitation has been seen overall.

    Remediation

    The article gives no specific remediation. Dream's findings underline the risk of exposed management interfaces: restrict them from the internet, patch PHP and the kernel, and hunt for webshells, reverse SSH tunnels and anomalous AD activity (LDAP queries, password spraying, new accounts).

13. bleepingcomputer.com ↗ · pub. 28/10/2026 10:50 · coletado 28/10 12:00

    PHP2Shell: Two PHP RCE Flaws Exploited Before Patch, CISA KEV Listed; Sponsored Piece Urges Identity Blast-Radius Controls

    ler a análise desta fonte ocultar

    Sponsored commentary by Token Security recaps PHP2Shell, two remote code execution vulnerabilities present in PHP since 2012. Researchers at Calif and Wiz found them in August using OpenAI and Google models and disclosed them jointly with OpenAI. Amazon saw an exploitation attempt on October 17, four days before disclosure. PHP shipped the patch on October 21, and watchTowr observed in-the-wild attempts the same day. CISA added both flaws to the KEV catalog on October 26. The article argues that, since remediation cannot keep pace with exploitation, defenders should reduce blast radius by governing non-human and AI agent identities rather than relying on CVSS-driven patching alone.

    Technical Details

    • The two flaws date to 2012. The article gives no CVE identifiers.
    • A shell on a PHP server exposes whatever the server can read, including environment variables and cloud keys in config files. PHP2Shell can also leak worker memory, including passwords, tokens and API keys.
    • Cloudflare observed attack traffic escalating rapidly after disclosure.
    • PHP ships inside appliances and hosting control panels that customers cannot patch themselves. PHP 8.1 and older received no official builds.
    • As of October 27, Censys counted 32.5 million internet-facing PHP services running potentially vulnerable versions, plus more than 60 million that do not report a version.
    • Remediation benchmarks cited: Verizon 2026 DBIR median time-to-fix for known exploited vulnerabilities is 43 days. Qualys reports a mean of 21.2 days, with 63% of critical vulnerabilities still open after a week.
    • The article cites the LiteLLM incident as an example of identity-based lateral movement. A master key exposed in a public repository was used to retrieve an unscoped GitHub organization-owner token. The attackers then stole two more maintainer tokens, subverted the release workflow and published credential-stealing artifacts.

    Remediation

    • Install the updated PHP release on supported branches. Some governments and companies took sites offline while waiting for the fix.
    • Inventory every AI agent and non-human identity, and secure those with the widest reach first.
    • Assign owners, scope access to purpose and intent, remove dormant credentials and continuously govern the identity lifecycle.
14. securityweek.com ↗ · pub. 28/10/2026 09:00 · coletado 28/10 10:00

    China-nexus actor chains PHP2Shell and Fragnesia to root firewalls, deploy webshells and breach a US government-affiliated network

    Dream reports that a China-nexus actor chained PHP2Shell with the Linux kernel flaw Fragnesia (CVE-2026-46300) to root firewalls on October 23-24. It selected targets via FOFA (19,000 firewalls, 240 candidates, 25 exploited, 24 webshells) and compromised a US government-affiliated environment, including a firewall management server, LDAP credentials and attempted Active Directory backdoor accounts. This adds a post-exploitation scenario, a new CVE and a nation-state attribution assessment (not a named actor).

    ler a análise desta fonte ocultar

    Dream reports that a China-nexus actor chained PHP2Shell with the Linux kernel flaw Fragnesia (CVE-2026-46300) to root firewalls on October 23-24. It selected targets via FOFA (19,000 firewalls, 240 candidates, 25 exploited, 24 webshells) and compromised a US government-affiliated environment, including a firewall management server, LDAP credentials and attempted Active Directory backdoor accounts. This adds a post-exploitation scenario, a new CVE and a nation-state attribution assessment (not a named actor).

    A China-linked threat actor has been exploiting the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) to gain root access to internet-facing firewalls and drop PHP webshells for persistent access, according to Dream. The actor chained the PHP exploit with Fragnesia (CVE-2026-46300), a Linux kernel privilege escalation bug. Dream has not named a specific threat actor but assesses the activity as a Chinese-nexus operation. In the observed intrusions the actor progressed furthest inside a US government-affiliated environment, where it reached an internal firewall management server and gained control over the configurations and credentials of every firewall the organization managed.

    Technical Details

    • The actor used the Chinese internet asset search engine FOFA to identify about 19,000 internet-facing firewalls from a single (unnamed) vendor. It then filtered for servers in the US, Japan, Taiwan and South Korea, and for newer PHP releases, leaving about 240 potential targets.
    • An automated tool ran the full PHP2Shell-Fragnesia chain against 25 firewalls on October 23-24, dropping a PHP root webshell on 24 devices. No post-exploitation activity was seen on 22 of them.
    • On two servers in a US government-affiliated environment, the first rooted firewall crashed after exploitation on October 23. The actor probed it with 240 automated requests over two hours, waiting for it to recover. A second wave on October 24 succeeded against the second firewall, whose certificate data linked it to the target organization.
    • The actor deployed a reverse SSH tunnel for persistence and used it to run the same chain against an internal firewall management server, gaining access to the configurations, credentials and settings of all managed firewalls.
    • From the management server the actor accessed and decrypted the LDAP service account password, enumerated domain users and groups, ran password spraying and attempted to create Active Directory backdoor accounts.
    • Dream bases the nation-state assessment on the targeting of the US, Japan, Taiwan and South Korea. It has not attributed the activity to a named actor.

    Remediation

    • Patch PHP to the fixed releases and patch the Linux kernel against CVE-2026-46300.
    • Review internet-facing firewalls and management servers for PHP webshells and unexpected reverse SSH tunnels.
    • Rotate LDAP service account and firewall credentials, and audit Active Directory for unauthorized accounts and password spraying activity.
15. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01

    CERT-FR bulletin: PoCs and exploitation attempts for PHP flaws CVE-2026-109618 and CVE-2026-109619 in specific deployments

    ler a análise desta fonte ocultar

    CERT-FR weekly bulletin CERTFR-2026-ACT-045 (week 43) updates its alert on multiple vulnerabilities in PHP. On 26 October 2026, CERT-FR became aware of proof-of-concept code and exploitation attempts for CVE-2026-109618 and CVE-2026-109619 against specific PHP deployments. These are the two critical flaws PHP disclosed on 20 October, with security fixes available from the vendor since 21 October. On 23 October PHP also published an advisory for a new remote code execution flaw, CVE-2026-115560, whose exploitation is considered unlikely and which is to be fixed in a future update. CERT-FR urges vigilance, as PHP is embedded in many products.

    Technical Details

    • CVE-2026-109618 and CVE-2026-109619: the two critical flaws announced by PHP on 20 October; PoCs and exploitation attempts reported on 26 October for specific deployments. The article does not specify the deployments or the vulnerability types.
    • CVE-2026-115560: remote code execution, disclosed 23 October; exploitation deemed unlikely by the vendor; no fix yet.
    • References: CERT-FR alert CERTFR-2026-ALE-014 and advisory CERTFR-2026-AVI-1359 (21 October 2026); PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

    Remediation

    • Apply the PHP security fixes released on 21 October 2026 and check the vendor advisories.
    • Inventory products embedding PHP, since the language is used in many products.
    • Track the future PHP update that will fix CVE-2026-115560.
16. theregister.com ↗ · pub. 27/10/2026 11:45 · coletado 27/10 13:00

    CISA confirms PHP2Shell exploitation as researchers record successful shell executions on honeypots

    The Register adds Delft University's telemetry (over 50,000 exploit requests from 600+ IPs in 70 countries, 171 sending exploit code or droppers), details of Karimi's honeypot results (35 shell executions, two source IPs, follow-on PHP/curl/wget callouts with no malware downloaded, no evidence for CVE-2026-109619), AWS's October 17 first sighting, and the retractions by Sophos and Palo Alto Networks. It also notes CISA has not disclosed victims.

    ler a análise desta fonte ocultar

    The Register adds Delft University's telemetry (over 50,000 exploit requests from 600+ IPs in 70 countries, 171 sending exploit code or droppers), details of Karimi's honeypot results (35 shell executions, two source IPs, follow-on PHP/curl/wget callouts with no malware downloaded, no evidence for CVE-2026-109619), AWS's October 17 first sighting, and the retractions by Sophos and Palo Alto Networks. It also notes CISA has not disclosed victims.

    CISA added CVE-2026-109618 and CVE-2026-109619, the two critical PHP2Shell flaws in PHP, to its Known Exploited Vulnerabilities (KEV) catalog on Monday. Federal civilian agencies must remediate by October 29. Last week the agency had warned of the danger but had not observed successful exploitation. Both bugs are rated CVSS 9.2 and allow unauthenticated code execution. Patches shipped on October 21, but AWS saw exploitation attempts from October 17. Researchers now report working shells, though CISA has not disclosed victims or how many production systems were breached.

    Technical Details

    • On October 24, Adel Karimi (Perplexity) recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve RCE.
    • The attackers then tried to contact external servers using PHP, curl and wget, but no additional malware was successfully downloaded.
    • Karimi's findings match exploitation of CVE-2026-109618, with no evidence that CVE-2026-109619 was involved. The honeypots used a favorable single-worker configuration, so results may not reflect reliability against production servers.
    • Delft University's Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries. Of these, 171 addresses went beyond probing and sent exploit code or malware droppers.
    • Earlier success claims were walked back: Sophos concluded its observed activity was scanning and failed attempts, and Palo Alto Networks withdrew claims linking the flaws to an intrusion at a European government agency.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the release branch.
    • Systems on unsupported versions need an upgrade or vendor-supported fixes.
    • Systems that cannot be secured should be taken offline until the risk is addressed.
    • CISA urges non-federal organizations to prioritize the fixes, although the deadline does not apply to them.
17. wiz.io ↗ · pub. 27/10/2026 10:21 · coletado 27/10 11:01

    Wiz: Limited PHP2Shell exploitation attempts seen; exploit chain fails outside tuned configs, exposure down 67%

    Wiz Research reports a limited number of exploitation attempts in its telemetry and no public PoC for general end-to-end exploitation. Captured attempts used an open-source kit whose chain failed on its honeypots at the request-size limit or the address-leak stage, plus PHP2Shell-branded tools that actually relied on session poisoning and an unrelated LFI. Wiz also records a ~67% drop in vulnerable exposed machines and ~47.9% fewer affected organizations, and links CISA's KEV listing to successful exploitation of Adel Karimi's honeypot.

    ler a análise desta fonte ocultar

    Wiz Research reports a limited number of exploitation attempts in its telemetry and no public PoC for general end-to-end exploitation. Captured attempts used an open-source kit whose chain failed on its honeypots at the request-size limit or the address-leak stage, plus PHP2Shell-branded tools that actually relied on session poisoning and an unrelated LFI. Wiz also records a ~67% drop in vulnerable exposed machines and ~47.9% fewer affected organizations, and links CISA's KEV listing to successful exploitation of Adel Karimi's honeypot.

    Wiz Research reports a limited number of PHP2Shell exploitation attempts (CVE-2026-109618, CVE-2026-109619) in its telemetry and honeypots since the October 21, 2026 disclosure. It found no public PoC for complete, general end-to-end exploitation against arbitrary targets, though partners have privately disclosed exploits that work against a variety of targets. Observed activity was either an open-source exploit kit whose chain failed on Wiz honeypots, or PHP2Shell-branded tools that actually used session poisoning plus a separate LFI. Wiz also records about a 67% drop in daily distinct vulnerable Internet-exposed machines and about a 47.9% drop in affected organizations. It still assesses PHP2Shell as a short- and long-term risk and urges patching or other remediation.

    Technical Details

    • Kit variants: Wiz saw two variants of an open-source exploit kit. The older "legacy" chain (archive/legacy-8m/exploit.py) sent a ~12 MB multipart body with 1,005 parts. It failed on the 8 MB post_max_size limit. The newer chain (pure/mk_a1.py, pure/mk_leak_b.py) was seen in most attempts.
    • Newer chain: Stage A1 is a chunked multipart request with a null-byte PHPSESSID, 860 empty file parts with deeply nested array names and PHP_SESSION_UPLOAD_PROGRESS. It reliably produced HTTP 500 and memory exhaustion. Stage B1, which should leak heap and libphp addresses via the PHPSESSID cookie, failed in every captured run. No source sent the final exploit stage.
    • Worker pinning: The chain needs consecutive requests to hit the same Apache child. The kit opens stalled connections (one address opened 399 alongside 400 GETs) to occupy other workers.
    • Why it failed: B1 was calculated for the official php:8.4.26-apache image with a 128 MB limit. Wiz's Roundcube honeypot ran a different build with extra extensions and a 64 MB limit. Latency and timeouts also broke the chain over the internet.
    • Branded but unrelated tools: A Go port of "Chain A" from WoYinDao/CVE-2026-109618-CVSS-9.2-Critical used upload-progress session poisoning and an LFI sink (lfi_sink.php) that only exists in the PoC's lab. Without an equivalent LFI it cannot execute code.
    • Confirmed compromise: Adel Karimi's public report and honeypots give the strongest public evidence of end-to-end exploitation. Those targets were a favorable single-worker Apache mod_php configuration, so they do not establish reliability elsewhere. Scanners 15.204.59[.]70 and 162.35.99[.]94 successfully exploited his honeypot, likely contributing to CISA adding PHP2Shell to the KEV list.
    • Remediation trend: The share of vulnerable exposed machines running PHP 7.3 or earlier (no official backports) fell from 8.3% to 5.7% in five days. PHP is used by 65% of organizations in Wiz's dataset.

    Remediation

    Apply the PHP security updates, or mitigate by upgrading, retiring affected hosts or restricting internet access. Wiz expects attackers with the necessary expertise to overcome the reliability barriers over time.

18. blog.cloudflare.com ↗ · pub. 27/10/2026 10:00 · coletado 27/10 11:00

    Cloudflare launches PHP CTF to test WAF rules against PHP2Shell RCE flaws CVE-2026-109618 and CVE-2026-109619

    Cloudflare (blog.cloudflare.com, October 27) reports it shipped WAF rules, client updates and a new full transaction detection feature on all plans, including Free, and launched a HackerOne-based PHP CTF against a deliberately vulnerable PHP 8.5.11 mod_php instance behind its WAF to find bypasses for CVE-2026-109618 and CVE-2026-109619. It reiterates that a WAF does not replace patching.

    ler a análise desta fonte ocultar

    Cloudflare (blog.cloudflare.com, October 27) reports it shipped WAF rules, client updates and a new full transaction detection feature on all plans, including Free, and launched a HackerOne-based PHP CTF against a deliberately vulnerable PHP 8.5.11 mod_php instance behind its WAF to find bypasses for CVE-2026-109618 and CVE-2026-109619. It reiterates that a WAF does not replace patching.

    Cloudflare announced a limited-time PHP Capture the Flag challenge, run through its HackerOne Bug Bounty program, to test its WAF protections against the php2shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. During the incident Cloudflare shipped client updates, new WAF rules blocking exploitation of the PHP flaws and a new feature called full transaction detection, available on all plans including Free. Researchers must bypass the WAF, obtain RCE in a sandboxed PHP instance and recover the contents of /flag. Cloudflare stresses that the WAF is not a substitute for patching PHP. The article also mentions, as a separate event, the compromise of eight eMudhra intermediate certificates the same week.

    Technical Details

    • Target: stock PHP 8.5.11 with standard extensions, Apache 2 (mod_php) and an empty index.php, inside a Cloudflare Container, behind the default WAF rules for the two CVEs.
    • The sandbox and the /flag file reset every few minutes.
    • Testing is authorized only against the WAF-protected /php/* endpoints of the challenge host, POST only. Hosted at php-rce.cloudflare.app.
    • Eligible reports need attacker-controlled code or command execution through an authorized POST, flag recovery verified in the UI, and a private HackerOne report with the full payload, request sequence and WAF bypass explanation. Awards require a materially distinct bypass; file disclosure without RCE, partial chains, local-only exploits and rediscovery of the known PHP flaws are ineligible.
    • Cloudflare records request payloads and metadata of attempts.

    Remediation

    • Apply the latest PHP security updates; WAF response blocking cannot undo actions already performed at the origin.
    • Cloudflare customers on all plans have the new WAF rules and full transaction detection available.
19. securityaffairs.com ↗ · pub. 27/10/2026 07:39 · coletado 27/10 09:00

    CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to KEV as North Korea-linked group scans 216 hosts

    Cyfirma attributes targeting of PHP2Shell to a North Korea-linked group that coordinates over a private I2P channel and reported 216 potentially vulnerable hosts on October 24, scanned from 21 compromised nodes with deliberately low-volume, rotating activity. Cloudflare's exploitation-attempt volumes (millions by October 22) and the PHP 5.4 (2012) origin of the vulnerable code are also new.

    ler a análise desta fonte ocultar

    Cyfirma attributes targeting of PHP2Shell to a North Korea-linked group that coordinates over a private I2P channel and reported 216 potentially vulnerable hosts on October 24, scanned from 21 compromised nodes with deliberately low-volume, rotating activity. Cloudflare's exploitation-attempt volumes (millions by October 22) and the PHP 5.4 (2012) origin of the vulnerable code are also new.

    CISA added the PHP2Shell vulnerabilities CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state) to its Known Exploited Vulnerabilities (KEV) catalog. Both are rated CVSS 9.2 and allow unauthenticated remote code execution through crafted HTTP requests. Cloudflare reported tens of thousands of exploitation attempts within 45 minutes of disclosure and millions by October 22. Cyfirma says a North Korea-linked group is coordinating through a private I2P channel and flagged 216 potentially unpatched hosts on October 24, checking them from 21 compromised scan nodes. Federal agencies must remediate by October 29, 2026.

    Technical Details

    • The flaws reside in the PHP engine itself, not in individual applications, and the vulnerable code dates back to PHP 5.4 (2012). All PHP versions handling web requests are affected.
    • PHP released emergency patches on October 21.
    • Cyfirma observed two handles active since March 2026 in a closed I2P channel, with shared staging infrastructure. The same scan node addresses were seen attempting web-shell tooling and upload-progress session-poisoning.
    • Scanning is deliberately slow: low volume, rotating machines, and any node that meets filtering or rate limiting is retired and never reused. Rate-based alerting will probably not detect it.
    • At the time of capture, the operators had checked about one-third of the targets.

    Remediation

    • Apply the October 21 PHP patches immediately.
    • Federal agencies must fix the flaws by October 29, 2026 under BOD 22-01. Private organizations are advised to review the KEV catalog.
    • Do not rely on rate-based detection; hunt for web-shell and upload-progress session-poisoning activity.
20. bleepingcomputer.com ↗ · pub. 27/10/2026 05:20 · coletado 27/10 07:00

    CISA adds PHP2Shell RCE flaws CVE-2026-109618 and CVE-2026-109619 to KEV as exploitation is confirmed

    Adds that Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack saw unsuccessful exploitation attempts before disclosure, and that Amazon says attacks began four days before the patches. Also adds the leaked details and non-functional PoCs, the unpatched RCE CVE-2026-115560 with mitigation only, BOD 26-04, and VirusTotal exposure estimates that differ from the Censys figure.

    ler a análise desta fonte ocultar

    Adds that Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack saw unsuccessful exploitation attempts before disclosure, and that Amazon says attacks began four days before the patches. Also adds the leaked details and non-functional PoCs, the unpatched RCE CVE-2026-115560 with mitigation only, BOD 26-04, and VirusTotal exposure estimates that differ from the Censys figure.

    CISA added the two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog. Unprivileged attackers can exploit them in high-complexity attacks to achieve remote code execution on unpatched PHP systems. The PHP security team released patches on October 21. Details leaked and non-functional PoCs appeared before the patches, and several vendors saw unsuccessful exploitation attempts. Adel Karimi of Perplexity later confirmed in-the-wild RCE against a honeypot. Federal civilian agencies must remediate by Thursday under BOD 26-04.

    Technical Details

    • Multiple firms (Cloudflare, Amazon, Hadrian, watchTowr, Previdian, Patchstack) detected widespread exploitation attempts before public disclosure and judged them unsuccessful. Amazon Threat Intelligence said attackers began targeting the flaws four days before the patches.
    • Karimi's honeypots recorded RCE against an Apache mod_php installation running PHP 8.4.26.
    • On Friday the PHP security team shared mitigation for a further RCE flaw, CVE-2026-115560, which has no patch and is exploitable with "an unusual combination of configuration and application code".
    • VirusTotal estimates PHP powers about 70% of websites, with over 5.1 million PHP hosts exposed and about 3.8 million with at least one open port.

    Remediation

    • Install the PHP security updates released October 21.
    • FCEB agencies must patch by Thursday per BOD 26-04. CISA urges all organizations to prioritize KEV vulnerabilities.
    • Apply the vendor mitigation for CVE-2026-115560 until a patch is available.
21. thehackernews.com ↗ · pub. 27/10/2026 01:37 · coletado 27/10 03:00

    CISA adds PHP2Shell RCE flaws CVE-2026-109618 and CVE-2026-109619 to KEV after honeypot exploitation

    ler a análise desta fonte ocultar

    CISA added two recently patched PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on Monday, confirming active exploitation. Both are rated CVSS 9.2 and allow unauthenticated remote code execution on affected PHP deployments. The addition followed confirmation by Adel Karimi (Perplexity) of successful RCE against honeypot systems on October 24, 2026. Censys estimates more than 32.51 million PHP services still run an affected version. Federal agencies must apply fixes by October 29, 2026.

    Technical Details

    • CVE-2026-109618: out-of-memory corruption flaw enabling unauthenticated RCE.
    • CVE-2026-109619: stale internal request-state flaw enabling unauthenticated RCE.
    • Karimi described the result as confirmed RCE with usable memory disclosure: the response delivered an 800 KiB decoded cookie dump, and a function address derived from it using the public exploit's offsets appeared in the later execution payload.
    • Karimi cautions that the evidence covers a deliberately favorable single-worker mod_php profile and does not measure exploit reliability on other worker counts, PHP builds or applications.
    • Separately, the PHP Foundation released Windows builds on October 26 to fix CVE-2026-111497 (also known as Broccoli2Shell, HTTP2Shell and Node2Shell), an out-of-bounds write in the Brotli decoder that could lead to privilege escalation and unauthenticated RCE. It affects Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0, and is patched in 1.0.10, 1.1.1 and 1.2.1 and in downstream projects including Node.js, Bun, Envoy Proxy, Istio, .NET and Python.
    • In PHP Windows builds, the vulnerable decoder is reachable through the cURL extension when automatic HTTP response decompression is enabled. This is off by default in cURL, but applications and HTTP client libraries can enable it.

    Remediation

    • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (released October 21, 2026).
    • On Windows, use builds 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1 to address the Brotli flaw CVE-2026-111497.
    • US federal agencies must remediate by October 29, 2026.
22. hacktron.ai ↗ · pub. 25/10/2026 21:00 · coletado 26/10 16:00

    Hacktron benchmark: only frontier models ported the php2shell exploit to a hardened MediaWiki target; open models failed

    Hacktron's benchmark shows that only frontier models (Claude Mythos 5.1, GPT-5.6 Sol) could port the php2shell exploit to a different target (MediaWiki 1.44.2 behind Caddy), while open models failed, and the author suggests this gap may help explain the limited mass exploitation. It also states that as of October 26 neither CVE is in CISA's KEV catalog and there is no convincing public evidence of exploitation at scale, while Perplexity's Adel Karimi documented successful exploitation against honeypots.

    ler a análise desta fonte ocultar

    Hacktron's benchmark shows that only frontier models (Claude Mythos 5.1, GPT-5.6 Sol) could port the php2shell exploit to a different target (MediaWiki 1.44.2 behind Caddy), while open models failed, and the author suggests this gap may help explain the limited mass exploitation. It also states that as of October 26 neither CVE is in CISA's KEV catalog and there is no convincing public evidence of exploitation at scale, while Perplexity's Adel Karimi documented successful exploitation against honeypots.

    Hacktron researcher Mohan Pedhapati tested five open and frontier AI models on porting a working php2shell exploit (CVE-2026-109618 and CVE-2026-109619, found by Ryan Austin of Calif.io) to a production-like MediaWiki deployment behind Caddy. Claude Mythos 5.1 retrieved the flag in 3h 28m and GPT-5.6 Sol in 6h 10m. Among the open models, GLM 5.3 got local code execution but could not exploit the remote target after 20+ hours, while Kimi K3.1 Pro and DeepSeek V4.1 Flash never reached the memory leak that opens the chain. The author argues the exploitability gap between frontier and open models, together with the difficulty of monetizing intrusions, may help explain why mass exploitation has not materialized. As of October 26 neither CVE is in CISA's KEV catalog and there is no convincing public evidence of exploitation at scale, though Adel Karimi of Perplexity documented successful exploitation against his honeypots.

    Technical Details

    • Each model received the same working HTTP-only exploit built for Apache prefork with mod_php. The target was MediaWiki 1.44.2 on PHP 8.1.33 (Apache prefork, mod_php) behind Caddy 2.10.2 with compression enabled, isolated and reachable only over HTTP.
    • Porting requires fingerprinting the PHP version, build and SAPI; understanding the reverse proxy; finding memory limits remotely; getting consecutive requests onto the same worker; heap grooming to reclaim the dangling session state; leaking memory to resolve PHP and library base addresses; and building a payload whose destructor path reaches zend_eval_string. It is a blind, remote memory corruption, which is why many public PoCs do not work or do not port cleanly.
    • The stealmybitcoin.com challenge ran PHP's CLI development server (php -S) behind nginx and served only a static index.html for roughly the first 10 hours, so the vulnerable multipart parser was unreachable. Once a PHP endpoint was exposed, other players' DoS made requests barely go through. Mythos obtained leaks, identified the build as php:8.4.26-fpm-alpine from the leaked pointer's page offset, and had a full local chain working, but workers kept crashing, so the chain never landed remotely. The challenge was won by @killa, whose recovered key did not match the advertised Bitcoin address.
    • The author's hypotheses for the lack of mass exploitation: stolen data is hard to monetize and crime carries risk, whereas crypto and LLM API tokens convert directly to money; and recent high-profile exploits came from vetted researchers with frontier access (OpenAI's Daybreak program), while open models need heavy hand-holding on hard bugs. Open models are strong on common web bugs, and the gap may narrow.

    Remediation

    The article gives no new remediation guidance; it stresses that a patch existing does not mean systems are patched, since legacy dependencies and downtime constraints leave systems vulnerable for months or years.

23. cert.cyber.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 26/10 14:01

    CERT-FR updates PHP alert: exploitation attempts and PoCs for CVE-2026-109618/109619, third RCE CVE-2026-115560 unpatched

    CERT-FR, a French government source, confirms that it observes exploitation attempts against CVE-2026-109618 and CVE-2026-109619 and has known PoCs since 22 October. It also provides unqualified workarounds: disable session upload progress (which only mitigates CVE-2026-109619) and block or monitor multipart Content-Type requests via a WAF. It recommends isolating affected equipment and migrating to a maintained PHP version, and it repeats that CVE-2026-115560 will only be fixed in the next regular update cycle.

    ler a análise desta fonte ocultar

    CERT-FR, a French government source, confirms that it observes exploitation attempts against CVE-2026-109618 and CVE-2026-109619 and has known PoCs since 22 October. It also provides unqualified workarounds: disable session upload progress (which only mitigates CVE-2026-109619) and block or monitor multipart Content-Type requests via a WAF. It recommends isolating affected equipment and migrating to a maintained PHP version, and it repeats that CVE-2026-115560 will only be fixed in the next regular update cycle.

    CERT-FR updated its alert CERTFR-2026-ALE-014 on PHP remote code execution flaws on 26 October 2026. It reports observed exploitation attempts against CVE-2026-109618 and CVE-2026-109619 targeting specific PHP deployments, and says it has known proofs of concept since 22 October. PHP published fixes on 21 October for 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while all 8.0.x and 8.1.x versions remain affected and unsupported. On 23 October PHP disclosed a third RCE, CVE-2026-115560. PHP judges its exploitation conditions unlikely, so the fix will wait for the next regular release cycle. CERT-FR urges vigilance because PHP is embedded in many products.

    Technical Details

    • Affected: PHP 8.0.x and 8.1.x (all versions), 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27 and 8.5.x before 8.5.12.
    • CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution (RCE), per PHP.
    • CVE-2026-115560 also allows RCE, but only with a combination of configuration options and application code that PHP considers unlikely.
    • The CERT-FR bulletin references the NCSC-NL php2shell GitHub repository and the CERT-EU advisory.

    Remediation

    • Isolate affected equipment, then migrate to a maintained PHP version with the latest security fixes.
    • Interim workarounds, not qualified by CERT-FR: set session.upload_progress.enabled = Off in php.ini, and for PHP-FPM also php_admin_flag[session.upload_progress.enabled] = off. This disables upload-progress and only reduces the attack surface for CVE-2026-109619.
    • Block, or at least closely monitor, HTTP requests whose Content-Type is multipart, for example at a Web Application Firewall.
    • Apply vendor patches to third-party products embedding PHP as soon as they are available.
24. theregister.com ↗ · pub. 26/10/2026 05:00 · coletado 26/10 14:00

    PHP2Shell: critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 in PHP core under early exploitation

    ler a análise desta fonte ocultar

    Two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), allow an unauthenticated attacker to execute code on a server through a crafted HTTP request. Both score CVSS v4.0 9.2 and affect every earlier release. Details leaked before the planned embargo, and the PHP security team shipped fixes about a day after announcing them. watchTowr reports exploitation in its honeypot network as of October 21, and Cloudflare is reportedly seeing early attacks (relayed by Tenable). Patchstack telemetry shows mostly probing. Neither CVE is in CISA's KEV catalog and no public IOCs have been released. The article is partner content from Tanium, which promotes its own discovery tooling alongside the technical guidance.

    Technical Details

    • Both bugs are in PHP core, not in a framework or plugin, so they affect anything serving web requests through PHP: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php as the highest risk. No login is needed, only HTTP access to a PHP endpoint.
    • VulnCheck reproduced both flaws. Code execution works on ARM64 and on x86 systems with ASLR disabled. Dozens of public PoCs exist but very few work, and none bypass ASLR on x86-64. Red Hat rates RCE as hard in practice on default PHP-FPM deployments.
    • Fake PoC repositories for headline CVEs often carry malware.
    • Censys counts more than 13 million internet-facing assets running potentially affected PHP versions.
    • Hunting: look for unexplained worker crashes in web server and PHP-FPM logs, and for unusual or malformed multipart uploads.
    • Discovery is difficult because PHP is often bundled on Windows (XAMPP, WampServer, Laragon, zip extracts), shipped inside applications, baked into containers, or installed through Homebrew. PHP binaries embed their version string, so it can be read without executing them.

    Remediation

    • Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM and web server workers.
    • PHP published minimal source backports for 7.4, 8.0 and 8.1, but there are no official releases for those branches. Treat them as a stopgap and migrate off end-of-life versions.
    • Inventory all PHP installs and prioritize internet-facing servers, mod_php setups and ARM64 hosts.
    • If patching is not yet possible, isolate internet-facing PHP apps (as CERT-EU advises) and apply WAF/IDS rules; Cloudflare and VulnCheck have shipped rules for the known vectors.
    • Setting session.upload_progress.enabled=0 in php.ini, an FPM pool or server config (followed by a worker restart) blocks one path for CVE-2026-109619 only and does not mitigate CVE-2026-109618.
    • Distro packages were still rolling out as of Oct 21, 16:30 UTC. The Remi repository would not ship updates that day, so use distro packages or build from source.
25. securityweek.com ↗ · pub. 26/10/2026 10:30 · coletado 26/10 12:00

    PHP2Shell: honeypots record 35 working shells via CVE-2026-109618 on mod_php, first confirmed in-the-wild RCE chain

    SecurityWeek adds detail on Adel Karimi's honeypot findings: 35 shells on three honeypots on October 24 (one IP produced 32), a four-stage request chain (memory exhaustion, memory leak, command execution), earlier results of 30 OOM errors and 11 crashes with no code execution, no second-stage payload, and Karimi's caveat that the result applies only to the single-worker mod_php profile. It also notes that CISA had not added the flaws to KEV as of the morning of October 26.

    ler a análise desta fonte ocultar

    SecurityWeek adds detail on Adel Karimi's honeypot findings: 35 shells on three honeypots on October 24 (one IP produced 32), a four-stage request chain (memory exhaustion, memory leak, command execution), earlier results of 30 OOM errors and 11 crashes with no code execution, no second-stage payload, and Karimi's caveat that the result applies only to the single-worker mod_php profile. It also notes that CISA had not added the flaws to KEV as of the morning of October 26.

    A Perplexity researcher, Adel Karimi, reported that attackers successfully exploited the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to run shell commands on his honeypots. On October 24 his sensors recorded 35 shells across three honeypots. The activity matched a public proof-of-concept (PoC) and is consistent with exploitation of CVE-2026-109618. Expel's Marcus Hutchins called it the highest-quality confirmation of in-the-wild PHP2Shell exploitation he has seen. As of the morning of October 26, CISA had not added the flaws to its KEV catalog and had said it had not observed successful exploitation.

    Technical Details

    • The honeypots serve ordinary PHP-backed pages on PHP 8.4.26 under Apache mod_php with a single worker. This is a deliberately favorable profile.
    • Karimi's first report covered just over 26 hours and logged 30 out-of-memory errors and 11 worker crashes, with no code execution.
    • On October 24, one IP address produced three shells on a single honeypot. Another produced 32 shells across all three.
    • The attackers used a four-stage chain of HTTP requests: some requests exhausted PHP memory, others leaked memory contents, and the last executed a shell command.
    • No second-stage payload download was observed.
    • Karimi cautioned that the evidence does not measure exploit reliability on other worker counts, PHP builds or applications.
    • Researchers had previously developed exploits capable of bypassing ASLR.

    Remediation

    PHP patched the flaws on October 21. Defenders should apply the fixed releases and monitor for PHP worker processes spawning shells.

26. securityweek.com ↗ · pub. 26/10/2026 11:52 · coletado 26/10 12:00

    Industrial vendors confirm PHP2Shell (CVE-2026-109618/109619) impact on OT products from Schneider, Siemens, ABB, Belden and others

    Industrial and OT vendors (Schneider Electric, Siemens, ABB/B&R, Belden, Johnson Controls, HMS Networks, Wibu-Systems) have confirmed that specific OT products are affected by PHP2Shell and published patches or mitigations, extending the known scope beyond web and IT stacks. Rockwell Automation and Moxa report no confirmed impact, and Hitachi Energy is still investigating.

    ler a análise desta fonte ocultar

    Industrial and OT vendors (Schneider Electric, Siemens, ABB/B&R, Belden, Johnson Controls, HMS Networks, Wibu-Systems) have confirmed that specific OT products are affected by PHP2Shell and published patches or mitigations, extending the known scope beyond web and IT stacks. Rockwell Automation and Moxa report no confirmed impact, and Hitachi Energy is still investigating.

    Industrial vendors including Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories on the impact of the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on their products. Several confirmed that industrial and OT products are affected, while others are still assessing exposure or found no impact. The critical PHP engine flaws allow unauthenticated remote code execution. PHP patched them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after details leaked ahead of disclosure. Exploitation attempts began on October 17, Cloudflare has reported millions of attempts, and the first confirmed attacks, against honeypots, were reported over the weekend.

    Technical Details

    • Schneider Electric: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS) and EcoStruxure Control Engineering are affected.
    • Siemens: Ruggedcom APE1808 devices running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are affected. CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter and Xpedition are confirmed unaffected.
    • ABB: MES deliveries that include DokuWiki are affected. Subsidiary B&R reports its APROL process control system is affected up to R 4.4-65.
    • Belden: all NetModule NRSW versions and macmon 6.x and 7.x are affected.
    • Johnson Controls: several Illustra lines (Flex4, Pro4, Gen5, Essentials Gen 4) and Visonic PowerManage are affected.
    • HMS Networks: Netbiter devices are affected; Talk2M and the Argos documentation server were patched, with no indicators of compromise found. Anybus is not affected.
    • Wibu-Systems: the CodeMeter License Central web interface and its PHP-based extensions are affected.
    • Rockwell Automation has confirmed no affected products so far, Moxa found none impacted, and Hitachi Energy is still investigating.

    Remediation

    • Schneider: Security Expert 1.48.4.0 is available from the Customer Care Center; ProLeiT support provides a LINEoptimize fix; Control Engineering has mitigations only.
    • Siemens: contact support for patch information and apply the Palo Alto Networks workarounds.
    • ABB: update the PHP packages on servers hosting DokuWiki. B&R APROL patches were expected October 26 and 29.
    • Johnson Controls: Illustra patches released; Visonic PowerManage fixed in 5.0.45.
    • Belden: no NetModule NRSW patch yet, so disable the web interface; a macmon 7.x patch is available and 6.x users should upgrade.
    • HMS: Netbiter firmware update released. Wibu-Systems: updates released.
27. industrialcyber.co ↗ · pub. 26/10/2026 07:07 · coletado 26/10 09:01

    PHP2Shell: global agencies urge patching of critical PHP RCE flaws as government sites go offline; Unit 42 reports AI-driven post-exploitation

    Adds the multinational government advisory picture: the Oct. 21 EU joint statement (ENISA, CERT-EU, Europol EC3, CSIRTs), CISA's SIGMA rule update, UK NCSC's OOM/memory-corruption description, ACSC's note that PHP 5 onward may be affected and that Australian government sites went offline, the Canadian Cyber Centre's CWE-416 classification, Palo Alto Networks' 22 million exposed-instance estimate, and the CRA reporting context. The article's statement that CISA has not observed successful exploitation conflicts with Unit 42's confirmed compromise.

    ler a análise desta fonte ocultar

    Adds the multinational government advisory picture: the Oct. 21 EU joint statement (ENISA, CERT-EU, Europol EC3, CSIRTs), CISA's SIGMA rule update, UK NCSC's OOM/memory-corruption description, ACSC's note that PHP 5 onward may be affected and that Australian government sites went offline, the Canadian Cyber Centre's CWE-416 classification, Palo Alto Networks' 22 million exposed-instance estimate, and the CRA reporting context. The article's statement that CISA has not observed successful exploitation conflicts with Unit 42's confirmed compromise.

    Global cybersecurity agencies are urging immediate patching of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), which allow unauthenticated remote code execution on web servers. A joint statement of ENISA, the European Commission, CERT-EU, Europol EC3 and national CSIRTs (Oct. 21), together with advisories from CISA, the UK NCSC, ASD's ACSC and the Canadian Cyber Centre, tells organizations to inventory PHP, prioritize internet-facing systems and patch. Australian, European and other government websites were taken offline as a precaution. Palo Alto Networks estimates more than 22 million exposed PHP instances, and Unit 42 reports attackers using agentic AI platforms for post-exploitation against a European government entity.

    Technical Details

    • Affected: all PHP installations serving web requests, including Apache mod_php (highest risk per PHP), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. ACSC believes all versions from PHP 5 onward may be affected.
    • The Canadian Cyber Centre describes the flaws as Use After Free (CWE-416). The UK NCSC says an attacker can trigger an out-of-memory (OOM) condition leading to memory corruption, which under certain conditions can be exploited for unauthenticated RCE. A PoC is reportedly available in open sources.
    • Unit 42: within two hours of initial exploitation of a European government entity, attackers accessed password hashes and MFA secrets, established an NTLM-relay tunnel into Active Directory and attempted Domain Admin privilege escalation, using agentic AI attack platforms.
    • CISA updated its alert with a SIGMA rule and advises monitoring for PHP worker processes launching shells or downloading tools.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Inventory all systems running PHP, including products that bundle it (see the NCSC-NL GitHub repository for affected third-party software).
    • Where patching is not immediately possible, or for PHP 8.1 and earlier, isolate or take systems offline. A WAF may offer partial protection.
    • Prioritize internet-facing systems and coordinate with hosting and service providers.
28. securityaffairs.com ↗ · pub. 26/10/2026 06:58 · coletado 26/10 07:00

    Suspected North Korean actors use PHP2Shell scans to target 216 potentially unpatched PHP hosts, Cyfirma reports

    securityaffairs.com relays more detail on the Cyfirma report than the case had. Cyfirma has monitored the I2P channel since October 22, and two handles have been active since March 2026. The operators scored 21 scan nodes and 216 hosts on October 24, and Cyfirma gives the campaign an imminence score of 78/100. They use a local AI model to rank public exploits, and Cyfirma says a non-state Korean-speaking crew would fit the same facts. The article also adds the 17 source and 15 staging address counts, detection and hunting guidance, and VulnCheck's x86-64 PHP 8.4.10-8.4.26 results. It corrects earlier coverage: the upload-progress field belongs to 109619 only, so disabling it does not mitigate 109618.

    ler a análise desta fonte ocultar

    securityaffairs.com relays more detail on the Cyfirma report than the case had. Cyfirma has monitored the I2P channel since October 22, and two handles have been active since March 2026. The operators scored 21 scan nodes and 216 hosts on October 24, and Cyfirma gives the campaign an imminence score of 78/100. They use a local AI model to rank public exploits, and Cyfirma says a non-state Korean-speaking crew would fit the same facts. The article also adds the 17 source and 15 staging address counts, detection and hunting guidance, and VulnCheck's x86-64 PHP 8.4.10-8.4.26 results. It corrects earlier coverage: the upload-progress field belongs to 109619 only, so disabling it does not mitigate 109618.

    Cyfirma reports a suspected North Korea-linked campaign scanning for hosts still vulnerable to PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Two operator handles, active since March 2026, coordinate in a private I2P channel that Cyfirma has monitored since October 22. On October 24 they reported 216 unpatched or partially mitigated hosts and named 21 compromised scan nodes, about one-third of which they had already checked. Cyfirma assesses with moderate confidence a link to the Lazarus family, but it has no shared malware or infrastructure and says a non-state Korean-speaking criminal crew would fit the same facts. It has high confidence in the campaign itself and scores its imminence 78/100, but it names no victims and has not confirmed large-scale compromise.

    Technical Details

    • Scanning is deliberately slow and low-volume. Nodes rotate, and any node that meets filtering or rate limiting is dropped and never reused, so rate-based alerts will probably stay quiet. The same scan addresses were seen attempting web-shell tooling and upload-progress session poisoning.
    • The operators dropped every host showing a fixed version or heavy filtering, so hosts still bannering older PHP are the ones they kept.
    • The group does not appear to develop new exploits. Members use a local AI model to rank public exploit repositories, then test results manually in a lab. Some public PoCs are fake and may carry malware.
    • Priority targets are government and banks, then logistics, ports, airports and aviation, manufacturing, and online transaction and trading platforms. Named countries are the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.
    • Apache mod_php (default settings, prefork) is the confirmed worst case for 109618, with full unauthenticated code execution. For 109619, PHP-FPM is validated through the upload-progress path. Reliable code execution is hard: the attacker must land a follow-up request on the same worker and shape heap data, otherwise the worker crashes. VulnCheck reports working code execution on x86-64 with ASLR against PHP 8.4.10 to 8.4.26, while ARM64 only leaks memory so far. Other demonstrated impacts are worker crashes, arbitrary file reads through OPcache and a leak of about 67 KB of process memory.
    • Correction: early coverage tied the session upload-progress field to 109618, but PHP's advisories place it under 109619 only. Disabling upload progress does not mitigate 109618.
    • Cyfirma provides Sigma, Splunk and YARA content (the YARA set is untested on real application code) and lists 21 scan-node addresses, 17 source addresses from October 23 and 15 staging addresses, all defanged. Some scan nodes are compromised hosts that may belong to victims.

    Remediation

    • Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1, 8.0 and 7.4 get only minimal backports, and PHP 5.4 to 7.3 have no fix, so migrate or isolate them. Confirm coverage with vendors that ship their own builds (cPanel EasyApache, CloudLinux, TuxCare, Plesk).
    • Restart every worker after patching, because a reload that keeps old workers alive leaves stale state in place. Isolate internet-facing hosts that cannot be patched within hours, starting with Apache mod_php.
    • If a host is suspected compromised, capture memory and logs before patching, since a restart destroys the CVE-2026-109619 state. Then rebuild from a trusted image and rotate every secret the PHP worker could reach.
    • Hunt back to October 17 over long time windows. The strongest signal is a PHP or web server process spawning something unusual. Also look for odd multipart POSTs to endpoints that take no uploads, bursts of worker crashes and memory errors, new PHP files in web roots, and new cron jobs, local users or SSH keys.
    • Interim limits, such as a low post_max_size and disabling session upload progress for 109619, do not replace patching.
29. bleepingcomputer.com ↗ · pub. 26/10/2026 06:19 · coletado 26/10 07:00

    PHP2Shell RCE flaws (CVE-2026-109618/109619) confirmed exploited in the wild against Apache mod_php honeypot

    Adel Karimi (Perplexity) reported honeypot evidence of confirmed RCE with memory disclosure against Apache mod_php on PHP 8.4.26, corroborated by Marcus Hutchins (Expel). This is the first high-quality confirmation of functional exploitation using the public exploit's offsets, and it contradicts the earlier assessments (Dataminr TRACE, PHP security team) that observed activity was limited to scanning and non-working exploits.

    ler a análise desta fonte ocultar

    Adel Karimi (Perplexity) reported honeypot evidence of confirmed RCE with memory disclosure against Apache mod_php on PHP 8.4.26, corroborated by Marcus Hutchins (Expel). This is the first high-quality confirmation of functional exploitation using the public exploit's offsets, and it contradicts the earlier assessments (Dataminr TRACE, PHP security team) that observed activity was limited to scanning and non-working exploits.

    Two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), have now been successfully exploited in the wild. Adel Karimi (detection and response lead at Perplexity) recorded confirmed RCE with usable memory disclosure on his honeypots, against an Apache mod_php installation running PHP 8.4.26. Marcus Hutchins (Expel) corroborated the finding and called it the highest-quality confirmation of in-the-wild PHP2Shell exploitation he has seen. Until then, per Dataminr TRACE, observed activity was limited to scanning, fingerprinting and non-working exploits, with no known compromises. The PHP security team patched the flaws on October 21, and on Friday it published mitigation guidance for a separate unpatched RCE, CVE-2026-115560.

    Technical Details

    • The honeypot response delivered an 800 KiB decoded cookie dump. A function address derived from that dump using the public exploit's offsets appeared in the subsequent execution payload.
    • The client acknowledged the full response, and the shell command ran about 1.6 ms after the final captured byte of the execution request.
    • Pre-patch exploitation attempts were reported by Cloudflare, Hadrian, watchTowr, Previdian, Patchstack and Amazon Threat Intelligence (four days before the patches), but all were flagged as unsuccessful.
    • CVE-2026-115560 is exploitable only on systems with an unusual combination of configuration and application code.
    • PHP is used by roughly 70% of websites. VirusTotal estimates more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one open port.

    Remediation

    • Install the PHP security updates released on October 21.
    • Until a patch for CVE-2026-115560 ships, set session.upload_progress.enabled=0.
30. gbhackers.com ↗ · pub. 26/10/2026 02:21 · coletado 26/10 03:00

    Public PoC for PHP2Shell RCE (CVE-2026-109618/109619) Used Against StealMyBitcoin Challenge on PHP 8.4.26

    ler a análise desta fonte ocultar

    A researcher using the GitHub handle KillaBoi published a working proof-of-concept exploit for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2, potentially unauthenticated RCE). The PoC chains memory exhaustion, address disclosure and command execution against PHP 8.4.26. The researcher says it was run successfully against the live Steal My Bitcoin challenge on October 25, 2026 and returned a WIF private key, which did not match the advertised Bitcoin address. The PoC is calibrated to a specific build, but its public release lowers the barrier for adapting it to other targets.

    Technical Details

    • The exploit abuses PHP's session upload-progress handling and memory management. A crafted multipart/form-data request makes PHP allocate far more memory than the request size.
    • Deeply nested form-field names exhaust the 128 MiB memory limit and leave stale session-related data in a reusable worker process. Follow-up requests leak memory addresses via PHPSESSID cookies.
    • Two address leaks (heap and code) defeat ASLR. The attacker then forges a PHP HashTable with a manipulated destructor callback, so cleanup invokes zif_system (the handler behind system()).
    • The PoC needs Python 3.11+ with no third-party dependencies. It targets Alpine PHP 8.4.26 with four CLI-server workers and uses hardcoded offsets that may not work on other builds.
    • In a Docker test, execution succeeded in 7 of 10 attempts. Failures were mainly due to worker-selection races and memory-layout differences.

    Remediation

    • Update PHP to 8.4.27, 8.3.36, 8.2.35 or 8.5.12, depending on the branch in use.
    • Monitor for unusual multipart requests, repeated PHP memory-exhaustion errors, abnormal session cookies, and unexpected commands spawned by PHP worker processes.
31. gbhackers.com ↗ · pub. 26/10/2026 02:31 · coletado 26/10 03:00

    Mass scanning with public PHP2Shell exploit scripts hits internet-facing PHP servers; Fastly logs ~250,000 requests from ~3,200 IPs

    Fastly telemetry quantifies the scanning (about 250,000 requests, 3,200 IPs, over 100 source IPs, more than two dozen tool names) and profiles the dominant kit (User-Agent php2shell-109618, boundary B7kQpoc618, raw-IP targeting). It also reports that some PHP2Shell detection rules actually matched React2Shell and a separate WordPress campaign, and Akatsuki Legion dates the first PHP2Shell-named scanner to 03:59 UTC on October 21. Sansec and Recorded Future reiterate that scanning does not equal successful exploitation.

    ler a análise desta fonte ocultar

    Fastly telemetry quantifies the scanning (about 250,000 requests, 3,200 IPs, over 100 source IPs, more than two dozen tool names) and profiles the dominant kit (User-Agent php2shell-109618, boundary B7kQpoc618, raw-IP targeting). It also reports that some PHP2Shell detection rules actually matched React2Shell and a separate WordPress campaign, and Akatsuki Legion dates the first PHP2Shell-named scanner to 03:59 UTC on October 21. Sansec and Recorded Future reiterate that scanning does not equal successful exploitation.

    Opportunistic actors are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts targeting CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Fastly recorded roughly 250,000 requests from PHP2Shell-named tools across about 3,200 public IPs through midday October 22, but the figures include defensive scanners and do not prove successful compromise. More than 100 source IPs used over two dozen tool names. Sansec and Recorded Future caution that most public PoCs do not work against default PHP installations, so scanning volume should not be equated with successful exploitation.

    Technical Details

    • Both flaws sit in the PHP engine and can enable unauthenticated RCE under specific conditions, so updating a CMS alone does not fix the exposure.
    • CVE-2026-109618 is an out-of-memory condition that interrupts initialization of internal request data, leaving cleanup routines handling inconsistent state. The command passed to zif_system comes from a fake zend_string and runs as the web server user (typically www-data).
    • CVE-2026-109619 lets internal state outlive the memory backing it, potentially exposing a later request on the same worker to corrupted data.
    • The most widespread kit sends POST requests to /index.php or /, uses the User-Agent php2shell-109618 and the multipart boundary B7kQpoc618. It targets raw IP addresses, usually hitting each host once or twice, which indicates opportunistic address-space scanning.
    • Fastly identified more than ten candidate kits via fixed or patterned multipart boundaries, five of them tied to PHP2Shell by name, headers or behavior. About one-third of the traffic self-labeled as defensive checking, which cannot be verified.
    • Akatsuki Legion places the first PHP2Shell-named scanner at 03:59 UTC on October 21, over nine hours before the scheduled release.
    • Two circulating PHP2Shell detection patterns mostly matched React2Shell traffic (identifiable by the Next-Action header). Boundaries beginning --wp2shell indicate a separate WordPress campaign.
    • Sansec found public PoCs fail against default installs and many need extra weaknesses such as local file inclusion or artificially vulnerable test environments.

    Remediation

    Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install the distributor's patched package; older branches need verified backports or migration. A WAF gives only temporary coverage because the vulnerable processing happens before application code. Correlate suspicious requests with PHP-FPM errors, Apache worker crashes and unexpected outbound connections from PHP processes. Boundary strings are useful hunting leads, but rotating User-Agents and shared proxies make simple signatures and IP blocklists unreliable.

32. olhardigital.com.br ↗ · pub. 25/10/2026 16:28 · coletado 25/10 18:00

    PHP2Shell: Two unauthenticated RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) exploited, forcing systems offline

    ler a análise desta fonte ocultar

    Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, allow unauthenticated remote code execution on vulnerable servers. Banks, retailers, gaming platforms, hospitals and government bodies reportedly took systems offline while patching. Amazon reported exploitation attempts roughly a week before the patches were released, and Cloudflare CEO Matthew Prince said exploitation attempts grew exponentially after disclosure. The flaws were found by researchers at Calif during a PHP code audit under the Hack the Planet initiative run by OpenAI and Wiz, with AI assisting the analysis and exploitation. The source of the early exploitation is unresolved: a leak, a failure during the embargo, or independent discovery.

    Technical Details

    • Both flaws allow an attacker to send commands to a vulnerable PHP server over the internet without credentials.
    • PHP underpins roughly 70% of the web, including WordPress, Drupal, Joomla and MediaWiki.
    • PHP is also embedded in dev tooling, command-line components, storage appliances, routers and corporate security devices, so patching web servers alone may not close all exposure.
    • The flaws had been identified earlier, but a working exploitation method was demonstrated only recently.
    • The PHP Foundation shared information with large companies and hosting providers before public disclosure.

    Remediation

    • Apply the patches released by the PHP Foundation to all affected systems.
    • Inventory every PHP instance, including embedded ones in appliances, routers and CLI tooling, not only web servers.
    • Prioritize internet-facing servers and legacy components, and watch for exploitation attempts in logs.
33. thehackernews.com ↗ · pub. 25/10/2026 14:19 · coletado 25/10 16:00

    PHP2Shell exploited against European government entity; agentic AI post-exploitation seen, Lazarus-linked scanning of 216 hosts

    Unit 42 reports a concrete compromise of a European government entity with apparent agentic-AI post-exploitation (hashes and MFA secrets within two hours, NTLM relay, Domain Admin attempt). CYFIRMA adds a suspected Lazarus-linked scanning campaign against 216 hosts, Defused Cyber reports probing of Palo Alto GlobalProtect honeypots from 204.76.203[.]7, and ReliaQuest, Datadog, Xint and Bitsight add detection, technical and exposure data.

    ler a análise desta fonte ocultar

    Unit 42 reports a concrete compromise of a European government entity with apparent agentic-AI post-exploitation (hashes and MFA secrets within two hours, NTLM relay, Domain Admin attempt). CYFIRMA adds a suspected Lazarus-linked scanning campaign against 216 hosts, Defused Cyber reports probing of Palo Alto GlobalProtect honeypots from 204.76.203[.]7, and ReliaQuest, Datadog, Xint and Bitsight add detection, technical and exposure data.

    Palo Alto Networks Unit 42 reports that attackers exploited the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) against a European government entity and used what appears to be an agentic AI platform for post-exploitation. Within two hours of initial exploitation they reached password hashes and MFA secrets, set up an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation. Separately, CYFIRMA attributes with moderate confidence a low-and-slow scanning campaign from 21 compromised nodes against 216 unpatched hosts to a Korean-speaking operator in the Lazarus Group ecosystem. Defused Cyber also sees PHP2Shell probes against Palo Alto Networks GlobalProtect honeypots, and the PHP Foundation has warned of a third RCE flaw, CVE-2026-115560.

    Technical Details

    • Unit 42 saw enumeration commands wrapped in delimiters such as ==SHELLUSER== and ==PASSWD==, which produce machine-parseable output for an AI model. Activity included reconnaissance of the authentication database for password hashes and 2FA secrets, curl-based anonymous LDAP queries to the domain controller to find the administrator account, and host reconnaissance for DNS/AD integration, internal hosts, privileged groups and interactive users.
    • CYFIRMA: scanning is paced and nodes are rotated and abandoned at the first sign of blocking, so threshold-based alerting is unlikely to catch it. Targets are 216 hosts across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia and the E.U., spanning government, finance, logistics, airports and aviation, manufacturing and online transaction platforms. Coordination runs over a closed I2P channel. Attribution rests on North Korean (Munhwaŏ) vocabulary, C2 infrastructure previously used by Lazarus and its history of PHP/WordPress compromise (SyncHole). CYFIRMA says exploitation is the next step.
    • Defused Cyber: probes from 204.76.203[.]7 carry a PHP_SESSION_UPLOAD_PROGRESS marker ('p2s-rider') and an empty dummy upload, apparently building a target list of Palo Alto devices.
    • Datadog: the exploit needs a form-field name sized to force an allocation failure during PHP's copying into a hash table, and must defeat ASLR. ReliaQuest reproduced CVE-2026-109618 in a lab; its detection sequence is a POST returning 500, PHP memory exhaustion and heap corruption, and an Apache worker crash.
    • CVE-2026-115560 requires session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), with upload progress enabled. A fix is expected in the regular release cycle.
    • Cloudflare detected millions of exploitation attempts. Bitsight counts nearly 37 million internet-facing PHP systems, mostly in the U.S., Germany, France, the Netherlands and Japan. Xint released an exposure scanner.

    Remediation

    Update PHP on the host itself, since WAF rules or application and plugin updates do not remove the flaw. Hunt for the ReliaQuest log sequence, and disable session upload progress until the CVE-2026-115560 fix ships. Organizations in the sectors and regions CYFIRMA lists should assume they are in scope for targeting.

34. techcrunch.com ↗ · pub. 24/10/2026 12:30 · coletado 24/10 13:00

    PHP2Shell: critical PHP RCE flaws CVE-2026-109618/109619 patched amid mass exploitation attempts and first confirmed compromises

    TechCrunch reports that as of late Friday (October 24), Palo Alto Networks and Trail of Bits confirm compromises and post-exploit activity tied to PHP2Shell, contradicting earlier reports that no successful compromise had been documented. It also says the bugs were first found in 2024 but not deemed exploitable, that Calif found them under the OpenAI/Wiz Hack the Planet initiative, and that businesses including banks, retailers, gaming sites and hospitals took services offline.

    ler a análise desta fonte ocultar

    TechCrunch reports that as of late Friday (October 24), Palo Alto Networks and Trail of Bits confirm compromises and post-exploit activity tied to PHP2Shell, contradicting earlier reports that no successful compromise had been documented. It also says the bugs were first found in 2024 but not deemed exploitable, that Calif found them under the OpenAI/Wiz Hack the Planet initiative, and that businesses including banks, retailers, gaming sites and hospitals took services offline.

    Two critical unauthenticated remote code execution flaws in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were patched by the PHP Foundation on Wednesday after a coordinated, embargoed disclosure. The bugs were found by researchers at Calif during a PHP code audit under the Hack the Planet initiative run by OpenAI and Wiz. They affect a platform used by roughly 70% of the web-facing internet. Industry coordination largely prevented mass exploitation, but Amazon detected exploitation about a week before the patches, with defenders advised to hunt for activity from October 17. As of late Friday, Palo Alto Networks and Trail of Bits report confirmed compromises and post-exploit activity against a still-unknown target. Many systems remain unpatched.

    Technical Details

    • The flaws allow remote, unauthenticated code execution without user interaction. An attacker could plant malware to steal data or keep a persistent foothold.
    • Per TechCrunch, the bugs were first found in 2024 but were not considered exploitable and went unpatched. Researchers later found an exploitation path. Calif says AI assisted the exploitation work, but most of it relied on the researchers' existing knowledge of PHP's codebase. Wiz verified the proof-of-concept exploits.
    • Amazon could not say how the attacker learned of the bugs before disclosure. Theories include an embargo leak, independent discovery, or espionage. The PHP Foundation blamed one company for pushing patches live hours before the embargo ended, which does not explain the week of earlier activity.
    • Cloudflare CEO Matthew Prince said exploitation attempts rose exponentially after disclosure. Researchers say weaponization is difficult but not impossible, which explains the absence of mass exploitation so far.
    • PHP also sits in developer tools, command-line packages, and software on routers, storage devices, firewalls and VPNs. Downstream vendors will need to ship their own updates. WordPress, Drupal, Joomla and MediaWiki rely on PHP.

    Remediation

    • Apply the PHP Foundation patches or vendor updates promptly, prioritizing internet-facing systems.
    • Hunt for evidence of exploitation dating back to October 17.
    • Track downstream products that embed PHP, and plan for legacy systems that cannot be updated.
35. theregister.com ↗ · pub. 23/10/2026 17:04 · coletado 23/10 19:00

    PHP Foundation reserves CVE-2026-115560, a third PHP RCE flaw, with no emergency fix; Mandiant validates PHP2Shell PoCs

    The PHP Foundation's executive director Elizabeth Barron says CVE-2026-115560 is reserved and will get a full advisory and fix in the next regular release, not an emergency patch, and that the Foundation has no evidence of exploitation before disclosure or on patched versions. Mandiant CTO Charles Carmakal says exploitation may have begun in a limited fashion, many public PoCs are 'vibe-coded' and non-functional, but some validated PoCs achieve RCE against default mod_php deployments, though not PHP-FPM.

    ler a análise desta fonte ocultar

    The PHP Foundation's executive director Elizabeth Barron says CVE-2026-115560 is reserved and will get a full advisory and fix in the next regular release, not an emergency patch, and that the Foundation has no evidence of exploitation before disclosure or on patched versions. Mandiant CTO Charles Carmakal says exploitation may have begun in a limited fashion, many public PoCs are 'vibe-coded' and non-functional, but some validated PoCs achieve RCE against default mod_php deployments, though not PHP-FPM.

    The PHP Foundation told The Register on October 23 that it has reserved CVE-2026-115560 for a third PHP remote code execution (RCE) flaw, separate from the two PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619). It will not ship an emergency fix; a full advisory and patched software will come with the next regular PHP release. The Foundation says exploitation needs a very unlikely combination of configuration and application code, and has published only an informational advisory. The Foundation and other researchers report no publicly confirmed successful compromises from PHP2Shell, only exploitation attempts. Mandiant CTO Charles Carmakal warns that exploitation may have begun in a limited fashion and that the threat is viable and very serious.

    Technical Details

    • CVE-2026-115560 requires an application to set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime with ini_set() before calling session_start(). The session upload progress feature must also be enabled.
    • Mandiant says several public PoCs appear to be 'vibe-coded' and cannot achieve RCE. It has validated some PoCs that achieve RCE against default mod_php deployments, but not PHP-FPM.
    • PHP Foundation: no evidence of successful exploitation of the two PHP2Shell CVEs prior to disclosure, and none against patched PHP versions. It is working with OpenAI, Wiz and Calif.

    Remediation

    • Set session.upload_progress.enabled=0 until the next regular PHP bugfix release to fully protect against the CVE-2026-115560 RCE vector.
    • Apply the October 21 PHP releases for CVE-2026-109618 and CVE-2026-109619.
36. f5.com ↗ · pub. 22/10/2026 14:50 · coletado 23/10 14:00

    F5 Labs observes PHP2Shell exploit attempts against CVE-2026-109618/109619 starting hours before patches

    F5 Labs adds honeypot telemetry: first PHP2Shell scanning at 08:36 UTC on October 21, over five hours before publication, a split of about 98% CVE-2026-109619 versus 2% CVE-2026-109618, three concrete request patterns, scanner user agents and webshell test strings. It also scores both flaws CVSS 9.8, which differs from the CVSS v4.0 9.2 in the known report.

    ler a análise desta fonte ocultar

    F5 Labs adds honeypot telemetry: first PHP2Shell scanning at 08:36 UTC on October 21, over five hours before publication, a split of about 98% CVE-2026-109619 versus 2% CVE-2026-109618, three concrete request patterns, scanner user agents and webshell test strings. It also scores both flaws CVSS 9.8, which differs from the CVSS v4.0 9.2 in the known report.

    F5 Labs honeypots recorded the first PHP2Shell scanning on October 21, 2026 at 08:36 UTC, more than five hours before the CVEs were published and patches released. The activity followed a leak of details and pre-allocated CVE numbers for two unauthenticated RCE use-after-free flaws in core PHP, CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.8. After the official advisories, opportunistic scanning and exploit attempts surged, with about 98% of events targeting CVE-2026-109619 and about 2% targeting CVE-2026-109618. F5 describes mostly probing and PoC-style requests, many from self-identified scanners, while other operators use browser-like user agents to blend in. F5 does not report a confirmed successful compromise.

    Technical Details

    • Both flaws are CWE-416 use-after-free bugs reached through the session upload-progress feature (session.upload_progress.enabled). The client controls the PHP_SESSION_UPLOAD_PROGRESS field in a multipart/form-data POST.
    • CVE-2026-109619: PHP global state points into request memory and is not reset between requests. Attackers cycle session IDs while replaying the same progress structure to groom the heap.
    • CVE-2026-109618: longjmp() aborts on out-of-memory errors leave request memory uninitialized, and cleanup routines then read it. The OOM condition can be driven with an oversized upload.
    • Pattern 1 is a verification probe: POST / with User-Agent php2shell-verify/1.0, boundary ----php2shelld656557dacfa4fbc, upload-progress value p2sprobec982a06c, and file probe.txt containing probe.
    • Pattern 2 is a repeated minimal trigger: random 64-hex boundary, rotating 16-hex PHPSESSID, X-prefixed progress value, and file x.txt containing two literal \0 bytes, with a generic Mozilla/5.0 user agent. This is consistent with heap grooming for CVE-2026-109619.
    • Pattern 3 is a large OOM-style payload: Content-Length 62,929, User-Agent php2shell-109618, boundary B7kQpoc618, static PHPSESSID=a1b2c3d4e5f6a7b8c9d0e1f2a3, and a file named a padded with about 62 KB of A characters.
    • Many user agents are self-identified scanners. The appendix lists more than 100, including php2shell-scan/1.0 (+https://github.com/0xrsydn/php2shell-scan) and php2shell-scanner/1.0.0 (+https://github.com/Evil0ctal/php2shell-scanner). Others are Chrome or Firefox lookalikes.
    • The appendix also lists two php2shellLP strings that look like PHP webshell test payloads: one runs system('id'), the other sends id output via curl to a redacted URL.

    Remediation

    • Upgrade internet-facing PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Where patching is delayed, disable upload progress tracking.
    • Use WAF virtual patching, such as F5 WAF for Distributed Cloud or BIG-IP, to drop multipart payloads that target PHP_SESSION_UPLOAD_PROGRESS and to block high-frequency empty file uploads.
37. zdnet.com ↗ · pub. 23/10/2026 12:09 · coletado 23/10 14:00

    PHP2Shell: PHP issues extra mitigation for CVE-2026-115560 as NSA urges heightened vigilance over critical PHP RCE flaws

    The article adds the exact configuration conditions for CVE-2026-115560 (serialize handler switched at runtime with ini_set() before session_start(), with upload progress enabled) and the PHP Project's October 23 advice to set session.upload_progress.enabled=0. It also adds the NSA's call for heightened awareness, enhanced logging and replacement of end-of-life PHP, and Perforce Zend's statement that most distributions patched within hours.

    ler a análise desta fonte ocultar

    The article adds the exact configuration conditions for CVE-2026-115560 (serialize handler switched at runtime with ini_set() before session_start(), with upload progress enabled) and the PHP Project's October 23 advice to set session.upload_progress.enabled=0. It also adds the NSA's call for heightened awareness, enhanced logging and replacement of end-of-life PHP, and Perforce Zend's statement that most distributions patched within hours.

    The PHP Project published an October 23 advisory on a separate, "unlikely" RCE vector, CVE-2026-115560, tied to the PHP2Shell pair of critical flaws (CVE-2026-109618 and CVE-2026-109619, both scored 9.2). It recommends disabling session upload progress until the next routine release. The two core flaws were patched on October 21, and PHP is present on roughly 70% of websites, according to Wiz. Amazon Threat Intelligence reported exploitation attempts four days before disclosure, an actor tied to the attack chains trying to deploy a Mirai-style botnet, and Cloudflare recording millions of attempts. The NSA advised heightened awareness over the coming weeks and prioritization of vendor patches.

    Technical Details

    • CVE-2026-115560 requires an application to set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled.
    • Applications that never change the serialize handler at runtime can keep the feature enabled.
    • Wiz says the attack chain needed an exceptionally complex series of steps, "at the edge of what human researchers could practically achieve", which frontier AI models made feasible.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Where patching is not immediately possible, set session.upload_progress.enabled=0 until the next scheduled PHP release. This also covers CVE-2026-115560.
    • The NSA advises inventorying hardware and software that rely on vulnerable PHP versions, prioritizing vendor patches, enabling enhanced logging and replacing end-of-life PHP packages.
    • Perforce Zend/OpenLogic notes that most open source and commercial LTS distributions shipped patches at or shortly after the coordinated release, so a system package manager update is a quick fix.
38. securityweek.com ↗ · pub. 23/10/2026 09:45 · coletado 23/10 10:00

    Mirai-linked botnet operators try PHP2Shell exploits as VulnCheck ASLR bypass emerges; no confirmed compromise

    Adds Hunt.io's attribution of the PHP2Shell traffic to an established Mirai-style botnet active since at least May 2026, Arctic Wolf's finding that its data does not show the requests delivering Potassium, Sansec's revised view that exploitation is harder than predicted, Qualys patching and end-of-life figures (199,000 patched in 12 hours; about 110 million end-of-life and 44 million unpatched supported instances), and confirmation that CISA had not added the CVEs to KEV as of the morning of October 23.

    ler a análise desta fonte ocultar

    Adds Hunt.io's attribution of the PHP2Shell traffic to an established Mirai-style botnet active since at least May 2026, Arctic Wolf's finding that its data does not show the requests delivering Potassium, Sansec's revised view that exploitation is harder than predicted, Qualys patching and end-of-life figures (199,000 patched in 12 hours; about 110 million end-of-life and 44 million unpatched supported instances), and confirmation that CISA had not added the CVEs to KEV as of the morning of October 23.

    Two days after PHP shipped emergency fixes for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2, unauthenticated RCE), threat actors have tried to use them to spread Potassium, which Sophos believes is a Mirai variant. No successful in-the-wild compromise has been confirmed. VulnCheck built an exploit that defeats ASLR on production-style x86-64 setups, and SOCRadar found an exposed attacker server holding custom PHP2Shell tooling. Many European government, school and hospital sites went offline as a precaution, and the UK said 32 government services were unavailable and four partly unavailable.

    Technical Details

    • Sophos analyzed a blocked attempt to install Potassium, an updated build of a Mirai-derived strain first identified in early 2026, with downloader and DDoS functions. The malware never reached the target. Sophos's latest analysis corrects an earlier update that reported successful exploitation.
    • Arctic Wolf tied two Potassium binaries to servers hosting PHP2Shell payloads, but its data does not show the PHP2Shell requests fetching or running the malware. Hunt.io attributes the traffic it saw to an established Mirai-style botnet, active since at least May 2026, that recently added these flaws to its spreading methods.
    • VulnCheck's exploit for CVE-2026-109618 chains a memory leak into code execution on x86-64 systems with ASLR enabled and PHP error display off (the recommended production setup). It is available only to its Initial Access Intelligence customers. VulnCheck notes that very few of the hundreds of GitHub PoC repositories contain legitimate exploits.
    • SOCRadar found an exploit chain for PHP 8.4.26 on Apache mod_php on an attacker server with publicly browsable files, billed as "one-click" and tested in a lab. It requires an uncommon, test-like configuration. The operator fingerprinted about 20 sites (US, UK, Canada, France, Finland, Poland, China) and probed 11 in depth; none met the requirements and no shell access was seen as of October 22. Hunt.io counted 10 attack rounds against 123 servers; about 57 ran PHP, 10 rejected the requests and none was exploited.
    • Sansec revised its earlier prediction of mass exploitation within 15 minutes of the patch. Its October 22 update says attackers need detailed server knowledge and specific conditions, and that public exploits fail against default PHP settings. Wordfence also reports continuing attacks with no known compromises.
    • Qualys data (12,000 customers, anonymized): only 199,000 PHP instances were patched within 12 hours. Roughly 110 million instances (71%) run end-of-life PHP 5.4 through 8.1 and will likely never be patched. Another 44 million run supported branches but are unpatched.

    Remediation

    • PHP fixed the flaws in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21.
    • Operators of end-of-life PHP versions have no vendor patch available.
    • As of the morning of October 23, CISA had not added either CVE to its KEV catalog. Censys runs a public dashboard tracking patch progress.
39. thehackernews.com ↗ · pub. 23/10/2026 08:25 · coletado 23/10 10:00

    PHP warns of separate unpatched RCE flaw CVE-2026-115560 two days after emergency PHP2Shell fixes; mitigation is disabling upload progress

    On October 23 PHP disclosed a separate, unpatched code execution flaw, CVE-2026-115560, affecting only an unusual configuration (runtime change of session.serialize_handler to php before session_start with upload progress enabled). It is not fixed by the October 21 releases; PHP will not issue an emergency fix and recommends session.upload_progress.enabled=0. Affected versions, severity and any shared root cause with CVE-2026-109619 are unstated, and no exploitation has been reported.

    ler a análise desta fonte ocultar

    On October 23 PHP disclosed a separate, unpatched code execution flaw, CVE-2026-115560, affecting only an unusual configuration (runtime change of session.serialize_handler to php before session_start with upload progress enabled). It is not fixed by the October 21 releases; PHP will not issue an emergency fix and recommends session.upload_progress.enabled=0. Affected versions, severity and any shared root cause with CVE-2026-109619 are unstated, and no exploitation has been reported.

    PHP published an informational advisory on October 23, 2026 warning of a separate code execution issue, CVE-2026-115560, two days after its October 21 emergency release fixing the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). The new issue affects only web applications with an unusual configuration, which PHP considers unlikely in practice, so no emergency fix is planned. PHP recommends disabling the session upload progress feature until a fix ships in the next routine bugfix release. No exploitation of CVE-2026-115560 has been reported; the surge in attacks since October 21 targets the two earlier PHP2Shell flaws.

    Technical Details

    • The issue is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
    • An application is exposed only if it sets session.serialize_handler to php_binary or php_serialize in its configuration, changes it to php at runtime via ini_set(), does so before calling session_start(), and still has session upload progress enabled (the default).
    • PHP has not stated the affected versions, the releases that will contain the fix, a severity score, or whether the root cause is shared with CVE-2026-109619.
    • Separately, Amazon honeypots logged an exploit attempt against the PHP2Shell flaws on October 17, four days before disclosure. Cloudflare saw attempts rise from tens of thousands within 45 minutes of disclosure to millions by early October 22. Attackers tried to install a Mirai variant (per Sophos and Arctic Wolf), but Previdian, Wordfence and others report only scanning and probing with no confirmed code execution.

    Remediation

    • Set session.upload_progress.enabled=0 until the next routine bugfix release. This is the same mitigation PHP listed on October 21 for CVE-2026-109619; those who already applied it need to do nothing more.
    • PHP will publish a full advisory for CVE-2026-115560 with the next release.
    • Continue applying the October 21 PHP2Shell patches.
40. gbhackers.com ↗ · pub. 23/10/2026 06:41 · coletado 23/10 07:00

    Public PoCs for PHP2Shell RCE flaws CVE-2026-109618/109619 circulate; Sophos revises exploitation claim to scanning and failed attempts

    Sophos corrected its earlier exploitation claim: its 21:21 UTC update on October 22 says telemetry showed only scanning and a few failed attempts, superseding the 16:18 UTC assessment. The article adds 117.55.202[.]115 as Potassium C2 infrastructure, Sophos IPS signature IDs, the finding that Sophos's Adversary Group struggled to build a working exploit even with AI, and Sophos hunting and interim mitigation guidance.

    ler a análise desta fonte ocultar

    Sophos corrected its earlier exploitation claim: its 21:21 UTC update on October 22 says telemetry showed only scanning and a few failed attempts, superseding the 16:18 UTC assessment. The article adds 117.55.202[.]115 as Potassium C2 infrastructure, Sophos IPS signature IDs, the finding that Sophos's Adversary Group struggled to build a working exploit even with AI, and Sophos hunting and interim mitigation guidance.

    Public proof-of-concept code for two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell, CVSS v4.0 9.2), is circulating while attackers scan exposed servers. The flaws allow unauthenticated remote code execution (RCE) with web server privileges. Sophos corrected an earlier report of successful exploitation: its October 22 update (21:21 UTC) says customer telemetry showed scanning and a small number of failed attempts, not confirmed compromises, superseding its 16:18 UTC assessment. A blocked attempt carried a payload assessed as Potassium, a likely Mirai-derived botnet variant, which was not delivered. PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

    Technical Details

    • CVE-2026-109618 is memory corruption tied to out-of-memory handling; CVE-2026-109619 involves stale request state and use-after-free conditions (Sophos). Both affect PHP itself, not a specific application.
    • Apache with mod_php carries the highest risk; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.
    • Sophos says its Adversary Group struggled to build a working exploit even with AI assistance. Public exploit availability does not establish reliable exploitation, and claimed successes may depend on lab conditions or specific configurations.
    • The Potassium sample is an updated, significantly expanded variant of one documented earlier in 2026. It combines downloader and DDoS functions, resolves a hard-coded encrypted C2 address, connects to 134[.]199[.]154[.]64 and sends an HTTP request. It accepts content only after an HTTP 200 response and the ELF magic bytes 7F 45 4C 46. Its resolver falls back to 8.8.8.8, 1.1.1.1 and 1.0.0.1, which are legitimate resolvers and not indicators. Sophos also associates 117[.]55[.]202[.]115 with Potassium C2 infrastructure.

    Remediation

    • Obtain the upstream release or equivalent vendor package; updates are not installed automatically.
    • Sophos released Firewall IPS signatures 67359, 67360, 67375, 2313184, 2313185, 2313187 and 2313188. Endpoint IPS coverage includes 2313184, 2313185, 2313187, 2313188 and 2313189. These supplement Endpoint XDR, Taegis XDR, Windows Behavioral Protection and Linux Runtime Detection rules but do not replace patching.
    • Hunt for unexpected multipart upload requests, memory-exhaustion errors, worker crashes, suspicious child processes, modified PHP files and unusual outbound connections.
    • If patching is not immediately possible, remove exposed applications from the internet or place them behind network-layer authentication. Configuration mitigations only address individual attack paths.
    • Inventory all PHP runtimes, including copies bundled in appliances and hosted services, and verify vendor remediation status. The absence of confirmed compromise should not delay updates.
41. thehackernews.com ↗ · pub. 23/10/2026 04:40 · coletado 23/10 05:00

    PHP2Shell exploit attempts hit millions as attackers try to deploy Potassium Mirai variant; none confirmed successful

    The article adds Potassium Mirai botnet deployment attempts with C2 and loader infrastructure (Sophos, Arctic Wolf), an attacker server with PHP2Shell tooling (SOCRadar, Hunt.io), Previdian and other telemetry showing no successful RCE, Censys exposure figures of 34.4 million vulnerable PHP services, and a VirusTotal estimate of about 272,000 hosts on supported branches.

    ler a análise desta fonte ocultar

    The article adds Potassium Mirai botnet deployment attempts with C2 and loader infrastructure (Sophos, Arctic Wolf), an attacker server with PHP2Shell tooling (SOCRadar, Hunt.io), Previdian and other telemetry showing no successful RCE, Censys exposure figures of 34.4 million vulnerable PHP services, and a VirusTotal estimate of about 272,000 hosts on supported branches.

    Threat actors are unsuccessfully attempting to exploit the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) to enlist hosts into Potassium, a Mirai variant. Researchers say weaponizing the bugs appears harder than expected. Cloudflare reported millions of exploitation attempts as of early October 22, 2026. Previdian, Cisco Talos, Wordfence and others observed mostly scanning and no confirmed remote code execution. SOCRadar and Hunt.io exposed an attacker server holding PHP2Shell tooling, while VulnCheck built an exploit that defeats ASLR on x86-64. Censys assesses more than 34.4 million PHP services as still vulnerable as of October 23, 2026.

    Technical Details

    • The flaws allow unauthenticated RCE via crafted HTTP requests. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
    • Potassium sample (Sophos, Arctic Wolf): an expanded Mirai derivative with downloader and DDoS functions. It resolves an encrypted hard-coded C2, connects to 134.199.154[.]64 and expects an ELF payload (magic bytes 7F 45 4C 46). It falls back to public DNS servers (8.8.8.8, 1.1.1.1, 1.0.0.1).
    • Attack sources fetch a loader from 92.118.112[.]100. In a sandbox the botnet queried thunder.godofthunder[.]st, resolved it to 134.199.154[.]64 and opened a C2 channel on TCP 50792. The goal was volumetric floods against two adjacent hosts in a single Ukrainian network.
    • Arctic Wolf: 24 commands, with floods over ICMP, TCP, UDP and OpenVPN. ARM and x86 builds contain Ethereum Name Service (ENS) C2 resolution that is disabled. Nokia Deepfield describes ChaCha20 for the static config table, a 0xED wire byte, a SHELL/SHOUT reverse-shell protocol and DNS A-record half-swapping. Synthient first flagged Potassium in March 2026.
    • SOCRadar found an exploit server at 206.188.197[.]105:9999 with aslr_exploit.py (a one-click exploit for PHP 8.4.26 under Apache mod_php that leaks addresses via the session cookie and abuses session upload progress), plus php2shell_fp.py, deep_probe.py and wp_attack.py. The scripts screened about 20 sites in Canada, China, Finland, France, Poland, the UK and the US. SOCRadar saw no shell access as of October 22 and assesses a financially motivated actor focused on crypto and Web3.
    • Hunt.io says the same server targeted 123 servers; about 57 run PHP, ten rejected the request and none was exploited. It lists ten open directories hosting PHP2Shell tooling.
    • VulnCheck (Spencer McIntyre) developed a technique chaining the two flaws with a memory leak to bypass ASLR on x86-64 under PHP's recommended production error-display setting.
    • Previdian recorded its first CVE-2026-109618 attempt on October 21, 2026 at 13:05 UTC, with no RCE or dropped PHP files. Beelzebub, Dataminr and Wordfence report scanning, fingerprinting and attempts to confirm execution, steal secrets, persist and fetch second-stage payloads. A China-based IP tried to drop a web shell via a session file.
    • Sysdig notes the vulnerable code dates to PHP 5.4 and sits in the engine, so WordPress, Drupal and Joomla sites with clean code are still exposed.

    Remediation

    • Patch to a fixed PHP branch. Organizations on PHP 7.4, 8.0 or 8.1 should move to a supported branch or use a distribution backport.
    • Defenders should block the Potassium C2 and loader infrastructure, and the ENS names and RPC infrastructure if ENS resolution is enabled in future variants.
    • Hunt for second-stage payloads and for web shells dropped through session files.
42. tenable.com ↗ · pub. 22/10/2026 19:04 · coletado 22/10 20:00

    Criminal forums including BreachForums go offline over PHP2Shell RCE flaws CVE-2026-109618 and CVE-2026-109619

    Tenable adds the underground reaction: BreachForums, DarkForums, PwnForums and Dread went offline or migrated, citing PHP2Shell, and it forecasts commoditization of the exploits by access brokers and ransomware affiliates. Its claims that all PHP versions below 8.3 are affected and that 8.2 and older get no patches conflict with the known report of fixed 8.2.35 and backports for 7.4, 8.0 and 8.1.

    ler a análise desta fonte ocultar

    Tenable adds the underground reaction: BreachForums, DarkForums, PwnForums and Dread went offline or migrated, citing PHP2Shell, and it forecasts commoditization of the exploits by access brokers and ransomware affiliates. Its claims that all PHP versions below 8.3 are affected and that 8.2 and older get no patches conflict with the known report of fixed 8.2.35 and backports for 7.4, 8.0 and 8.1.

    Tenable reports that criminal forums took themselves offline or migrated infrastructure after the public disclosure of PHP2Shell, two critical unauthenticated RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each). BreachForums posted an advisory saying "We take our security seriously", DarkForums said it would stay offline until PHP is patched globally, PwnForums went dark, and Dread posted a maintenance notice naming both CVEs. Some forums restricted registrations or moved key communications to Telegram. Tenable argues that operators face a dual threat from law enforcement and rival groups, because forum PHP stacks hold member emails, IP logs, private messages, transaction records and stolen credentials. It also reports pre-disclosure exploitation from October 17 from an Australian-geolocated IP and forecasts that initial access brokers and ransomware affiliates will commoditize the exploits.

    Technical Details

    • The two flaws target different stages of PHP's memory management (OOM Corruption and Stale Global State). Chaining them gives a more reliable exploitation path, and researchers credit frontier AI models with the discovery and the chain.
    • Tenable states the flaws affect every PHP version below 8.3, that about 59% of internet-facing PHP hosts run end-of-life branches, and that no patches will be issued for PHP 5.x, 7.x, 8.0, 8.1 and 8.2.
    • Researchers have documented AI-assisted vulnerability analysis being used to speed up exploit development and to find additional exploitation vectors.
    • DarkOwl analysis highlights the data held behind a typical forum's PHP application layer.

    Remediation

    • Treat both CVEs as immediate remediation priorities and upgrade PHP.
    • Where upgrading is not feasible, deploy compensating controls: a WAF, network segmentation and enhanced monitoring for exploitation indicators.
    • Tenable plugins are being released on the individual CVE pages.
43. theregister.com ↗ · pub. 22/10/2026 17:37 · coletado 22/10 18:00

    VulnCheck develops PHP2Shell exploit that bypasses ASLR for RCE on x86-64 PHP 8.4.26 in production configuration

    VulnCheck reports a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 systems with PHP's recommended production configuration (display_errors=off), chaining a memory leak into RCE on PHP 8.4.26. This contrasts with earlier reports that circulating PoCs were non-functional. The exploit is restricted to VulnCheck's Initial Access Intelligence customers, does not yet work for RCE on ARM64, and VulnCheck says hundreds of GitHub PoC repositories exist but very few work.

    ler a análise desta fonte ocultar

    VulnCheck reports a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 systems with PHP's recommended production configuration (display_errors=off), chaining a memory leak into RCE on PHP 8.4.26. This contrasts with earlier reports that circulating PoCs were non-functional. The exploit is restricted to VulnCheck's Initial Access Intelligence customers, does not yet work for RCE on ARM64, and VulnCheck says hundreds of GitHub PoC repositories exist but very few work.

    VulnCheck says it has developed what it believes is the first known exploit to achieve remote code execution (RCE) for CVE-2026-109618, part of the PHP2Shell pair with CVE-2026-109619, on ASLR-enabled x86-64 systems using PHP's recommended production configuration. The exploit chains a confirmed memory leak into RCE on PHP 8.4.26, and it works with display_errors=off. VulnCheck has made it available only to its Initial Access Intelligence customers. The company says ASLR had been the main barrier to exploiting PHP2Shell on real-world servers, and Spencer McIntyre warns that adversaries are clearly spending time (and AI tokens) on the bug. VulnCheck has seen hundreds of PHP2Shell proof-of-concept repositories on GitHub, but very few contain working exploits. Defenders are urged to patch rather than rely on memory protections.

    Technical Details

    • Target: CVE-2026-109618, an out-of-memory corruption bug leading to RCE in PHP; the PHP Foundation disclosed and patched it, together with CVE-2026-109619, on Wednesday.
    • The technique chains a confirmed memory leak into RCE on PHP 8.4.26 and defeats ASLR on x86-64 with display_errors=off.
    • VulnCheck says it works on ARM64 as well, but the RCE is not currently functional on ARM-based systems.
    • VulnCheck says it has not identified another public or commercial exploit that achieves this under the same conditions.

    Remediation

    • Organizations running vulnerable PHP versions should prioritize patching rather than assume that existing memory protections (ASLR) or configuration changes will stop an attack.
44. blog.checkpoint.com ↗ · pub. 22/10/2026 14:15 · coletado 22/10 15:00

    PHP2Shell: CVE-2026-109618 and CVE-2026-109619 PHP RCE flaws actively exploited, hitting 10% of organizations worldwide

    ler a análise desta fonte ocultar

    Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meaning exploitation attempts were observed; Check Point cannot confirm whether any attack succeeded. Europe is hit hardest (14% versus 6% in North America, Latin America and APAC), with Hungary (38%), Denmark (32%) and Austria (28%) the most affected countries. Government institutions in the Netherlands and Finland have taken some websites offline as a precaution.

    Technical Details

    • The flaws are in the PHP engine itself, so they affect any stack built on it: WordPress, Drupal, Joomla, Magento, shared hosting, cPanel and Plesk, and many commercial applications.
    • An unauthenticated remote attacker can execute code on a vulnerable server, leading to data theft, lateral attacks or outages.
    • Exploitation activity peaks hourly at midnight, when fewer security teams are watching.
    • The most exposed sectors are telecommunications (20%), education (18%), media and entertainment (16%) and associations and non-profits (16%). Biotech and pharmaceuticals is lowest (5%) among the 23 industries tracked.
    • Updating a CMS or its plugins does not close the flaws; PHP must be updated on the server.
    • Indicators of compromise to hunt for: unexplained web service outages, new or unfamiliar PHP files, unusual web server requests, web server processes executing system commands, and connections to unknown external addresses.

    Remediation

    • Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.1 and older remain vulnerable unless the fix is backported.
    • Inventory all PHP instances, including containers and third-party products. Patch internet-facing systems first, then restart services and verify the patched version is running.
    • Confirm with hosting providers that the patch has been applied.
    • Where patching is not immediately possible, restrict access to or temporarily take the vulnerable service offline, and segment web servers from the corporate network.
    • Patching does not remove malicious code already planted, so check for compromise.
    • Check Point offers IPS and WAF protections (latest signatures in Prevent mode) and Exposure Management to map PHP exposure.
45. theregister.com ↗ · pub. 22/10/2026 13:05 · coletado 22/10 15:00

    PHP2Shell forces 32 UK government services offline and 4 partly offline; no confirmed compromise

    UK minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services are unavailable and four partially unavailable as a precaution, with no confirmed compromise of central government or the wider public sector. Disruption includes the OBR, reportedly the DVLA, police services and several councils, and government sites in Germany, France, Belgium, Finland, the Netherlands and Australia's cyber agency site were also taken offline. The NCSC was briefed by OpenAI a week earlier and sent 50,000 warnings, and the NSA urged organizations to patch or disconnect.

    ler a análise desta fonte ocultar

    UK minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services are unavailable and four partially unavailable as a precaution, with no confirmed compromise of central government or the wider public sector. Disruption includes the OBR, reportedly the DVLA, police services and several councils, and government sites in Germany, France, Belgium, Finland, the Netherlands and Australia's cyber agency site were also taken offline. The NCSC was briefed by OpenAI a week earlier and sent 50,000 warnings, and the NSA urged organizations to patch or disconnect.

    The PHP2Shell flaws have forced 32 UK government services offline and left four partially unavailable, according to tech minister Baroness Lloyd of Effra in the House of Lords on October 22, 2026. She said the outages largely stem from precautionary measures while security updates and mitigations are applied, and that the government is not aware of any confirmed compromise of central government systems or the wider public sector. The Office for Budget Responsibility is among those offline, and reports cite disruption at the DVLA, police services and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet. Government sites in Germany, France, Belgium, Finland and the Netherlands, and Australia's cybersecurity agency website, were also taken down as a precaution. AWS says attacks began four days before disclosure, and Cloudflare has recorded millions of weaponization attempts.

    Technical Details

    • CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on vulnerable PHP servers.
    • One bug was found by Calif using OpenAI's GPT-5.6 Sol model; Wiz separately found both flaws with AI tools. OpenAI then analysed them and worked with vendors and agencies on disclosure.
    • The NCSC was briefed by OpenAI the week before disclosure, and the government set up a cross-departmental incident response before the public announcement.

    Remediation

    • The NCSC urges organizations to patch immediately or take affected systems offline until they are fixed, and sent 50,000 warnings to businesses and other organizations.
    • The NSA urges organizations to patch or disconnect vulnerable systems.
    • Departments are restoring services after remediation work.
46. gbhackers.com ↗ · pub. 22/10/2026 13:13 · coletado 22/10 15:00

    Gcore offers free WAAP Enterprise to public agencies after php2shell PHP RCE flaws (CVE-2026-109618/109619) take European sites offline

    ler a análise desta fonte ocultar

    Gcore is offering its WAAP Enterprise plan free to government bodies and public agencies until December 31, 2026. The offer follows the php2shell vulnerabilities, which forced public websites offline across Europe this week. Government portals in the Netherlands, Finland, Denmark and France, along with hospitals, schools and commercial sites, were taken down on the advice of CERT-EU and national agencies. The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, are rated CVSS 9.2 and allow unauthenticated remote code execution before any application code runs. The article is a vendor press release, so Gcore's claims about its own product's protection are unverified.

    Technical Details

    • The php2shell flaws allow unauthenticated RCE in PHP, before application code executes.
    • Gcore states its WAAP blocks the php2shell attack path by default for all customers, and updates rules centrally if new variants appear.
    • Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older receive no official fix.
    • The article does not state whether the flaws are exploited in the wild. The sites went offline as a precaution while no fix existed.

    Remediation

    • Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM and long-running workers.
    • For PHP 8.1 and older, obtain a vendor backport or upgrade.
    • Restrict origin access so traffic reaches the server only through a protection layer such as a WAF/WAAP.
    • Sites taken offline can be placed behind a filtering layer and restored while patching continues.
47. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01

    CERT-FR flags multiple PHP vulnerabilities enabling remote code execution, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12

    ler a análise desta fonte ocultar

    CERT-FR advisory CERTFR-2026-AVI-1359 reports multiple vulnerabilities in PHP that allow an attacker to achieve remote arbitrary code execution. The flaws are addressed in the PHP security bulletins of 21 October 2026. All 8.0.x and 8.1.x versions are listed as affected, and since the advisory names no fixed release for these branches, they appear to be end-of-life. The advisory does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: PHP 8.0.x (all versions), 8.1.x (all versions), 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27 and 8.5.x before 8.5.12.
    • Referenced CVEs: CVE-2026-109618 and CVE-2026-109619.
    • Vendor references: four php.net announcements dated 21 October 2026 and the GitHub advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w.
    • The advisory gives no CVSS scores, vulnerability classes or attack vectors, and does not map the impact to individual CVEs.

    Remediation

    • Consult the PHP security bulletin of 21 October 2026 and upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later.
    • Installations running PHP 8.0.x or 8.1.x have no listed fix and should be migrated to a supported branch.
48. securityaffairs.com ↗ · pub. 22/10/2026 11:55 · coletado 22/10 13:00

    AWS: PHP2Shell exploitation attempts began Oct 17, four days before CVE-2026-109618/109619 disclosure

    AWS adds five more IPs observed on October 21 to the single October 17 IP already known, says some belong to shared anonymization infrastructure, and recommends hunting from October 17 onward for POSTs containing PHP_SESSION_UPLOAD_PROGRESS, unexpected PHP-spawned processes and file changes. It also states there is no configuration-only workaround and suggests considering blocking multipart uploads as a stopgap.

    ler a análise desta fonte ocultar

    AWS adds five more IPs observed on October 21 to the single October 17 IP already known, says some belong to shared anonymization infrastructure, and recommends hunting from October 17 onward for POSTs containing PHP_SESSION_UPLOAD_PROGRESS, unexpected PHP-spawned processes and file changes. It also states there is no configuration-only workaround and suggests considering blocking multipart uploads as a stopgap.

    Amazon Threat Intelligence reports that exploitation of the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) began on October 17, 2026, four days before public disclosure. The first attempt hit an AWS MadPot honeypot from an IP linked to a commercial anonymization network while the bugs were still under embargo. On October 21, starting around 02:00 UTC (about 12 hours before the 14:00 UTC patch release), further proof-of-concept attempts arrived from other anonymized infrastructure. Payloads and anonymization services varied, so AWS suspects multiple actors. After the fixes shipped, more PoCs appeared within hours, and AWS describes PHP2Shell as broadly exploited in the wild. AWS has not established how the actor learned of the flaws before disclosure, nor whether the early attempts would have succeeded against real systems.

    Technical Details

    • The flaws allow unauthenticated RCE through a crafted web request and affect the PHP runtime itself, not a specific application.
    • AWS published six IPs: 103.216.220.92 (Oct 17) and 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188, 95.217.98.37 (all Oct 21). Some are shared anonymization infrastructure, so matching events should be investigated rather than blindly blocked.
    • Hunting indicators: POST requests carrying the PHP_SESSION_UPLOAD_PROGRESS string in multipart form data, unexpected processes spawned by PHP (command interpreters), and unexplained file changes on web servers.
    • Cloudflare reports it deployed WAF protections before disclosure and saw attackers mutating payloads to evade them.

    Remediation

    • Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Check that the hosting provider, OS vendor or container image has supplied the update. Updating WordPress, Drupal or other applications does not fix the runtime.
    • AWS says no configuration-only workaround fully mitigates both flaws. Where patching is delayed, consider blocking multipart file uploads after assessing the impact on applications; this is not a substitute for patching.
    • Review logs and activity from October 17 onward, including behavior that detection tools may not yet recognize. A WAF reduces exposure but does not replace patching.
49. securityweek.com ↗ · pub. 22/10/2026 09:20 · coletado 22/10 11:00

    Vendors, security firms and governments respond to PHP2Shell critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619)

    The article consolidates the industry and government response: vendor impact assessments (Cisco says no products are known to be affected, Red Hat scores the flaws 8.1 and not critical, Sophos took its MyUTM portal offline, SolarWinds applied compensating controls), OS and cloud patches, hosting panel fixes for EOL PHP branches, detections from CrowdStrike, Corelight, Broadcom and Cisco Talos, Coalition honeypot data, a Qualys mitigation, and alerts from CISA, UK NCSC, CERT-EU, Canada and BSI.

    ler a análise desta fonte ocultar

    The article consolidates the industry and government response: vendor impact assessments (Cisco says no products are known to be affected, Red Hat scores the flaws 8.1 and not critical, Sophos took its MyUTM portal offline, SolarWinds applied compensating controls), OS and cloud patches, hosting panel fixes for EOL PHP branches, detections from CrowdStrike, Corelight, Broadcom and Cisco Talos, Coalition honeypot data, a Qualys mitigation, and alerts from CISA, UK NCSC, CERT-EU, Canada and BSI.

    Tech vendors, security companies and government agencies have published advisories, detections and mitigations for PHP2Shell, two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619, in PHP. Wiz, OpenAI and Calif found them in August, and PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day ahead of the planned disclosure after the CVE IDs leaked on October 20. Amazon reports the first exploitation attempt on October 17. Hadrian, Patchstack and Cloudflare saw attempts in the hours before the patches, and WatchTowr saw mass exploitation soon after, although the circulating PoCs did not achieve code execution. Many vendors are still checking whether their products embed PHP, and several European government, school and hospital sites went offline as a precaution.

    Technical Details

    • Cisco is reviewing over 30 products and cloud services (ISE, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex, AppDynamics PHP Agent) and states that currently no products are known to be affected. Talos published Snort coverage and estimates that about half of PHP systems will not get a patch.
    • Red Hat scores both bugs 8.1 versus 9.8 in NVD and does not rate them critical. It says reliable exploitation of CVE-2026-109618 requires precise heap manipulation and timing and typically non-default behavior.
    • Palo Alto Networks rates the impact on PAN-OS high (CVSS 8.7), has no knowledge of attacks, and has fixes in upcoming releases. Sophos took its legacy MyUTM portal (SG UTM licensing) offline on October 21 because it ran a vulnerable PHP version. SolarWinds applied compensating controls to Pingdom. Fortinet confirmed two dozen products are not impacted and is still investigating others. Broadcom has not confirmed affected products.
    • CrowdStrike confirmed that one unauthenticated POST request is enough to make an Apache mod_php worker spawn a shell, with no vulnerable application code required.
    • Coalition honeypots logged exploit-pattern requests between October 20 and 21. JFrog warned about fake PoCs.
    • Amazon is addressing Elastic Beanstalk, WorkMail, Amazon Linux and Lightsail. Google Cloud is not vulnerable and auto-updated App Engine PHP runtimes.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Move off PHP 8.1 or earlier to 8.2 or newer. cPanel and Plesk released fixed builds for EOL PHP 7.4, 8.0 and 8.1, and DirectAdmin also shipped patches. Ubuntu fixed all supported releases and Debian fixed bookworm and trixie.
    • Inventory all PHP installations, including those embedded in appliances and services. Hunt for backdoors planted before patching (UK NCSC). Isolate internet-facing applications until the fix is verified (CERT-EU).
    • Qualys provides a mitigation that disables PHP's session upload-progress feature. Corelight published open-source Zeek and Suricata detections. CrowdStrike, Broadcom/Symantec and Cisco Talos published detections.
    • CISA, UK NCSC, Dutch NCSC, CERT-EU (joint with the European Commission, ENISA and Europol), Canada's Cyber Centre and Germany's BSI urge immediate patching.
50. hacktron.ai ↗ · pub. 21/10/2026 21:00 · coletado 22/10 10:00

    PHP2Shell: critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 patched, exploitation attempts reported

    The article adds detail on the interim mitigations: administratively set INI values for each CVE, the warning against RLIMIT_AS/RLIMIT_DATA, and pm.max_requests=1. It also adds that PHP 8.6.0 release candidates before RC4 are affected, the per-runtime validation status (PHP-FPM RCE validated for CVE-2026-109619 only, FrankenPHP and LiteSpeed by source analysis only), the CVSS v4.0 vector, and the AWS hunting guidance for multipart POSTs carrying PHP_SESSION_UPLOAD_PROGRESS.

    ler a análise desta fonte ocultar

    The article adds detail on the interim mitigations: administratively set INI values for each CVE, the warning against RLIMIT_AS/RLIMIT_DATA, and pm.max_requests=1. It also adds that PHP 8.6.0 release candidates before RC4 are affected, the per-runtime validation status (PHP-FPM RCE validated for CVE-2026-109619 only, FrankenPHP and LiteSpeed by source analysis only), the CVSS v4.0 vector, and the AWS hunting guidance for multipart POSTs carrying PHP_SESSION_UPLOAD_PROGRESS.

    PHP2Shell is the name for two critical unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that affect servers using PHP to handle web requests. The PHP security team scored both 9.2 under CVSS v4.0 and released fixes on 21 October 2026. Exploitation attempts have been reported, including AWS observations from at least 17 October. As of 22 October, no successful compromise of a real-world victim had been publicly documented and neither CVE was in CISA's KEV catalog. Updating is the only complete fix.

    Technical Details

    • CVE-2026-109618 is RCE via out-of-memory corruption. PHP exits out-of-memory errors with longjmp(). If memory runs out while request state is only partly initialised, shutdown can read or branch on invalid memory. It is reachable through request input handling, including multipart parsing.
    • CVE-2026-109619 is RCE via stale global state. Request-owned data can remain in worker globals after the request's memory is freed, and a later request on the same worker can use it before normal initialisation. Confirmed early consumers are INI diagnostics and session upload progress. Impact includes use-after-free, memory disclosure and RCE with the web worker's privileges.
    • Both flaws are unauthenticated and network-reachable (CVSS v4.0 9.2, AV:N/AC:H/AT:P/PR:N/UI:N). Exploit reliability depends on the build, extensions, frontend and memory allocator layout.
    • Affected: PHP 8.2, 8.3, 8.4 and 8.5 before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus PHP 8.6.0 release candidates before RC4. Independent analysis traces the earliest affected code path to PHP 5.4.0; PHP has not stated a full affected range.
    • Apache with mod_php carries the highest risk. RCE is confirmed for both CVEs, and for CVE-2026-109618 with default input and memory limits.
    • PHP-FPM: the session upload progress path of CVE-2026-109619 was validated as RCE on a normal dynamic pool. For CVE-2026-109618, source analysis says FPM is susceptible, but no complete exploit has been demonstrated.
    • FrankenPHP and LiteSpeed (LSAPI): susceptibility rests on source analysis only. No exploit has been validated, and PHP says this does not make them immune.
    • Hunting: AWS suggests looking for multipart POST requests containing the PHP_SESSION_UPLOAD_PROGRESS field. AWS says it is unclear whether the attempts it saw would have succeeded.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. Rebuild and redeploy container images and confirm the new version is serving requests.
    • Inventory every PHP runtime serving web traffic, including container base images and OS packages. Check the version that actually serves requests, since the CLI can differ from PHP-FPM or mod_php. For distribution packages, follow the distribution advisory, because backported fixes may not change the upstream version number.
    • Interim mitigations reduce risk but do not remove it, and should be set administratively so no pool, directory or app setting can override them.
      • CVE-2026-109618: set memory_limit=-1; keep post_max_size conservative and enforce request size at the frontend; lower max_input_nesting_level and bound input variables, multipart parts and uploads; block multipart requests at the frontend if unused. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable path.
      • CVE-2026-109619: set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. If performance allows, PHP also suggests pm.max_requests=1.
    • PHP 7.4, 8.0 and 8.1 have no upstream release. PHP published minimal source backports, and distributions or LTS vendors may ship patched packages. PHP 5.4 to 7.3 is end of life, so migrate or obtain a vendor backport.
    • Review activity from at least 17 October 2026 for new or modified PHP files, web shells, unexpected admin users, unusual outbound connections, and unexpected child processes or shell commands launched by PHP or the web server. Exploitation need not leave a web shell on disk.
51. infosecurity-magazine.com ↗ · pub. 22/10/2026 07:10 · coletado 22/10 08:01

    PHP2Shell exploitation attempt hit Amazon honeypot four days before disclosure; mass exploitation of PHP flaws now underway

    Adds that the October 20 leak came from a pseudonymous Hacker News forum user, that the University of Vienna also went offline, that Beelzebub is among the firms observing exploitation, and the interim mitigations: restarting PHP workers, restricting multipart/form-data requests and limiting body, section and header sizes. It also adds Amazon's public confirmation of the October 17 attempt.

    ler a análise desta fonte ocultar

    Adds that the October 20 leak came from a pseudonymous Hacker News forum user, that the University of Vienna also went offline, that Beelzebub is among the firms observing exploitation, and the interim mitigations: restarting PHP workers, restricting multipart/form-data requests and limiting body, section and header sizes. It also adds Amazon's public confirmation of the October 17 attempt.

    Amazon Threat Intelligence confirmed that its MadPot honeypot recorded a PHP2Shell exploitation attempt on October 17, 2026, four days before the scheduled October 21 disclosure of CVE-2026-109618 and CVE-2026-109619. The attempt came from an IP address tied to a commercial anonymization network, which Amazon takes as a sign of a threat actor. How the actor obtained exploit information before disclosure is unclear. The unauthenticated RCE flaws affect PHP back to version 5.4, and Amazon says they are now being broadly exploited in the wild. Cloudflare CEO Matthew Prince reported attempts rising from thousands before disclosure to millions after it.

    Technical Details

    • The flaws were found in August by Calif and Wiz (Google Cloud), working with OpenAI's Patch the Planet project. Disclosure was set for October 21 at 2pm GMT.
    • On October 20 a pseudonymous Hacker News forum user leaked information before the patches were ready. French public administrations, the Dutch National Cyber Security Centre and the University of Vienna took sites offline as a precaution.
    • Amazon identified multiple PoCs on October 21 about 12 hours before disclosure. The earliest was seen around 02:00 GMT, with more attempts between 02:00 and 08:00 GMT. Payload and infrastructure variations suggest multiple actors, and it is unclear whether the attempts would have succeeded.
    • Beelzebub, Ellio, Recorded Future, VulnCheck, WatchTowr and Wiz also report exploitation attempts, but real-world success is unconfirmed. Public PoCs released for researchers can also be abused.
    • PHP is used by about 69.7% of websites with a known server-side language (W3Techs), including WordPress, Drupal, Joomla and Magento.

    Remediation

    • Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Patching is the only complete fix.
    • PHP 8.1 and earlier, including PHP 5 and 7, get no official fixes, so migrate to a supported version.
    • Interim measures: disable vulnerable functionality where applicable, restart PHP workers after configuration changes, and restrict unnecessary multipart/form-data requests. Enforce limits on request body size, multipart sections and headers, and keep resource limits in place against memory exhaustion.
    • Cloudflare WAF protects free and paid customers by default, but this does not replace patching.
52. securityweek.com ↗ · pub. 22/10/2026 06:48 · coletado 22/10 08:00

    PHP2Shell RCE flaws probed from Oct 17, four days before patches; mass exploitation attempts follow

    SecurityWeek adds Cloudflare's exploitation volume (thousands in the 10 hours before disclosure, millions afterwards), JFrog's fake PoCs and prank malware on GitHub, a VulnCheck-observed Chinese IP attempting a webshell, Censys exposure figures (about 1.57 million unpatched hosts), and the Log4Shell comparisons by Forescout and Expel. It also adds WatchTowr's statement that circulating PoCs fail to achieve RCE, and that about 920,000 vulnerable hosts are in the US on a handful of cloud providers.

    ler a análise desta fonte ocultar

    SecurityWeek adds Cloudflare's exploitation volume (thousands in the 10 hours before disclosure, millions afterwards), JFrog's fake PoCs and prank malware on GitHub, a VulnCheck-observed Chinese IP attempting a webshell, Censys exposure figures (about 1.57 million unpatched hosts), and the Log4Shell comparisons by Forescout and Expel. It also adds WatchTowr's statement that circulating PoCs fail to achieve RCE, and that about 920,000 vulnerable hosts are in the US on a handful of cloud providers.

    Amazon reports that threat actors began probing for the two critical PHP remote code execution flaws, collectively PHP2Shell (CVE-2026-109618 and CVE-2026-109619), on October 17, four days before patches shipped on October 21. The first attempt hit an Amazon honeypot from a commercial anonymization network, and it is unclear how the actor obtained exploit information during the embargo. After the issues leaked on October 20, PoC exploits spread quickly. Amazon now describes PHP2Shell as broadly exploited in the wild, while WatchTowr says none of the circulating PoCs achieve RCE. Over 1 million internet-facing PHP servers remain unpatched, many on end-of-life versions.

    Technical Details

    • Amazon found multiple PoCs from additional anonymized infrastructure about 12 hours before public disclosure. Payload and origin variations suggest multiple actors.
    • Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within 2 hours, and millions afterwards.
    • WatchTowr's Jake Knott says the sprayed exploits either don't work, test for timing differences, or crash the target. Hadrian, Patchstack and Cloudflare saw attempts hours before the fixes.
    • JFrog observed fake PoCs and prank malware on GitHub. VulnCheck saw at least one Chinese IP unsuccessfully try to deploy a webshell.
    • Exposure: Censys counted about 1.57 million unpatched hosts out of roughly 1.58 million reporting a PHP version (October 21). VulnCheck counted over 2.6 million PHP hosts, at least 1 million on EoL versions. VirusTotal saw about 758,000 EoL hosts versus about 272,000 on supported versions. About 920,000 hosts are in the US, concentrated on providers such as AWS, DigitalOcean, Alibaba, OVHcloud and Hetzner.
    • Forescout's Sai Molige and Expel's Marcus Hutchins compare the event to Log4Shell. Hutchins calls it about 50% of the way there, with worse direct exploitation but a shorter tail.

    Remediation

    • CISA urged immediate updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Investigate for signs of compromise, since in some configurations code executes before security checks run.
    • Until patched, restrict what web-facing PHP processes can launch, access or connect to, and apply WAF rules. These are a backstop, not a substitute for patching.
    • Inventory forgotten and shadow PHP installations, since end-of-life branches may have no upstream fix.
53. thehackernews.com ↗ · pub. 22/10/2026 03:34 · coletado 22/10 08:00

    Amazon Detects PHP2Shell Exploit Attempt Four Days Before Disclosure; Broad Exploitation Follows Patches

    Amazon's own disclosure (CJ Moses) confirms the October 17 pre-disclosure attempt from 103.216.220.92. The article adds new IOCs from VulnCheck (85.11.167.243, 45.198.224.169, 109.71.252.97 and the user-agent php2shell-scan/109618), CrowdStrike's note on near-absent forensic traces, ELLIO's first sensor hit at 08:36 UTC on October 21 after Chainguard's early image release, and Pantheon's 60,000+ blocked requests. It also adds FBI and NSA alerts, CloudLinux fixed packages, OpenAI's Codex checker skill, VulnCheck's host counts and Amazon's warning about AI-accelerated exploit development.

    ler a análise desta fonte ocultar

    Amazon's own disclosure (CJ Moses) confirms the October 17 pre-disclosure attempt from 103.216.220.92. The article adds new IOCs from VulnCheck (85.11.167.243, 45.198.224.169, 109.71.252.97 and the user-agent php2shell-scan/109618), CrowdStrike's note on near-absent forensic traces, ELLIO's first sensor hit at 08:36 UTC on October 21 after Chainguard's early image release, and Pantheon's 60,000+ blocked requests. It also adds FBI and NSA alerts, CloudLinux fixed packages, OpenAI's Codex checker skill, VulnCheck's host counts and Amazon's warning about AI-accelerated exploit development.

    Amazon Threat Intelligence reported that its MadPot honeypot recorded an exploit attempt against the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on October 17, 2026, four days before the vulnerabilities were publicly disclosed. The attempt came from 103.216.220.92, an Australia-geolocated address tied to a commercial anonymization network, and it is unclear how the actor obtained exploit information while the flaws were under embargo. Both flaws are rated 9.2 CVSS and enable pre-authentication RCE in PHP core. Exploitation became broad after patches shipped on October 21, with multiple PoCs and varied payloads suggesting several threat actors. Amazon, CrowdStrike, VulnCheck, Cloudflare, ELLIO and Pantheon all report attack traffic, and the NCSC, CISA, FBI and NSA urge immediate patching.

    Technical Details

    • The flaws sit in PHP memory management and error handling, so any reachable PHP endpoint is exposed, including static forms, login routes and health checks, regardless of CMS, framework or plug-ins. The article states they affect every release of the 7.x and 8.x series.
    • CrowdStrike says exploitation leaves almost no traces: workers stay stable, responses return HTTP 200, application logs show nothing, and the only server-side trace is a single memory-limit fatal error in the web server error log.
    • Amazon saw the earliest PoC attempt around 02:00 UTC on October 21, followed by six hours of attempts from anonymized infrastructure. The payload variety points to multiple actors.
    • ELLIO saw the first PHP2Shell request on its sensors at 08:36 UTC on October 21, less than an hour after Chainguard published built images containing the fix, which the PHP Foundation says broke the embargo.
    • VulnCheck honeypots saw 85.11.167.243 and 45.198.224.169 using the user-agent php2shell-scan/109618 against CVE-2026-109618, and 109.71.252.97 using both flaws.
    • Cloudflare saw attackers mutating payloads to evade its WAF rules. Pantheon blocked more than 60,000 suspicious requests.
    • Exposure estimates: VulnCheck found PHP on 2,608,039 internet-facing hosts, over 700,000 of them on PHP 3.x-7.3. Modat counted 4.38 million services as of October 20, 79% on unsupported branches.
    • Amazon's CISO CJ Moses says AI-assisted analysis lowers the cost of turning a patch diff into a working exploit, shrinking patch-to-exploit time to hours or minutes.

    Remediation

    • Patch immediately or take affected systems offline, as the NCSC and CISA advise.
    • The FBI advises monitoring web servers for PHP processes unexpectedly launching command shells or downloading files.
    • Know where PHP is deployed, including bundled in OS distributions and legacy environments, and assign ownership of remediation (Sonatype).
    • CloudLinux released fixed packages for ea-php52 through ea-php85 and all alt-php versions.
    • OpenAI released a Codex skill to check whether a website or local PHP binary is vulnerable.
54. gbhackers.com ↗ · pub. 22/10/2026 02:06 · coletado 22/10 04:00

    PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) exploited from Oct 17, four days before patches

    Amazon's MadPot honeypots recorded the earliest PHP2Shell exploitation attempt on October 17, 2026, four days before disclosure. The source was 103.216.220.92, on anonymization infrastructure. PoCs appeared around 02:00 UTC on October 21, and Amazon saw multiple actors. Amazon advises starting hunts from October 17 and looking for PHP_SESSION_UPLOAD_PROGRESS in POST data. This pushes the earliest known exploitation well before the October 21 first-attempt reports.

    ler a análise desta fonte ocultar

    Amazon's MadPot honeypots recorded the earliest PHP2Shell exploitation attempt on October 17, 2026, four days before disclosure. The source was 103.216.220.92, on anonymization infrastructure. PoCs appeared around 02:00 UTC on October 21, and Amazon saw multiple actors. Amazon advises starting hunts from October 17 and looking for PHP_SESSION_UPLOAD_PROGRESS in POST data. This pushes the earliest known exploitation well before the October 21 first-attempt reports.

    Amazon's MadPot honeypot network recorded exploitation attempts against the two critical PHP flaws, collectively called PHP2Shell, on October 17, 2026. That was four days before public disclosure and the security updates. CVE-2026-109618 and CVE-2026-109619 both score 9.2 (CVSS v4.0) and allow unauthenticated remote code execution. The earliest attempt came from 103.216.220.92, an address tied to commercial anonymization infrastructure. Amazon assessed this as likely threat actor activity, but investigators have not established how the attacker obtained exploit information before the embargo lifted. Amazon says the attempts were not confirmed to have succeeded, and later described PHP2Shell as broadly exploited in the wild.

    Technical Details

    • CVE-2026-109618: when memory exhaustion interrupts initialization of internal request data, cleanup treats the partially initialized data as valid. This creates memory corruption that can lead to RCE.
    • CVE-2026-109619: stale global state and use-after-free. State retained from one request can reference freed memory that a later request in the same worker accesses. PHP also confirms memory disclosure as an impact.
    • The defects are in PHP itself, so PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected. mod_php is the most exposed because exploitation can occur before application code runs.
    • Timeline per Amazon: PoCs appeared around 02:00 UTC on October 21, about 12 hours before the 14:00 UTC embargo lift. MadPot recorded more attempts from anonymized infrastructure between 02:00 and 08:00 UTC. Differing payloads and infrastructure point to multiple actors rather than one coordinated campaign. More exploit code appeared within hours of disclosure.
    • Amazon links shrinking exploit-development windows to AI-assisted analysis but does not establish that AI produced the pre-disclosure attacks.

    Remediation

    • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Distribution users should check vendor advisories. Minimal source backports exist for PHP 7.4 through 8.1, but there is no official release.
    • Amazon states that upgrading is the only complete fix. Configuration changes cannot fully resolve the combined exposure. Temporarily blocking multipart file uploads may reduce exposure, subject to testing against application functionality.
    • Start investigations no later than October 17. Review POST requests containing PHP_SESSION_UPLOAD_PROGRESS in form data, web server logs, and unexpected process execution or file modifications on application servers.
    • Treat Amazon's IP indicators as investigative leads, not automatic attribution or grounds for blanket blocking, because they include shared anonymization infrastructure. Deploy behavior-based detections.
55. gbhackers.com ↗ · pub. 22/10/2026 02:15 · coletado 22/10 04:00

    PHP releases emergency fixes for two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619

    gbhackers.com adds the mechanism of each flaw and of the OOM fix, the multipart routes to memory exhaustion, the confirmed CVE-2026-109619 paths (PHP 8.5 fatal-error backtraces, session upload progress) and detailed interim mitigations, including the warning against changing RLIMIT_AS/RLIMIT_DATA and the limits of memory_limit=-1.

    ler a análise desta fonte ocultar

    gbhackers.com adds the mechanism of each flaw and of the OOM fix, the multipart routes to memory exhaustion, the confirmed CVE-2026-109619 paths (PHP 8.5 fatal-error backtraces, session upload progress) and detailed interim mitigations, including the warning against changing RLIMIT_AS/RLIMIT_DATA and the limits of memory_limit=-1.

    PHP released emergency security updates, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored CVSS v4.0 9.2. The PHP project treats every installation serving web requests as potentially at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php has the highest demonstrated risk: researchers achieved code execution through unauthenticated requests before any application code runs, with the privileges of the web worker account. Configuration changes cannot fully remove the exposure, so administrators are told to update immediately.

    Technical Details

    • CVE-2026-109618 affects PHP's out-of-memory (OOM) handling. PHP used longjmp() to abandon execution when allocation failed. If that happened while request data was only partly initialized, shutdown routines could operate on invalid internal structures, causing memory corruption and potential RCE.
    • Multipart request processing offers several routes to memory exhaustion. Requests without usable Content-Length information can bypass initial size checks, and excessive multipart headers and nested file metadata can consume disproportionate memory. Apache mod_php performs an unconditional request shutdown after startup failures, which exposes the corrupted state before application logic begins.
    • The patch replaces the abrupt failure with a delayed, graceful failure at a safe point in the virtual machine. A higher memory threshold triggers immediate process termination through _exit(), which prevents unsafe cleanup.
    • CVE-2026-109619 involves request-owned memory that persistent worker globals still reference after it has been freed. Fatal errors or late shutdown diagnostics can leave stale error, session, object or extension state available to later requests. Exploitation needs one operation to leave the stale state and another request on the same worker to consume it before initialization resets the globals.
    • Confirmed paths are fatal-error backtraces in PHP 8.5 and session upload progress processing. Researchers validated RCE against mod_php and, through specific application-dependent session paths, against PHP-FPM. Multiple workers lower the per-request success chance but do not remove the vulnerability.

    Remediation

    • Deploy the corrected release for your branch, or obtain vendor packages with backported fixes. PHP 8.1 and older receive no upstream updates, so consult your distribution or LTS provider, or migrate to a supported release.
    • Temporary measures: disable session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces, then restart all workers. These block the confirmed paths but not every variant, and suppressing displayed errors does not prevent exploitation of the stale state.
    • Setting memory_limit=-1 avoids the predictable PHP memory-limit trigger but still allows underlying allocation failures. Conservative request limits and container or cgroup boundaries reduce exposure and availability risk. Do not replace RLIMIT_AS or RLIMIT_DATA, since this may trigger vulnerable allocation failures.
    • Updating is the only complete fix for both vulnerabilities.
56. recordedfuture.com ↗ · pub. 20/10/2026 21:00 · coletado 21/10 22:00

    PHP2Shell: critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 face exploitation attempts as patches ship

    Recorded Future (Insikt Group) adds a technical breakdown of each CVE: a UAF in the session upload-progress unserializer, a fatal-error backtrace UAF and an OPcache type-confusion bug. It adds Wiz's demonstrated RCE against WordPress, Drupal and Joomla and the Patchstack exploitation reports from 07:34 UTC. It also adds the invalidation of J4ck3LSyN's PoC theory, the Modat and VirusTotal exposure figures (about 5.1 million PHP IPs, SSH/MySQL/RDP co-exposure, about 85,000 IPs on the September 24 releases), a precise disclosure timeline (Wiz discovery Aug 19, reported Aug 24, PHP acknowledgement Sep 21, leaked archive on VirusTotal 02:29 UTC, release 13:52 UTC) and the advice to extend the hunting lookback before October 20.

    ler a análise desta fonte ocultar

    Recorded Future (Insikt Group) adds a technical breakdown of each CVE: a UAF in the session upload-progress unserializer, a fatal-error backtrace UAF and an OPcache type-confusion bug. It adds Wiz's demonstrated RCE against WordPress, Drupal and Joomla and the Patchstack exploitation reports from 07:34 UTC. It also adds the invalidation of J4ck3LSyN's PoC theory, the Modat and VirusTotal exposure figures (about 5.1 million PHP IPs, SSH/MySQL/RDP co-exposure, about 85,000 IPs on the September 24 releases), a precise disclosure timeline (Wiz discovery Aug 19, reported Aug 24, PHP acknowledgement Sep 21, leaked archive on VirusTotal 02:29 UTC, release 13:52 UTC) and the advice to extend the hunting lookback before October 20.

    Recorded Future's Insikt Group reports that two critical PHP engine RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), are being targeted in early exploitation attempts after technical details leaked ahead of PHP's coordinated release. PHP shipped fixes on October 21, 2026 (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12). Both flaws are rated 9.2 under CVSS v4.0. They were found by Wiz Research with Calif and OpenAI and reported to PHP in August. Because the bugs sit in PHP itself, sites on WordPress, Drupal and Joomla are exposed even if the application code is secure. The available reporting does not establish the extent of successful exploitation, and the effectiveness of public PoCs varies.

    Technical Details

    • Both CVEs are memory-safety bugs in PHP's handling of request memory during initialization, error handling and cleanup. Out-of-memory (OOM) failures and stale internal state can expose freed or partially initialized memory.
    • CVE-2026-109618: an OOM-related flaw with partially initialized request memory. Wiz found a use-after-free (UAF) in the session upload-progress unserializer and a related worker-memory disclosure. It demonstrated unauthenticated RCE against WordPress, Drupal and Joomla.
    • CVE-2026-109619: a stale-state flaw where PHP globals keep references to freed request memory. It includes a UAF involving fatal-error backtraces and a separate OPcache type-confusion bug. Wiz demonstrated unauthenticated RCE against Drupal and WordPress.
    • Session upload-progress has existed since PHP 5.4.0 and is enabled by default (per VirusTotal). Memory disclosure can leak passwords, tokens, API keys and certificates from other requests. Exploitation happens below the application layer, so application logs may show little.
    • Exploitation reports: Patchstack received reports of multiple active incidents from hosting partners by 07:34 UTC on Oct 21. Cloudflare CTO Dane Knecht reported early attacks, and Cloudflare deployed WAF rules.
    • Two PoCs by researcher J4ck3LSyN (poc0_109618.py, poc1_109619.py) rested on a cached-pointer UAF theory that the author later invalidated. Insikt has not independently tested any public PoC.
    • Exposure: Modat counted 4,384,302 PHP services on 1,886,612 hosts, about 79% of those with a readable version on unsupported branches (PHP 7.4: 878,761 services). VirusTotal counted about 5.1 million PHP IPs, of which only about 1.1 million disclose a version; about 758,000 of those run EOL branches. About 85,000 IPs ran the September 24 releases, which were not protected. VirusTotal also saw about 394,000 PHP hosts exposing SSH, 233,000 MySQL and 68,000 RDP.
    • Timeline: discovery Aug 19; reported to PHP Aug 24; PHP acknowledged Sep 21; emergency release announced Oct 20; leaked archive first submitted to VirusTotal at 02:29 UTC Oct 21; fixes released at 13:52 UTC Oct 21, ahead of the planned 14:00.

    Remediation

    • Upgrade to the patched versions, prioritizing internet-facing systems. Include PHP embedded in third-party applications, containers and managed services. Migrate off unsupported branches or obtain vendor-maintained fixes.
    • Inventory PHP deployments. Where patching is not feasible, restrict external access, apply WAF rules and request filtering, harden PHP configuration, and block direct origin access. These are not substitutes for patching.
    • Hunt for anomalous HTTP requests, PHP process failures and unexpected command execution, starting from October 20, 2026 or earlier. Rotate potentially exposed credentials and start incident response where compromise is found.
57. theregister.com ↗ · pub. 21/10/2026 20:02 · coletado 21/10 22:00

    PHP Foundation blames Chainguard for breaking embargo on PHP2shell RCE flaws CVE-2026-109618 and CVE-2026-109619

    The Register adds the dispute over the broken embargo. The PHP Foundation says Chainguard published fixed images at 07:41 UTC on October 21, over six hours early. Lorenc says Chainguard did not leak and acted because of public PoCs and reports of exploitation. Chainguard's honeypots saw attack IPs from China and Russia, the CVE IDs began circulating around 15:00 UTC on October 20, and mitigation advice given to critical infrastructure providers may also have leaked.

    ler a análise desta fonte ocultar

    The Register adds the dispute over the broken embargo. The PHP Foundation says Chainguard published fixed images at 07:41 UTC on October 21, over six hours early. Lorenc says Chainguard did not leak and acted because of public PoCs and reports of exploitation. Chainguard's honeypots saw attack IPs from China and Russia, the CVE IDs began circulating around 15:00 UTC on October 20, and mitigation advice given to critical infrastructure providers may also have leaked.

    PHP maintainers released emergency patches for two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2shell), then accused Chainguard of breaking the coordinated disclosure embargo. According to the PHP Foundation, Chainguard published built images containing the fix at 07:41 UTC on October 21, more than six hours before the planned release, letting attackers study the fix in binary form. Chainguard CEO Dan Lorenc does not dispute the timeline but says the company did not leak. He says rumors, public PoCs and third-party reports of real-world exploitation justified shipping the fixes early. The disclosure was already disrupted: CVE IDs circulated online from about 15:00 UTC on October 20, and Calif mistakenly published a PoC video. Chainguard says its honeypots caught IPs from China and Russia targeting the flaws on Wednesday.

    Technical Details

    • Both bugs are memory corruption issues in PHP memory management and error handling. A request that ends unexpectedly leaves corrupted internal state that a later request can reuse, leading to memory disclosure or RCE.
    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is RCE via out-of-memory corruption. A request hitting memory_limit at the wrong moment leaves partially initialized data that PHP later treats as valid. On Apache with mod_php, an unauthenticated request can trigger it before any application code runs.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is RCE via stale state. A fatal error leaves internal state pointing to memory from a previous request, and a later request on the same worker reuses the freed memory (use-after-free). RCE was demonstrated against a real application on Apache with mod_php.
    • Wiz says every PHP version of the last decade, back to 5.4, is affected by at least one of the flaws.
    • Lorenc says Chainguard independently found the same memory corruption bugs using an AI harness and a frontier model with a basic prompt.
    • The flaws were found between August and September by researchers at Calif, OpenAI and Wiz, who say they used AI models.

    Remediation

    • Patch immediately. Wiz strongly advises immediate patching.
    • The scope of exploitation, and what happens to legacy systems without security fixes, remain unknown.
58. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 16:12 · coletado 21/10 18:00 só resumo do feed

    Cisco issues critical advisory on PHP2shell RCE flaws CVE-2026-109618 and CVE-2026-109619 in PHP, affecting Cisco products

    Cisco has published a vendor advisory (cisco-sa-php-october26-Jj384Daq) confirming that Cisco products are affected by CVE-2026-109618 and CVE-2026-109619 (PHP2shell), with a Security Impact Rating of Critical. It adds Cisco to the list of vendors with downstream impact, alongside Palo Alto Networks. The excerpt names no specific products or fixes.

    ler a análise desta fonte ocultar

    Cisco has published a vendor advisory (cisco-sa-php-october26-Jj384Daq) confirming that Cisco products are affected by CVE-2026-109618 and CVE-2026-109619 (PHP2shell), with a Security Impact Rating of Critical. It adds Cisco to the list of vendors with downstream impact, alongside Palo Alto Networks. The excerpt names no specific products or fixes.

    Cisco published a security advisory (cisco-sa-php-october26-Jj384Daq) on the two critical PHP vulnerabilities addressed by the PHP Foundation's Critical PHP Security release of October 21, 2026. The flaws are CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), referenced as PHP2shell. Cisco assigns the advisory a Security Impact Rating of Critical, which indicates that some Cisco products are affected. The excerpt does not list the affected Cisco products, fixed releases or exploitation status.

    Technical Details

    • The upstream issues are tracked in the PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
    • Cisco's text gives no further technical detail beyond the CVE titles (OOM corruption and stale global state).

    Remediation

    • Consult the Cisco advisory for the list of affected Cisco products and fixed software; the article excerpt does not provide it.
59. sentinelone.com ↗ · pub. 21/10/2026 16:21 · coletado 21/10 18:00

    PHP2Shell: critical unauthenticated RCE and memory disclosure flaws (CVE-2026-109618, CVE-2026-109619) patched in PHP; SentinelOne detection guidance

    SentinelOne adds the CWE classification (CWE-416, CWE-755), the root-cause mechanics (longjmp skipping cleanup), the AI-assisted discovery timeline (2024 OSTIF/Quarkslab audit, report on August 11 and Wiz vectors on August 24), the PHPSESSID memory-disclosure indicator, Talos' estimate that about half of internet-facing PHP is on end-of-life branches, detailed interim hardening and hunting guidance, and its stance of no verified public PoC and no confirmed compromise as of October 21.

    ler a análise desta fonte ocultar

    SentinelOne adds the CWE classification (CWE-416, CWE-755), the root-cause mechanics (longjmp skipping cleanup), the AI-assisted discovery timeline (2024 OSTIF/Quarkslab audit, report on August 11 and Wiz vectors on August 24), the PHPSESSID memory-disclosure indicator, Talos' estimate that about half of internet-facing PHP is on end-of-life branches, detailed interim hardening and hunting guidance, and its stance of no verified public PoC and no confirmed compromise as of October 21.

    On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), collectively called PHP2Shell. An unauthenticated attacker can send a single crafted HTTP request to achieve remote code execution as the web worker or read process memory (passwords, tokens, API keys, certificates). The flaws affect PHP from 5.4.0 onward. On Apache with mod_php the attack runs before any application code executes. The bugs were found through AI-assisted auditing by Calif, Wiz and OpenAI, working with the PHP security team. SentinelOne reports no verified public proof-of-concept as of October 21 and no confirmed in-the-wild compromise, but Cloudflare observed attack attempts after the CVE IDs leaked on October 20. The article focuses on post-exploitation detection with the Singularity agent, Singularity AI SIEM and Purple AI, and on hardening.

    Technical Details

    • Root cause: on a fatal condition such as exhausting the memory limit, PHP exits the C call stack with longjmp, so no cleanup runs and half-built state is later trusted (CWE-416, CWE-755).
    • CVE-2026-109618 (out-of-memory): request data is marked valid before memory is allocated. If allocation fails, the entry points at uninitialized heap memory that cleanup then processes. On mod_php the request shutdown runs unconditionally.
    • CVE-2026-109619 (stale state): after a fatal error a global pointer refers to freed memory, and a later request on the same worker can use it before initialization, giving a use-after-free. Session upload progress (enabled by default) is a confirmed trigger.
    • The attacker sends a crafted multipart request. A chunked or lengthless request bypasses the post_max_size check, and empty file controls with deeply nested field names inflate allocations.
    • Code execution runs as the web worker (commonly www-data). PHP confirmed full RCE on mod_php with default input and memory limits. PHP-FPM is susceptible by source analysis.
    • The memory-disclosure path returns data from other requests via the PHPSESSID response cookie and runs no code, so endpoint telemetry cannot see it. Wiz notes application logs hold little context.
    • Post-exploitation: webshell drop into the web root, spawning sh, bash, python, curl and wget, outbound connections, and lateral movement with recovered credentials.
    • Cloudflare saw attackers mutating payloads to bypass its WAF rules.
    • PHP 8.1 and older receive no official fix. Source-only backports exist for 7.4, 8.0 and 8.1. Talos estimates around half of internet-facing PHP runs on branches with no official update.

    Remediation

    • Update every PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-fixed package, and restart Apache, PHP-FPM and long-running workers. Verify the version the web server actually loads.
    • Inventory internet-facing PHP, including copies bundled in appliances, cPanel and Plesk. Isolate PHP 8.1 and older until upgraded.
    • Rotate credentials, tokens and keys reachable by workers on exposed, unpatched systems.
    • Interim and partial only: memory_limit=-1 with a low post_max_size, session.upload_progress.enabled=0, fatal_error_backtraces=0 on PHP 8.5, WAF limits on multipart requests, lower pm.max_requests, and SELinux or AppArmor.
    • Hunt for web server workers spawning shells or download tools, new files in web roots, multipart requests followed by memory-limit errors or HTTP 500 bursts, and oversized PHPSESSID cookies.
60. github.com ↗ · pub. 21/10/2026 16:18 · coletado 21/10 16:33

    PHP2Shell: public PoC lab and five RCE chains published for CVE-2026-109618 and CVE-2026-109619 in PHP core

    A public GitHub repository (mirror of ikow/php2shell-poc by Qi Deng) now provides a Docker lab and verification PoCs for five claimed PHP2Shell attack chains, including a pre-auth Apache mod_php RCE and a claimed FPM path. It cites a different patch commit (3584a98bda) than elastic.co and conflicts with earlier statements that no reliable public PoC existed and that no full FPM exploit had been shown.

    ler a análise desta fonte ocultar

    A public GitHub repository (mirror of ikow/php2shell-poc by Qi Deng) now provides a Docker lab and verification PoCs for five claimed PHP2Shell attack chains, including a pre-auth Apache mod_php RCE and a claimed FPM path. It cites a different patch commit (3584a98bda) than elastic.co and conflicts with earlier statements that no reliable public PoC existed and that no full FPM exploit had been shown.

    A GitHub mirror of Qi Deng's ikow/php2shell-poc repository, published on October 21, 2026, documents and provides verification PoCs for five attack chains behind PHP2Shell, the pre-authentication RCE flaws CVE-2026-109618 and CVE-2026-109619 in PHP core. The author claims the vulnerable code dates back to PHP 5.4.0 (2012) and affects PHP through 8.5.11, and that Apache mod_php is exploitable with no application-level vulnerability (Chain D). The repository ships a Docker lab (PHP-FPM, nginx, Apache mod_php) and scripts that confirm vulnerability, lowering the barrier for defenders and attackers alike. The author states that full exploit code is restricted to paid subscribers of a Substack writeup. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the author says patching is the only complete fix.

    Technical Details

    • Chain A: PHP code in an uploaded filename is stored raw in the session file by session.upload_progress (enabled by default), then executed through any local file inclusion (LFI) in the application.
    • Chain B: a var_destroy() use-after-free in which __destruct fires without serialize_lock. The author reports an ASAN-confirmed heap-use-after-free at var_unserializer.c:851, with roughly 60% reliability.
    • Chain C: a session serialize handler mismatch (php_serialize vs php) splits the filename at | and deserializes an injected object. __destruct fires even when decoding fails.
    • Chain D: a multipart POST triggers OOM during request startup, longjmp() skips init_executor, and shutdown runs on stale EG() globals, giving a use-after-free. It needs no preconditions on Apache mod_php or FrankenPHP; FPM children exit.
    • Chain E: a large session decode triggers OOM and leaves BG(unserialize) dirty in an FPM worker that survives. A later upload_progress request, handled by the rfc1867 handler before basic_rinit, touches the stale state and fires __destruct on stale objects.
    • The writeup also lists session fixation (PHPSESSID accepted from the POST body despite use_only_cookies, fix in PR #22113), unvalidated filename storage and a PS(serializer) leak across FPM requests.
    • The author cites patch commit 3584a98bda (300 files), which replaces longjmp() with a delayed soft OOM plus a hard _exit().
    • Claimed scale: PHP runs on 78% of websites and WordPress on 43%.

    Remediation

    • Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Versions 8.1 and older, EOL, have no official fix.
    • Interim hardening only: session.upload_progress.enabled=Off, session.use_only_cookies=On and session.use_strict_mode=On. This blocks Chains A, C and partly E, but not Chain D or the engine-level OOM corruption.
    • Detection hints from the author: grep web logs for PHP_SESSION_UPLOAD_PROGRESS, and check for .user.ini files that set differing serialize_handler values.
61. security.paloaltonetworks.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:02

    Palo Alto Networks: PAN-OS and Panorama affected by PHP RCE flaws CVE-2026-109618 and CVE-2026-109619; fix pending

    Palo Alto Networks' PSIRT advisory confirms that PAN-OS and Panorama are affected by the PHP flaws. It rates them Severity HIGH with CVSS-B 8.7 (7.1 behind a jump box), reports no known exploitation against its products, and says PAN-OS fixes are still pending. It also lists interim mitigations: management interface restriction, Threat ID 543004, and IPS signatures 97622-97625.

    ler a análise desta fonte ocultar

    Palo Alto Networks' PSIRT advisory confirms that PAN-OS and Panorama are affected by the PHP flaws. It rates them Severity HIGH with CVSS-B 8.7 (7.1 behind a jump box), reports no known exploitation against its products, and says PAN-OS fixes are still pending. It also lists interim mitigations: management interface restriction, Threat ID 543004, and IPS signatures 97622-97625.

    Palo Alto Networks published a PSIRT advisory on the two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Its product evaluation lists PAN-OS and Panorama as affected, with no special configuration required. The vendor rates the issue Severity HIGH with Suggested Urgency MODERATE and a CVSS-B of 8.7, and says it is not aware of any malicious exploitation against its products. Fixed PAN-OS releases are not yet available, so interim mitigations are the main defense. The risk is highest where the management interface is reachable from the internet.

    Technical Details

    • CVE-2026-109618: longjmp() handling of out-of-memory errors leaves request memory uninitialized through improper control flow management, so attackers can reliably reach RCE with OOM triggers.
    • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed regions that are read or branched on in later requests, enabling arbitrary code execution.
    • Weakness and pattern classification: CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CAPEC-153 (Input Data Manipulation).
    • The advisory gives CVSS-B 8.7 for PAN-OS with the management interface exposed to the internet, and CVSS-B 7.1 when access is restricted to a jump box. It quotes 9.2 as the base score for the underlying PHP flaws.
    • CPE entries list PAN-OS and Panorama as vulnerable in all versions.

    Remediation

    • A fix will ship in upcoming PAN-OS releases, and the advisory will be updated with fixed versions and estimates.
    • Restrict management interface access to trusted internal IP addresses, ideally through a single jump box.
    • Customers with Frontier Virtual Patching (ATP Plus) on PAN-OS 12.2.4 received advance coverage through Threat ID 543004, released at 10:21 PM PT on Oct 20.
    • Advanced Threat Prevention released standard IPS coverage (signatures 543004, 97622, 97623, 97624 and 97625) on Oct 21.
    • Unit 42 publishes further detail on Palo Alto Networks protection capabilities.
62. theregister.com ↗ · pub. 21/10/2026 12:08 · coletado 21/10 14:00

    PHP ships emergency fixes for CVE-2026-109618 and CVE-2026-109619 as exploit attempts begin and sites go offline

    The Register adds that watchTowr sees in-the-wild attempts using vibecoded PoCs with "php2shell" User-Agents (none successful yet), that the privacy group noyb also temporarily withdrew its website, and Huntress's comment on how hard it is to inventory vulnerable PHP installations.

    ler a análise desta fonte ocultar

    The Register adds that watchTowr sees in-the-wild attempts using vibecoded PoCs with "php2shell" User-Agents (none successful yet), that the privacy group noyb also temporarily withdrew its website, and Huntress's comment on how hard it is to inventory vulnerable PHP installations.

    PHP developers released emergency updates (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. CERT-EU scores both 9.2 and advised isolating exposed applications from public networks where patching was not feasible. watchTowr reports in-the-wild exploitation attempts using vibecoded PoCs with "php2shell" User-Agents, none successful so far. Finnish government services, Dutch parliament and cybersecurity authority sites, and the privacy group noyb took sites offline as a precaution.

    Technical Details

    • All PHP installations serving web requests are potentially affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
    • PHP considers mod_php the highest risk, with a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs.
    • watchTowr sensors show a variety of PoCs hitting them with "php2shell" User-Agent strings.
    • Huntress notes that PHP underpins WordPress, Drupal, Joomla, Magento, shared hosting, control panels and software that does not advertise its PHP use, which makes finding vulnerable installations hard.

    Remediation

    • Update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • Where patching is not immediately possible, isolate internet-facing PHP applications from public networks or take them offline (CERT-EU).
63. securityweek.com ↗ · pub. 21/10/2026 13:50 · coletado 21/10 14:00

    PHP2Shell patches released as first in-the-wild exploitation attempts hit sensors; CVE-2026-109618/109619 critical PHP RCE

    Exploitation is now reported: watchTowr saw the first in-the-wild attempts around patch release without success, Hadrian reported at-scale exploitation via the session upload-progress path before the fixes, and Patchstack, Cloudflare and Vega also saw attempts. Also new: the OOM flaw's 2020/2024 history, the August 11 report date, Wiz's note on four grouped issues and untracked variants, 15 new PHP CVEs since July 1, and Chainguard's early release of fixed images.

    ler a análise desta fonte ocultar

    Exploitation is now reported: watchTowr saw the first in-the-wild attempts around patch release without success, Hadrian reported at-scale exploitation via the session upload-progress path before the fixes, and Patchstack, Cloudflare and Vega also saw attempts. Also new: the OOM flaw's 2020/2024 history, the August 11 report date, Wiz's note on four grouped issues and untracked variants, 15 new PHP CVEs since July 1, and Chainguard's early release of fixed images.

    PHP released patches for two critical unauthenticated RCE flaws, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), collectively named PHP2Shell and rated CVSS 9.2. RCE was confirmed on Apache with mod_php. watchTowr saw the first in-the-wild exploitation attempts around patch time but no successes, while Hadrian reported exploitation at scale before the fixes shipped, mostly abusing PHP's session upload-progress path. Patchstack, Cloudflare and Vega also observed attempts, and Vega's leveraged a public PoC. The flaws affect nearly all PHP releases back to 5.4 and were found by Wiz, OpenAI and Calif with frontier AI help.

    Technical Details

    • Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1.
    • All PHP installations handling web requests are potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
    • The flaws can also be used to read sensitive process memory, which may hold credentials and API keys.
    • Wiz says the two CVEs group four memory-safety issues and do not cover all variants; tracked and likely untracked variants exist.
    • An OOM flaw was first found in 2020 and rediscovered in 2024, but went unpatched because exploitation was unproven. Calif and OpenAI independently reported OOM-to-RCE on August 11, and OpenAI and Wiz later reported more vectors.
    • Disclosure was planned for October 22 but leaked on October 20, so patches shipped a day early. A PoC video was mistakenly published, and Chainguard released fixed images six hours before the coordinated release. Cloudflare deployed protections nine hours before disclosure.

    Remediation

    • Patch immediately. Workarounds reduce exposure to specific attack paths but do not make an installation safe.
    • Inventory where PHP runs, and check whether systems were reached before the fix was applied.
64. thehackernews.com ↗ · pub. 21/10/2026 11:00 · coletado 21/10 14:00

    PHP ships emergency fixes for PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 as exploit attempts emerge

    The article adds PHP advisory details: the nearly complete affected-version scope back to PHP 5.4, the FPM versus mod_php exploitability nuance, memory disclosure without code execution, specific interim mitigations and the new hard memory limit, detection hints, confirmation that session upload progress is part of one attack path, precautionary outages at BambooHR and Dutch government services, the Codex Security and Gemini roles, and AI-assisted exploit development.

    ler a análise desta fonte ocultar

    The article adds PHP advisory details: the nearly complete affected-version scope back to PHP 5.4, the FPM versus mod_php exploitability nuance, memory disclosure without code execution, specific interim mitigations and the new hard memory limit, detection hints, confirmation that session upload progress is part of one attack path, precautionary outages at BambooHR and Dutch government services, the Codex Security and Gemini roles, and AI-assisted exploit development.

    PHP released emergency updates on October 21, 2026 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical unauthenticated remote code execution flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both are rated 9.2 on CVSS v4.0 and affect nearly every PHP version back to 5.4, across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws were found by Wiz, Calif and OpenAI, and the release was pulled forward a day after details leaked. Cloudflare reported early exploit attempts, but no source has confirmed a successful compromise; watchTowr saw no in-the-wild exploitation as of 11:26 UTC and neither CVE was in CISA KEV. Some organizations took services offline as a precaution, including BambooHR and several Dutch government services.

    Technical Details

    • The flaws sit in the PHP engine, not in applications, so even a "Hello World" page on a vulnerable version can be attacked. mod_php is the highest risk, with a demonstrated single unauthenticated request that triggers the attack before any application code runs.
    • PHP-FPM shuts the worker down when a request fails early in setup. For one flaw, PHP says FPM is susceptible but no complete FPM exploit has been shown. The other was shown to reach code execution on both mod_php and PHP-FPM, though the FPM path depends on an operation inside the running application.
    • An attacker can read memory from the PHP worker process (passwords, tokens, API keys, certificates from other requests) without first gaining code execution. This was demonstrated against applications the researchers did not control.
    • Session upload progress (enabled by default) can reach session handling before request setup finishes and is part of one confirmed attack path for CVE-2026-109619. Disabling it does nothing for CVE-2026-109618.
    • The researchers say AI models helped turn the decade-old flaws into working exploits. Calif traced the bug lineage to 2004 PHP research.
    • Suggested indicators: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oddly large PHPSESSID response cookies, and unexplained PHP worker restarts.

    Remediation

    • Update the PHP runtime that serves web requests, then restart Apache, PHP-FPM and long-running PHP workers. Updating WordPress or Laravel does not update the runtime. Distribution packages may carry the fix under an old version number, so check the package changelog for the CVE.
    • PHP 8.1 and older receive no project updates; source backports exist for 7.4, 8.0 and 8.1. PHP 8.2 reaches end of life on December 31, 2026.
    • Interim measures only reduce exposure. For CVE-2026-109618: memory_limit=-1, low post_max_size and request-size limits at the web server or proxy; do not use RLIMIT_AS or RLIMIT_DATA. For CVE-2026-109619: session.upload_progress.enabled=0 with worker restarts, and fatal_error_backtraces=0 on PHP 8.5.
    • After patching, review memory_limit and post_max_size, since the fix adds a new hard memory limit that terminates the process and skips shutdown handlers.
65. wired.com ↗ · pub. 21/10/2026 11:26 · coletado 21/10 12:01

    Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 (php2shell) draw early attacks; European government sites pulled offline

    Wired adds named victims taking sites offline pre-patch (Finnish government including the National Land Survey, French government sites, Port of Rotterdam, per Reuters), Wiz's account of AI-assisted discovery and its php2shell demo, impact on process memory secrets, Sansec's 15-minute mass-attack forecast, FBI reporting guidance, Australian agency warnings and NCSC inventory/monitoring steps.

    ler a análise desta fonte ocultar

    Wired adds named victims taking sites offline pre-patch (Finnish government including the National Land Survey, French government sites, Port of Rotterdam, per Reuters), Wiz's account of AI-assisted discovery and its php2shell demo, impact on process memory secrets, Sansec's 15-minute mass-attack forecast, FBI reporting guidance, Australian agency warnings and NCSC inventory/monitoring steps.

    The PHP Foundation disclosed two critical (CVSS 9.2) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations serving web requests back to PHP 5 (2004). Only PHP 8.2 and newer receive patches, which shipped just before 10 am ET on October 21, 2026. The PHP Foundation states that no complete mitigations exist and that updating is the only safe choice. Cloudflare reported "early attacks emerging" before disclosure, and Sansec expected mass attacks within 15 minutes of release. Per Reuters, multiple Finnish government sites (including the National Land Survey), French government sites and the Port of Rotterdam website went offline as a precaution. Experts such as Lukasz Olejnik warn of worst-case wormable malware.

    Technical Details

    • Wiz says the flaws can let unauthenticated attackers execute code or read sensitive process memory, which may hold passwords, authentication tokens, API keys and certificates belonging to other requests or the server. Its researchers found them partly with AI tools. They dubbed their exploitation demonstration php2shell and say exploitation is in some cases "fairly easily" achieved. OpenAI and Calif say they discovered the issues independently and worked together.
    • Consultant Davi Ottenheimer describes the bug as sitting in a file upload interface, where a single crafted upload to any reachable server is the entire attack.
    • Bleeping Computer and Ars Technica reported that details leaked before the planned publication.
    • Both flaws rated 9.2 CVSS by the PHP Foundation. Supported branches are 8.2 and newer; some distributions and third-party vendors still produce legacy fixes.

    Remediation

    • Update PHP immediately, starting with internet-facing systems. Where that is not feasible, the UK NCSC advises taking the system offline until it is fully mitigated.
    • NCSC: inventory all systems running PHP, focus on internet-connected ones and monitor them for exploitation. Also watch for updates from software vendors that embed PHP in their apps or services.
    • FBI cyber assistant director Brett Leatherman: if compromise is found, isolate the system, preserve web server and PHP logs, and report to the local FBI field office.
    • EU-CERT and Australia's cybersecurity agency had warned teams to prepare to update ahead of release.
66. elastic.co ↗ · pub. 20/10/2026 21:00 · coletado 21/10 12:01

    Elastic details detections for PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell) ahead of a public exploit

    Elastic (elastic.co) adds the patch commit hash (31c0ea7d...), the GHSA IDs and root-cause classes, Wiz Research credited with reporting the flaws using frontier AI models, the expected post-exploitation flow, and a set of Elastic EDR/SIEM detections plus inventory queries. It also states there is still no reliable public PoC.

    ler a análise desta fonte ocultar

    Elastic (elastic.co) adds the patch commit hash (31c0ea7d...), the GHSA IDs and root-cause classes, Wiz Research credited with reporting the flaws using frontier AI models, the expected post-exploitation flow, and a set of Elastic EDR/SIEM detections plus inventory queries. It also states there is still no reliable public PoC.

    Elastic Security Labs published detection and preparation guidance for CVE-2026-109618 and CVE-2026-109619 ("php2shell"), two critical unauthenticated RCE flaws in PHP core. The flaws leaked on October 20, 2026, and the emergency release followed on October 21 at 14:00 UTC. The PHP security team rated both 9.2 (CVSS v4.0). watchTowr confirmed the bugs are real and said it reproduced CVE-2026-109618, but had seen no in-the-wild exploitation, and Elastic notes there is no reliable public PoC. Elastic argues that exploitation converges on a web server or PHP worker spawning shells, downloading payloads or dropping webshells, so behavioral rules can cover it before an exploit is public. The post credits Wiz Research, working with frontier AI models, with reporting the flaws.

    Technical Details

    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is RCE via out-of-memory corruption: OOM handling can interrupt PHP while request data is partially initialized, and cleanup then treats the invalid data as valid.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is RCE via stale global state: request-owned state survives after its memory is freed and a later request on the same worker uses it before initialization.
    • The fix is commit 31c0ea7d7ff1d1fccb6492e52dab544011628065. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Affected are PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk because the trigger fires before any application code runs. PHP 8.1 and older are unsupported, with minimal source backports for 7.4, 8.0 and 8.1.
    • Expected post-exploitation flow: confirmation commands (id, whoami), privilege escalation enumeration (sudo -l, SUID search), interpreter staging (python -c, perl -e, php -r), curl/wget payload retrieval, inline base64 decoding, reverse shells, credential and cloud metadata harvesting (.env, ~/.aws/credentials, 169.254.169.254), webshell drops (.php, .phtml, double extensions) and persistence via cron, systemd or SSH keys. Elastic maps this to T1190, T1059 and T1505.003, and notes that account creation or fileless PHP execution may not be covered.
    • Elastic Defend (EDR) rules: Payload Execution by Web Server, Payload Downloaded via Curl or Wget by Web Server, Suspicious Web Server Child Process.
    • SIEM rules: Suspicious and Unusual Command Execution via Web Server, Suspicious and Unusual Child Execution via Web Server, Unusual File Creation via/by Web Server, File with High Entropy Created by Web Server (needs Elastic Stack 9.3.0+ and linux.advanced.events.populate_file_data=true), and Web Shell Detection: Script Process Child of Common Web Processes.
    • The post includes Kibana process-telemetry and Osquery queries (file, deb_packages, rpm_packages) to inventory PHP on Linux and Windows.

    Remediation

    • Inventory all PHP installs, including bundled runtimes, control panels and CMS platforms, and patch internet-facing systems first.
    • Upgrade or isolate end-of-life PHP (8.1 and older) behind a VPN or WAF.
    • The PHP team states there is no complete mitigation. Partial measures only reduce exposure: memory_limit=-1 set via php_admin_value, a low post_max_size, a cgroup limit, session.upload_progress.enabled=0 with a worker restart, and fatal_error_backtraces=0 on PHP 8.5. ini_set() and .user.ini do not help.
    • Enable the listed Elastic rules and Elastic Defend prevention on PHP hosts. If compromise is suspected, isolate the host, preserve logs, and hunt for webshells, new web-root files, cron jobs, services and accounts.
67. blog.cloudflare.com ↗ · pub. 21/10/2026 10:56 · coletado 21/10 12:00

    Cloudflare deploys default WAF protections against php2shell PHP flaws (CVE-2026-109618, CVE-2026-109619) and reports attack traffic

    Cloudflare's own post (blog.cloudflare.com) adds that its WAF rules were built from early October and deployed about 9 hours before disclosure, with default protection from October 21 at 03:02 UTC. It confirms attack traffic against its customers with payload mutation, credits Calif.io, Wiz, OpenAI and Quarkslab with the disclosure, introduces full transaction detection, and lists the ruleset IDs.

    ler a análise desta fonte ocultar

    Cloudflare's own post (blog.cloudflare.com) adds that its WAF rules were built from early October and deployed about 9 hours before disclosure, with default protection from October 21 at 03:02 UTC. It confirms attack traffic against its customers with payload mutation, credits Calif.io, Wiz, OpenAI and Quarkslab with the disclosure, introduces full transaction detection, and lists the ruleset IDs.

    Cloudflare reports that Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. They affect web servers running PHP 5.4 or later and may allow denial of service, remote code execution and data exposure through specially crafted HTTP requests. Cloudflare worked with the PHP Foundation, OpenAI and Wiz on coordinated mitigations. It built WAF rules from early October 2026, deployed about 9 hours before public disclosure, and enabled them by default for free and paid WAF customers from October 21 at 03:02 UTC. Because the flaws leaked before the official release date, Cloudflare observed attack traffic against its customers, with attackers mutating payloads to bypass the rules. The company still urges customers to patch PHP, treating the WAF only as defense in depth.

    Technical Details

    • Both bugs involve unsafe memory handling when PHP processes a failing HTTP request. In one, PHP runs out of memory before internal data is initialized, and cleanup then uses that unfinished data. In the other, a fatal error leaves references to memory freed at request end, and a later request on the same process follows those stale references, which can expose sensitive data.
    • Large requests can put memory under pressure, but the impact goes beyond resource exhaustion: an attacker may crash a PHP process, leak information or run attacker-supplied code.
    • Cloudflare built full transaction detection, a WAF capability that combines request and response signals from the same HTTP transaction, so a matching response rule can block the origin response before it reaches the requester. php2shell is its first managed detection using it.
    • Free plans get new rules in the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba), including seven "Generic Rules - Anomalous Execution" rules. Paid plans get rules in the Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee). All plans get a default block for high-confidence signatures in the new Cloudflare Managed Response Firewall Default.
    • Cloudflare tracked match volumes against rule logic to detect payload mutation. PHP is used by almost 70% of websites, including WordPress and Magento.

    Remediation

    • Update the PHP runtime itself, since updating site code or plugins does not fix the flaws. If a hosting provider manages PHP, ask it to apply the update, and follow the PHP advisory.
    • Keep Cloudflare WAF protections enabled while patching. Pro, Business and Enterprise customers should confirm the Managed Ruleset is deployed in block mode.
    • Review blocked requests in Security > Security Analytics > Events, filtering by rule ID.
    • Restricting unnecessary uploads and limiting upload sizes can reduce exposure but does not replace the PHP fix.
68. unit42.paloaltonetworks.com ↗ · pub. 21/10/2026 10:40 · coletado 21/10 12:00

    Unit 42 warns of critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 with 22.6M exposed instances and PoCs seen

    Unit 42 (unit42.paloaltonetworks.com) adds that it has seen proof-of-concept code for both flaws, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry counts over 22.6 million potentially vulnerable exposed instances. It also provides the exploitation mechanics (longjmp() handling and OOM triggers, stale global memory) and notes Palo Alto Networks Threat Prevention signature 543004 has been active since October 20, 2026.

    ler a análise desta fonte ocultar

    Unit 42 (unit42.paloaltonetworks.com) adds that it has seen proof-of-concept code for both flaws, that at least one European government took its website offline as a precaution, and that Cortex Xpanse telemetry counts over 22.6 million potentially vulnerable exposed instances. It also provides the exploitation mechanics (longjmp() handling and OOM triggers, stale global memory) and notes Palo Alto Networks Threat Prevention signature 543004 has been active since October 20, 2026.

    Unit 42 (Palo Alto Networks) issued a threat brief on two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 (CVSS 4.0). Unit 42 says it has seen proof-of-concept code for the flaws and that at least one European government took its website offline as a precaution. Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable. Unit 42 urges defenders to assess exposure and patch immediately per the PHP Group's security advisory.

    Technical Details

    • CVE-2026-109618: handling of out-of-memory errors via longjmp() leaves request memory uninitialized because of improper control flow management. Attackers can use out-of-memory (OOM) triggers to reliably achieve RCE.
    • CVE-2026-109619: longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can be read or branched on during later requests, enabling arbitrary code execution.
    • Palo Alto Networks protections: Next-Generation Firewall with Advanced Threat Prevention Plus and Frontier Virtual Patching, via Threat Prevention signature 543004 since October 20, 2026. Cortex XDR, Cloud Runtime and XSIAM address post-exploitation activity. Cortex Cloud Posture and Prisma Cloud Compute detect vulnerable PHP versions. Cortex Xpanse offers a PHP Attack Surface Rule for exposed devices.

    Remediation

    • Review the PHP Group's security advisory and patch immediately, prioritizing internet-facing systems.
    • Assess exposure, for example with the Cortex Xpanse PHP Attack Surface Rule.
    • Engage Unit 42 Incident Response if compromise is suspected.
69. cyberscoop.com ↗ · pub. 21/10/2026 10:40 · coletado 21/10 12:00

    PHP ships emergency fixes for php2shell RCE flaws CVE-2026-109618 and CVE-2026-109619 as Cloudflare sees early attacks

    cyberscoop.com adds a VirusTotal breakdown of servers that disclose their PHP version: about 758,000 run unsupported versions 5.4 through 8.1 versus 272,000 on supported branches. It also confirms the patch release time of 10 a.m. EDT on 21 October, the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, Cloudflare's rollout of stopgap firewall rules to all customers including free accounts, and CISA's KEV listing of three PHP flaws, two used in ransomware campaigns.

    ler a análise desta fonte ocultar

    cyberscoop.com adds a VirusTotal breakdown of servers that disclose their PHP version: about 758,000 run unsupported versions 5.4 through 8.1 versus 272,000 on supported branches. It also confirms the patch release time of 10 a.m. EDT on 21 October, the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, Cloudflare's rollout of stopgap firewall rules to all customers including free accounts, and CISA's KEV listing of three PHP flaws, two used in ransomware campaigns.

    The PHP project moved up an unscheduled security release to Wednesday, 21 October 2026, to fix two flaws it rates critical, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0 and are described by researchers as remote code execution bugs, dubbed php2shell. Details leaked ahead of the planned Thursday embargo, and Cloudflare CTO Dane Knecht said the company was "seeing early attacks emerging". An update to the story confirms the patches shipped as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exposure is broad: researchers estimate 1.3 million to 1.9 million internet-exposed hosts could be vulnerable, and most servers that disclose a version run end-of-life branches.

    Technical Details

    • CERT-EU says the flaws could affect every PHP version from 5 onward; the technical cause and the full list of affected versions were not confirmed before the release.
    • watchTowr said the flaws were under embargo for Thursday and that it had reproduced one of them. A video of an exploit chain was shared by researcher Kirill Firsov, who credited LCFR and Calif.io.
    • Code claiming to exploit the flaws is circulating but is unverified, and security firms warn such code is sometimes laced with malware.
    • Exposure estimates: more than 1.3 million exposed hosts potentially vulnerable, and about 1.9 million in a Shodan search. According to VirusTotal, among servers that disclose their version about 758,000 run PHP 5.4 through 8.1 (unsupported) versus 272,000 on supported branches.
    • PHP runs 70-80% of websites with a known server-side language and underpins WordPress, Drupal, Joomla and Laravel.
    • CISA's KEV catalog lists three PHP vulnerabilities, two of them used in ransomware campaigns.
    • Cloudflare deployed firewall rules for known exploit vectors to all customers, including free accounts, and called them a stopgap.

    Remediation

    • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
    • CERT-EU and the UK NCSC advise preparing to update quickly and isolating internet-facing applications where immediate patching is not feasible.
    • Treat publicly circulating exploit code with caution.
70. bleepingcomputer.com ↗ · pub. 21/10/2026 11:07 · coletado 21/10 12:00

    PHP releases emergency patches for critical unauthenticated RCE flaws PHP2Shell (CVE-2026-109618, CVE-2026-109619)

    The PHP team has now actually released the patches (8.5.12, 8.4.27, 8.3.36, 8.2.35), officially confirming the CVE IDs, unauthenticated RCE, the affected SAPIs and the root cause (memory corruption after abnormal request end, not specifically Session Upload Progress). It also published mitigations, minimal source backports for PHP 7.4/8.0/8.1, discovery credit to Calif, Wiz and OpenAI, and a UK NCSC warning to patch or take systems offline.

    ler a análise desta fonte ocultar

    The PHP team has now actually released the patches (8.5.12, 8.4.27, 8.3.36, 8.2.35), officially confirming the CVE IDs, unauthenticated RCE, the affected SAPIs and the root cause (memory corruption after abnormal request end, not specifically Session Upload Progress). It also published mitigations, minimal source backports for PHP 7.4/8.0/8.1, discovery credit to Calif, Wiz and OpenAI, and a UK NCSC warning to patch or take systems offline.

    The PHP security team released emergency patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked collectively as PHP2Shell. The bugs were found by researchers at Calif, Wiz and OpenAI. They affect all PHP installations that serve web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). Risk is highest for mod_php, where a demonstrated exploit triggers the attack before any application code runs. Cloudflare CTO Dane Knecht said the company saw early attacks before the patches shipped, and the UK NCSC told organizations to update immediately or take PHP systems offline. VirusTotal estimates over 5.1 million exposed PHP hosts.

    Technical Details

    • Both flaws stem from PHP leaving its memory in a corrupted state when a request ends abnormally.
    • CVE-2026-109618 gives RCE as the web worker account through a chain of weaknesses that trigger out-of-memory corruption.
    • CVE-2026-109619 is a stale global state bug that enables an unauthenticated heap use-after-free, memory disclosure and RCE with the web worker's privileges.
    • VirusTotal estimates over 5.1 million exposed PHP hosts, about 3.8 million with at least one open port. PHP powers roughly 75-80% of websites, including WordPress, Joomla and Drupal.
    • Cloudflare had deployed temporary WAF rules for known exploitation methods.

    Remediation

    • Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible. On PHP 7 or earlier, migrate to a fixed release.
    • PHP 8.1 and older no longer receive updates. Ask your distribution or LTS vendor about backports. The PHP team also provided minimal source backports for PHP 7.4, 8.0 and 8.1.
    • Gina Peter Banyard said no mitigation fully blocks attacks and patching is the only permanent defense.
    • Partial mitigations for CVE-2026-109618: set memory_limit=-1 in a way applications cannot override (php_admin_value), set a low post_max_size (8M, or 32M if uploads are needed), and use container or cgroup limits that kill only the affected worker.
    • Partial mitigations for CVE-2026-109619: set session.upload_progress.enabled=0 and restart all workers. On PHP 8.5, set fatal_error_backtraces=0. Remove per-request invalid or deprecated settings that emit diagnostics before initialization, and fix attacker-reachable fatal errors and timeouts. Hiding diagnostics does not help.
71. securityaffairs.com ↗ · pub. 21/10/2026 07:13 · coletado 21/10 10:00

    PHP schedules Oct 21 emergency fixes for two critical php2shell RCE flaws (CVE-2026-109618/109619) after pre-disclosure leak

    securityaffairs.com relays a social media claim that both CVE-2026-109618 and CVE-2026-109619 are heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c). PHP has not confirmed this. The article also states that Huntress had not seen exploitation as of October 21.

    ler a análise desta fonte ocultar

    securityaffairs.com relays a social media claim that both CVE-2026-109618 and CVE-2026-109619 are heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c). PHP has not confirmed this. The article also states that Huntress had not seen exploitation as of October 21.

    The PHP security team announced an emergency security release for October 21, 2026 at 14:00 UTC, fixing two critical vulnerabilities that both carry a CVSS v4.0 score of 9.2. Details leaked online before the planned disclosure. Researchers dubbed the flaws php2shell, tracked as CVE-2026-109618 and CVE-2026-109619, and said they allow remote code execution. These identifiers and the RCE claim come from reports outside PHP's advisory. watchTowr confirmed the flaws are real and reproduced CVE-2026-109618, but is withholding details. A social media post claims both are heap use-after-free bugs in the PHP session upload progress handler. PHP has not confirmed affected versions or fixed releases. Huntress and watchTowr reported no exploitation as of October 21.

    Technical Details

    • A tweet tagged #C4b1NKr3W and #php2shell claims it recreated and lab/field tested both CVEs as two heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c). PHP has not confirmed this.
    • The leaked post cited CVSS 10.0 and impact on versions back to PHP 5. PHP officially rates both flaws 9.2 under CVSS v4.0.
    • watchTowr's FAQ says the all-versions-from-PHP-5 scope is unconfirmed by any vendor advisory, and that no configuration or feature requirement has been described.
    • PHP supports only 8.2 to 8.5. Branches 8.1, 8.0, 7.x and 5.x are end of life and may get no upstream fix.
    • Mallory predicted fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These are predictions, not confirmed.
    • Mallory's Shodan data from October 20 shows about 884,000 internet-facing hosts reporting PHP 8.1 or older, roughly 59% of 1.5 million hosts that disclosed a version. A further 740,000 hosts reported PHP without a version. These are host counts, not confirmed vulnerable systems.
    • For comparison, exploit attempts against CVE-2024-4577 reached Akamai honeypots within 24 hours of disclosure in June 2024.
    • Suggested detection: watch php-fpm, php-cgi, httpd and apache2 spawning sh, bash, python, curl or wget. Florian Roth's process-watcher can log these but does not block anything.

    Remediation

    • Inventory all PHP installs: web servers, Windows systems, vendor appliances, control panels such as cPanel and Plesk, and applications bundling their own PHP runtime.
    • Prepare to patch as soon as fixes ship, internet-facing and business-critical systems first. Check Linux distributions and hosting providers for backported fixes.
    • For end-of-life PHP, upgrade to a supported branch, take services offline, restrict access via VPN or IP allowlist, or place them behind a WAF.
    • CERT-EU recommends considering isolating internet-facing applications from public networks if immediate patching is not possible. This is a precaution, not a confirmed workaround.
    • If compromise is suspected, isolate the server, preserve PHP and web server logs, and check for new web-root files, web shells, cron jobs, scheduled tasks and accounts.
72. thehackernews.com ↗ · pub. 21/10/2026 07:36 · coletado 21/10 09:00

    PHP2Shell: Session Upload Progress setting is no safeguard before the Oct 21 14:00 UTC PHP RCE patch

    The article reports that GMO Flatt Security walked back its own suggestion to set session.upload_progress.enabled=0 as a workaround, that PHP core developer Gina Peter Banyard says patching is the only mitigation, that an anonymous audit disputes the Session Upload Progress theory and says the circulating PoC does not work, and that Upwind still recommends the setting. It also adds configuration verification details, damage-limitation steps from GMO Flatt and the note that Cloudflare's emergency rules do not name PHP.

    ler a análise desta fonte ocultar

    The article reports that GMO Flatt Security walked back its own suggestion to set session.upload_progress.enabled=0 as a workaround, that PHP core developer Gina Peter Banyard says patching is the only mitigation, that an anonymous audit disputes the Session Upload Progress theory and says the circulating PoC does not work, and that Upwind still recommends the setting. It also adds configuration verification details, damage-limitation steps from GMO Flatt and the note that Cloudflare's emergency rules do not name PHP.

    Two critical PHP flaws (rated 9.2 by PHP, collectively called PHP2Shell) cannot be fully blocked before the fix scheduled for 14:00 UTC on October 21. The workaround circulating on social media, session.upload_progress.enabled=0, was suggested by GMO Flatt Security and later walked back by the same firm, which said it is not a complete fix and that bypasses are expected. No attacks had been reported as of the article, and PHP has not disclosed the affected versions, the vulnerable component or any mitigation. PHP core developer Gina Peter Banyard stated that the only mitigation is patching or upgrading PHP. Defenders are advised to reduce exposure, limit what a compromised server can reach and have the update ready to deploy as soon as it lands.

    Technical Details

    • The setting session.upload_progress.enabled controls Session Upload Progress, a PHP feature enabled by default. PHP's manual already advises disabling it where unused, because stored file names and field names "are not validated and may contain PHP code."
    • GMO Flatt first suggested the setting on October 21, then updated its advice at 14:00 JST (05:00 UTC) saying it is not a complete fix and that attacks bypassing it are expected. It did not describe the bypass.
    • The idea that the flaw lives in Session Upload Progress is a guess. PHP has not confirmed it, and an independent code audit from an anonymous account argues that the specific bug described in that feature does not exist in released PHP. The same audit states that the circulating proof-of-concept code does not fire.
    • Upwind still lists the setting as an immediate mitigation, relaying another researcher's analysis rather than its own tests. watchTowr, which reproduced one of the flaws, says there is no confirmed patch or workaround.
    • The setting is INI_PERDIR and can be set in php.ini, .htaccess or .user.ini. .user.ini is read only by CGI/FastCGI SAPIs, not the Apache module, and is re-read every 300 seconds by default. The value must be verified on the process serving web traffic (PHP-FPM or mod_php), not with php -i on the shell.
    • PHP issues fixes only for branches 8.2 through 8.5. Branches 8.1, 7.x and 5.x are end-of-life.
    • A short demonstration video was posted and then removed. Neither watchTowr's FAQ nor CISA's KEV catalog listed exploitation as of October 21.

    Remediation

    • Patch the runtime that serves web requests (PHP-FPM, mod_php or CGI) as soon as the fix ships, not just the application on top of it. Rehearse update steps, post-update checks, configuration changes and emergency restart approvals in advance (GMO Flatt).
    • If you cannot patch immediately, isolate internet-facing applications (CERT-EU), or place them behind a VPN, allowlisted clients or authenticated edge access, and verify the origin cannot be reached directly.
    • Limit blast radius: reduce data stored on the server, reduce its privileges, remove stored credentials including cloud roles, and keep logs enabled in a secure location.
    • For end-of-life branches, upgrade, take the system offline or isolate it; distributions or hosts may backport fixes on their own schedule.
    • Treat WAF rules as a weak stopgap. Cloudflare's emergency "anomalous execution" rules do not name PHP or these flaws and only cover traffic passing through the provider.
    • On managed or shared hosting, ask the provider when a fixed PHP build will land. Updating WordPress or Laravel does not update PHP.
    • After patching, review logs for activity that occurred before the update, and check the fixed versions, affected versions and any confirmed mitigation on php.net and PHP's GitHub security advisories.
73. infosecurity-magazine.com ↗ · pub. 21/10/2026 07:20 · coletado 21/10 08:01

    PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Leaked Before Scheduled Patch

    The UK NCSC also issued an emergency advisory alongside CERT-EU. Infosecurity Magazine cites W3Techs at 69.7% PHP usage, against the 69.3% already in the case. It also confirms that the PHP bulletin set the 2pm GMT October 21 release and the CVSS 9.2 rating, against the leaker's October 22 date and 10.0 score.

    ler a análise desta fonte ocultar

    The UK NCSC also issued an emergency advisory alongside CERT-EU. Infosecurity Magazine cites W3Techs at 69.7% PHP usage, against the 69.3% already in the case. It also confirms that the PHP bulletin set the 2pm GMT October 21 release and the CVSS 9.2 rating, against the leaker's October 22 date and 10.0 score.

    Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), were leaked on October 20 in a now-deleted Hacker News post by user 'petecooper' ahead of the planned patch release. The post claimed a CVSS 10.0 rating, an October 22 disclosure and impact on all versions back to PHP 5. watchTowr confirmed the CVE IDs were due to be disclosed later. The PHP security team said patches would ship at 2pm GMT on October 21 and rated the flaws CVSS 9.2. CERT-EU and the UK NCSC issued emergency advisories urging organizations to prepare for immediate patching.

    Technical Details

    • PHP is used by about 69.7% of websites with a known server-side language (W3Techs), including WordPress, Drupal, Joomla and Magento.
    • Leaking CVE IDs and the range of affected versions before a patch exists can enable attackers to reverse engineer the fix and exploit the flaws.
    • The PHP team said it reserves the right to release earlier if details become public or active exploitation appears.
    • Independent researcher Kevin Beaumont inferred the likely fixed versions from PHP pre-release builds; the list is truncated in the article.

    Remediation

    • Prepare to patch affected assets immediately once the PHP releases are published.
    • Where immediate patching is not feasible, consider isolating internet-facing applications from public networks until a fix is available (CERT-EU).
74. tenable.com ↗ · pub. 21/10/2026 06:01 · coletado 21/10 08:00

    PHP php2shell RCE flaws CVE-2026-109618 and CVE-2026-109619: early attacks reported ahead of Oct 21 emergency patch

    Tenable adds that, on October 21, Cloudflare CTO Dane Knecht reported "early attacks emerging" and Cloudflare deployed stopgap WAF rules for all customers. This conflicts with earlier reports that no exploitation had been observed. It also adds CERT-EU advisory 2026-018, Kevin Beaumont's expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the exploit-chain video credited to LCFR and Calif.io, host-exposure estimates (1.3 to 1.9 million), the PHP developers' statements that only patching helps, and Tenable plugin coverage.

    ler a análise desta fonte ocultar

    Tenable adds that, on October 21, Cloudflare CTO Dane Knecht reported "early attacks emerging" and Cloudflare deployed stopgap WAF rules for all customers. This conflicts with earlier reports that no exploitation had been observed. It also adds CERT-EU advisory 2026-018, Kevin Beaumont's expected fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the exploit-chain video credited to LCFR and Calif.io, host-exposure estimates (1.3 to 1.9 million), the PHP developers' statements that only patching helps, and Tenable plugin coverage.

    Tenable's FAQ covers two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSSv4.0 9.2 by the PHP security team. Patches are scheduled for October 21, 2026 at 14:00 UTC. Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging", and watchTowr says it believes it has reproduced CVE-2026-109618. Fixes are expected only for supported PHP 8.x branches, so end-of-life branches (PHP 5.x through 8.1.x) are not expected to be patched. CERT-EU advisory 2026-018 says all PHP versions from PHP 5 onwards could be affected.

    Technical Details

    • The PHP security team has not published technical details before the patch release. Public reporting describes both flaws as RCE.
    • A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The video references PHP 5.4.0 and later.
    • Expected fixed versions, reported by Kevin Beaumont before release: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 5.x through 8.1.x are end of life with no fix expected. Linux distributions may backport fixes.
    • Scoring differs between sources: PHP rates both flaws CVSSv4.0 9.2, while watchTowr and a Hacker News post described them as CVSS 10.0.
    • According to the article, the flaws were originally set to be disclosed under embargo on October 22.
    • W3Techs data cited in the article says PHP is used by 69.3% of websites with a known server-side language. Silas Cutler roughly estimates over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP.
    • Code claiming to exploit the flaws is circulating publicly, but Tenable has not verified it and warns it may be laced with malware.
    • Precedent: the CISA KEV catalog lists three PHP vulnerabilities (CVE-2024-4577, CVE-2019-11043, CVE-2012-1823). The first two are known to have been used in ransomware campaigns.

    Remediation

    • Patch to the fixed PHP releases as soon as they are published on October 21 at 14:00 UTC. PHP core developer Gina Peter Banyard said "the only mitigation is patching / upgrading PHP", and PHP 8.6 release manager Joe Ferguson said "ini settings won't save you".
    • Check distribution vendor advisories for backported fixes in packaged PHP.
    • Where patching is not feasible, CERT-EU recommends considering isolating internet-facing applications from public networks until a fix is available.
    • Cloudflare has deployed WAF rules for the known exploit vectors, available to all customers including the free tier. It describes them as a stopgap only, and they only cover traffic routed through Cloudflare.
    • Treat public exploit code with caution.
    • Tenable plugins 48243, 58987, 200476 and 216936 identify PHP installations and unsupported versions.
75. huntress.com ↗ · pub. 21/10/2026 01:00 · coletado 21/10 05:00

    Huntress outlines hunting for php2shell PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) ahead of the Oct 21 emergency patches

    Huntress adds that it has no PoC and knows of no public exploit code, and that a short exploitation video was briefly posted and removed. It also contributes detailed process-spawn hunting guidance, an unrelated PHP FastCGI intrusion pattern seen the prior week, and its detection and rule-publication plans.

    ler a análise desta fonte ocultar

    Huntress adds that it has no PoC and knows of no public exploit code, and that a short exploitation video was briefly posted and removed. It also contributes detailed process-spawn hunting guidance, an unrelated PHP FastCGI intrusion pattern seen the prior week, and its detection and rule-publication plans.

    Huntress published a rapid-response advisory on two leaked critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell. Both are rated CVSS v4.0 9.2 by the PHP security team and are publicly described as remote code execution in PHP core. The leak began with a Hacker News post on October 20, which was removed after screenshots spread, and watchTowr confirmed the flaws were real. The PHP team brought its security release forward to October 21 at 14:00 UTC. Huntress has not built a PoC and knows of no public exploit code. A short exploitation video was briefly posted and then removed. Huntress expects technical details and PoC code to follow quickly once fixes ship.

    Technical Details

    • No root cause, affected component or affected version list has been published. Reports point to PHP 5, 6, 7 and 8, and some researchers expect fixes only for supported PHP 8 branches.
    • Huntress, citing Florian Roth, expects exploitation to appear as suspicious child processes of PHP workers (php-fpm, php-cgi, php-cgi.exe, httpd, apache2). Likely children are shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl), download or networking tools (curl, wget, nc, certutil.exe), reverse shell command lines, and reconnaissance commands (whoami, id, uname -a, ipconfig).
    • Huntress describes an unrelated incident from the prior week. A PHP FastCGI process repeatedly ran a one-liner that wrote a small PHP file with random marker strings into the first writable temp directory, executed it and deleted it. It printed !notwrtbl! when no directory was writable. Huntress says this is not php2shell but shows the pattern of PHP spawning things it shouldn't.
    • Huntress notes that exposed Linux web servers and shared hosting without endpoint detection are where exploitation could go unnoticed.

    Remediation

    • Inventory every PHP install, including vendor appliances, Windows software bundling php.exe or php-cgi.exe, control panels (cPanel, Plesk), and WordPress, Drupal, Joomla and Magento.
    • Plan the patch window for October 21 at 10am ET, patch internet-facing systems first, and check distributions and hosting providers for backported packages.
    • For end-of-life PHP (5, 7, 8.0/8.1), upgrade, remove it from the internet, or place it behind a VPN or WAF.
    • Alert on PHP workers launching shells, interpreters or download tools. Florian Roth's process-watcher, started in observe mode, gives quick visibility on Linux servers without EDR.
    • If compromise is suspected, isolate the server, preserve web server and PHP logs, and look for webshells, new web-root files, cron jobs, scheduled tasks and accounts.
    • Huntress already detects web server processes spawning shells and common webshell activity on Windows and Linux. It will publish detection rules to huntresslabs/threat-intel once technical details are available.
76. securityweek.com ↗ · pub. 21/10/2026 04:02 · coletado 21/10 05:00

    PHP2Shell: Leaked Critical PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 Face Mass Exploitation Before Patch

    SecurityWeek adds that CERT-EU assesses both flaws as exploitable without authentication based on their CVSS vectors. It also adds that one report suggests CVE-2026-109618 is a use-after-free bug, that WatchTowr and Huntress have seen no exploitation, and that Sansec predicts mass exploitation within 15 minutes of the patch release.

    ler a análise desta fonte ocultar

    SecurityWeek adds that CERT-EU assesses both flaws as exploitable without authentication based on their CVSS vectors. It also adds that one report suggests CVE-2026-109618 is a use-after-free bug, that WatchTowr and Huntress have seen no exploitation, and that Sansec predicts mass exploitation within 15 minutes of the patch release.

    Details of two critical PHP vulnerabilities dubbed PHP2Shell leaked online ahead of coordinated disclosure. Both carry a CVSS score of 9.2 and could lead to remote code execution. PHP announced patches for Wednesday, 21 October 2026 at 14:00 UTC and warned that the release may come earlier if technical details are published or in-the-wild exploitation emerges. The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619, and CERT-EU says that, based on their CVSS vectors, both could be exploited without authentication. WatchTowr and Huntress have not seen exploitation, but Sansec expects mass exploitation to begin within 15 minutes of the patch release.

    Technical Details

    • Public details do not include a root cause, affected component or attack path. One report suggests CVE-2026-109618 is a use-after-free bug.
    • Public reporting suggests all PHP versions from PHP 5 onward are affected. This is not confirmed by PHP.
    • WatchTowr (CEO Benjamin Harris) says it reproduced CVE-2026-109618 and confirms the flaws are real, but is withholding technical information until patches are released.

    Remediation

    • Prepare now to upgrade PHP as soon as the release is available, as PHP urges all users to do.
    • Be ready to patch earlier than scheduled, since PHP may release sooner if details are published or exploitation appears.
    • Given Sansec's expectation of near-immediate mass exploitation, prioritize internet-facing PHP systems.
77. thehackernews.com ↗ · pub. 21/10/2026 01:57 · coletado 21/10 03:00

    PHP schedules out-of-cycle release for two unpatched critical RCE flaws (CVSS 4.0 9.2) after embargo leak

    The article adds exposure data and defensive guidance: Mallory counted about 884,000 internet-facing hosts reporting PHP 8.1 or older. Only PHP 8.2-8.5 will receive fixes, so end-of-life branches get no vendor patch. It gives the PHP notice time (19:33 UTC, October 20) and says Huntress saw no exploitation and has no PoC, while watchTowr's FAQ says the flaws are not in CISA KEV. It credits a six-step preparation checklist to Huntress, CERT-EU and Florian Roth. It also states that PHP's notice names neither CVE and that the 'PHP 5 onward' scope is unconfirmed.

    ler a análise desta fonte ocultar

    The article adds exposure data and defensive guidance: Mallory counted about 884,000 internet-facing hosts reporting PHP 8.1 or older. Only PHP 8.2-8.5 will receive fixes, so end-of-life branches get no vendor patch. It gives the PHP notice time (19:33 UTC, October 20) and says Huntress saw no exploitation and has no PoC, while watchTowr's FAQ says the flaws are not in CISA KEV. It credits a six-step preparation checklist to Huntress, CERT-EU and Florian Roth. It also states that PHP's notice names neither CVE and that the 'PHP 5 onward' scope is unconfirmed.

    PHP will ship an out-of-cycle security release at 14:00 UTC on October 21, 2026 for two critical vulnerabilities rated 9.2 on CVSS v4.0, but it has not described them. watchTowr says both allow remote code execution, and researchers are calling the pair php2shell. An October 20 Hacker News post leaked the flaws, claiming CVSS 10.0 and impact on every version since PHP 5, with disclosure planned for October 22. PHP published its advance notice at 19:33 UTC and moved the release forward. No exploitation has been reported, and the flaws are not in CISA KEV. Only PHP 8.2-8.5 will receive fixes, so end-of-life branches may have no vendor patch.

    Technical Details

    • The leak disclosed the flaws' existence, a score, a date and two CVE identifiers (CVE-2026-109618, CVE-2026-109619), not how they work. PHP's notice names neither CVE.
    • The CVSS 10.0 figure comes from the leak. PHP's own rating is 9.2 on CVSS v4.0.
    • The "PHP 5 onward" scope is unconfirmed. watchTowr's FAQ says it has not been confirmed by an official vendor advisory, and no configuration or feature requirement has been described.
    • PHP supports only four branches: 8.2 and 8.3 get security fixes only, and 8.4 and 8.5 are in active support. 8.1, 8.0, 7.x and 5.x are end of life.
    • Mallory counted about 884,000 internet-facing hosts whose banner reported PHP 8.1 or older in Shodan on October 20. That is 59% of about 1.5 million hosts reporting a version, and another 740,000 hosts reported PHP with no version. These are banner counts, not confirmed affected systems.
    • Huntress had seen no exploitation as of October 20 and had no proof of concept or public exploit code. watchTowr's FAQ lists no exploitation reported as of October 21.
    • For comparison, exploit attempts against CVE-2024-4577 hit Akamai honeypots within 24 hours of disclosure in June 2024.

    Remediation

    • Inventory every PHP install, including PHP bundled in vendor appliances, Windows software and control panels such as cPanel and Plesk.
    • Be ready to upgrade at 14:00 UTC and patch internet-facing systems first. Check your Linux distribution and hosting provider for backported packages.
    • On end-of-life branches, upgrade, take the system off the internet, or put it behind a VPN or WAF.
    • CERT-EU advises considering isolating internet-facing applications from public networks until a fix is available.
    • Alert on php-fpm, php-cgi, httpd or apache2 launching shells, interpreters or download tools. Florian Roth's process-watcher can log every program a PHP process starts, but it prevents nothing.
    • If compromise is suspected, isolate the server, preserve web server and PHP logs, and look for web shells, new web-root files, new cron jobs, scheduled tasks and accounts.
    • PHP has published no workaround.
78. gbhackers.com ↗ · pub. 21/10/2026 01:47 · coletado 21/10 02:00

    PHP team pre-announces two CVSS 9.2 RCE flaws (CVE-2026-109618, CVE-2026-109619); patches due October 21

    gbhackers.com stresses that watchTowr's details come from an unverified report and that PHP's official 9.2 scores are not tied to named CVEs. It also notes that watchTowr's table assigns no scores and that watchTowr cites a rumored October 22 (18:00 CEST) date against PHP's October 21 (14:00 UTC). It adds that no workaround or affected-version matrix exists and advises against speculative configuration changes.

    ler a análise desta fonte ocultar

    gbhackers.com stresses that watchTowr's details come from an unverified report and that PHP's official 9.2 scores are not tied to named CVEs. It also notes that watchTowr's table assigns no scores and that watchTowr cites a rumored October 22 (18:00 CEST) date against PHP's October 21 (14:00 UTC). It adds that no workaround or affected-version matrix exists and advises against speculative configuration changes.

    The PHP security team announced on October 20, 2026 that a release scheduled for October 21 at 14:00 UTC will fix two critical vulnerabilities, each rated 9.2 under CVSS v4.0. watchTowr reports two potential remote code execution (RCE) flaws, tracked as CVE-2026-109618 and CVE-2026-109619. PHP has not confirmed these identifiers or any technical details. watchTowr's reported scope is every PHP version from PHP 5 onward, which is unverified. watchTowr saw no exploitation in the wild as of October 21, and PHP may release patches earlier if details become public or exploitation emerges.

    Technical Details

    • No affected components, vulnerable functions, attack vectors, authentication requirements or configuration prerequisites have been disclosed.
    • PHP's notice does not link its two 9.2 scores to named CVEs. watchTowr's table lists both CVE IDs but assigns no scores.
    • watchTowr's FAQ cites a rumored announcement on October 22 at 18:00 CEST, based on social media. PHP's official notice gives October 21 at 14:00 UTC.
    • watchTowr stresses that its details come from an unverified report.

    Remediation

    • Follow the vendor's published schedule and monitor official PHP security channels for the release.
    • Inventory production PHP installations, identify application owners and prepare update procedures before the patches ship.
    • Install the confirmed fixed versions promptly.
    • No workaround or affected-version matrix is confirmed, so avoid speculative configuration changes.
79. aikido.dev ↗ · pub. 20/10/2026 22:54 · coletado 21/10 01:00

    Aikido: all PHP versions treated as affected by two critical RCE flaws (CVE-2026-109618, CVE-2026-109619); patches due Oct 21

    Aikido advises treating all PHP versions as affected, says it is coordinating with the PHP Foundation, confirms the advance notice came on October 20 after the leak and that independent researchers validated the flaws, and says the vulnerabilities are still circulating. It is withholding exploitation details until the patches ship.

    ler a análise desta fonte ocultar

    Aikido advises treating all PHP versions as affected, says it is coordinating with the PHP Foundation, confirms the advance notice came on October 20 after the leak and that independent researchers validated the flaws, and says the vulnerabilities are still circulating. It is withholding exploitation details until the patches ship.

    Aikido reports that critical vulnerabilities have been found in PHP itself and advises defenders to treat all versions as affected. The PHP security team will release fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC on October 21, 2026. Both are scored CVSS v4.0 9.2. The PHP team published an advance notice on October 20 after information leaked ahead of the planned disclosure. Independent researchers confirmed the flaws are real, and the release date was moved up to October 21. Aikido says the vulnerabilities continue to circulate and that it is coordinating with the PHP Foundation.

    Technical Details

    • Exploitation details are being withheld until systems are patched. Full information is to be published with the patches.
    • The article does not state affected version ranges beyond "treat all versions as affected", and gives no exploitation status.

    Remediation

    • Watch the PHP site and announcements for workarounds and patches, and deploy them as soon as they are released on October 21 at 14:00 UTC.
    • Inventory every PHP deployment in the stack and prioritize internet-facing ones.
80. bleepingcomputer.com ↗ · pub. 20/10/2026 17:56 · coletado 20/10 18:00 primeiro registro

    PHP team warns of two critical RCE flaws (CVE-2026-109618, CVE-2026-109619) after leak; emergency patches due Oct 21

    ler a análise desta fonte ocultar

    The PHP security team warned administrators to prepare for emergency security updates on October 21, 2026 at 14:00 UTC. The updates fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. Details reportedly leaked ahead of the planned embargo, and watchTowr confirmed the flaws are real remote code execution (RCE) bugs. watchTowr has not observed exploitation in the wild. The PHP team reserves the right to release earlier if details become public or exploitation appears.

    Technical Details

    • PHP has not disclosed affected versions, exploitation mechanics or fixed releases. Full details are to be published with the patches.
    • watchTowr (CEO Benjamin Harris) says both flaws are RCE and are understood to affect PHP 5, 6, 7 and 8. It believes it has reproduced CVE-2026-109618 and is withholding technical information until patches are available.
    • The leak appears to have come from a now-deleted Hacker News post by user "petecooper". The post named both CVE IDs and claimed disclosure on October 22.
    • Conflicting details: PHP assigns CVSS v4.0 9.2 to each flaw, while watchTowr and the Hacker News post cite CVSS 10.0. watchTowr and the post also cite a Thursday disclosure, while PHP scheduled the release for Wednesday, October 21. The PHP advisory is the authoritative source for scoring and dates.

    Remediation

    • Prepare to deploy the PHP security releases as soon as they are published on October 21 (14:00 UTC), and monitor the PHP ANNOUNCE mailing list and advisory.
    • Inventory internet-facing PHP applications, including CMS and e-commerce platforms, and prioritize them for patching.
    • Expect the release to come earlier than scheduled if exploitation appears.

Repetiram sem novidade

• gbhackers.com — OffSec releases free PG Play lab for PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 amid active exploitation
• welivesecurity.com — PHP2Shell: ESET video recap of two critical unauthenticated PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619
• aikido.dev — Aikido publishes free backported PHP images for PHP2Shell (CVE-2026-109618/109619) covering PHP 5.5 to 8.5
• tenable.com — Tenable publishes guidance for detecting and remediating PHP2Shell (CVE-2026-109618, CVE-2026-109619) across its product suite
• infosecurity-magazine.com — PHP warns of CVE-2026-115560, a niche RCE with no patch until next release; session upload progress mitigation advised
• securityaffairs.com — PHP discloses separate code execution flaw CVE-2026-115560 two days after PHP2Shell emergency patches
• ic3.gov — FBI PSA urges immediate patching of critical PHP core RCE flaws CVE-2026-109618 and CVE-2026-109619
• bleepingcomputer.com — PHP discloses unpatched RCE CVE-2026-115560 in non-default session config; mitigation issued as PHP2Shell attempts continue
• cert.ssi.gouv.fr — CERT-FR updates alert on critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619, confirms PoCs exist
• securityaffairs.com — PHP2Shell: millions of exploit attempts against critical PHP RCE flaws, no confirmed successful exploitation
• schneier.com — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619
• bleepingcomputer.com — Amazon: PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) exploited from Oct 17, four days before patches
• theregister.com — PHP2Shell (CVE-2026-109618/109619): millions of exploit attempts, Amazon honeypot saw targeting four days before disclosure
• cisa.gov — CISA urges immediate patching of critical unauthenticated PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (php2shell)
• securelist.com — Kaspersky details PHP2Shell critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) and its detection coverage
• krebsonsecurity.com — Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild; emergency patches cause government site outages
• blog.checkpoint.com — Check Point briefs on php2shell: leaked critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 ahead of emergency patch
• olhardigital.com.br — Critical PHP RCE flaws (CVSS 9.2) face early exploitation attempts ahead of emergency patch; WordPress sites exposed
• gbhackers.com — Cloudflare Reports Early Exploitation Attempts Against Two Critical PHP Flaws Ahead of Patch Release; Emergency WAF Rules Deployed