PHP2Shell exploit tooling found on exposed attacker server
The available SOCRadar page gives the finding in the title but no IOCs, versions, or victim details.
38
Malware
PHP2Shell
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenOct 20, 2026
- Last mentioned3d ago
Timeline
6 articles · newest firstExploit-DB lists PHP2Shell RCE for PHP after v5.4
The listing covers remote code execution in PHP core versions after v5.4 as CVE-2026-109618.
58
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
88
PHP patches two critical unauthenticated RCE flaws after exploit leak
A public PoC dubbed PHP2Shell targets PHP 5 through 8; backports exist for 7.4, 8.0, and 8.1, but attacks are not confirmed.
84
PHP to release two emergency 9.2-severity patches
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real; maintainers have not confirmed active exploitation.
78
PHP to fix two critical RCEs, CVE-2026-109618 and CVE-2026-109619
The official fix is due October 21 at 14:00 UTC; PHP 8.1 and older will not get one.
82
Related CVEs
by mentions- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.