Akatsuki Legion

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 26, 2026
Last mentioned4d ago

Timeline

2 articles · newest first

Attackers use public PHP2Shell exploits against university and business sites

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.

Cyber Security Newsupdated Oct 28, 00:00 UTC · 3d agofirst Oct 26, 20:29 UTC · 4d agoExploit / PoCExploited30 sourcesCVE-2026-109618 CVE-2026-1096195 · 2 reads

Public PHP2Shell scripts drive mass scans of internet-facing PHP

Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.

GBHackersupdated Oct 28, 00:00 UTC · 3d agofirst Oct 26, 05:31 UTC · 4d agoExploit / PoC 30 sourcesCVE-2026-109618 CVE-2026-1096191

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 9d agophpKEVPoC ×15
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 9d agophpKEVPoC ×25

Appears with

PHPvendor · 2
Miraimalware · 1
Sophosorganization · 1
Hunt.ioorganization · 1
Amazon Threat Intelligenceorganization · 1
Potassiummalware · 1
Recorded Futureorganization · 1
Fastlyorganization · 1
Sansecorganization · 1

Entities are extracted by the model from each article. First seen Oct 26, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.