Amazon Threat Intelligence

Mentions · 7d2
Mentions · 30d3
All mentions3
First seenOct 23, 2026
Last mentioned4d ago

Timeline

3 articles · newest first

Attackers use public PHP2Shell exploits against university and business sites

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.

Cyber Security Newsupdated Oct 28, 00:00 UTC · 3d agofirst Oct 26, 20:29 UTC · 4d agoExploit / PoCExploited30 sourcesCVE-2026-109618 CVE-2026-1096195 · 2 reads

PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26

A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.

BleepingComputerupdated Oct 28, 00:00 UTC · 3d agofirst Oct 26, 09:19 UTC · 4d agoExploit / PoCExploited30 sourcesCVE-2026-109618 CVE-2026-109619 CVE-2026-1155604 · 4 reads

PHP shares mitigation for unpatched RCE CVE-2026-115560

Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.

BleepingComputerOct 23, 15:38 UTC · 7d agoVulnerabilityCVE-2026-115560 CVE-2026-109618 CVE-2026-1096193 · 1 read

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 9d agophpKEVPoC ×15
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 9d agophpKEVPoC ×25
CVE-2026-115560—
published —PoC ×11

Appears with

PHPvendor · 2
Cloudflareorganization · 2
Dataminrorganization · 2
Miraimalware · 1
Sophosorganization · 1
Expelorganization · 1
PHPproduct · 1
Hunt.ioorganization · 1
Potassiummalware · 1
watchTowrorganization · 1
Perplexityorganization · 1
Apache mod_phpproduct · 1
Akatsuki Legionorganization · 1

Entities are extracted by the model from each article. First seen Oct 23, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.