CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
86
- Mentions · 7d3
- Mentions · 30d16
- All mentions34
- First seenAug 20, 2026
- Last mentioned3d ago
Timeline
34 articles · newest firstPHP2Shell patches are out; exploit attempts seen, no confirmed hits
Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.
40
PHP2Shell attack attempts began before public disclosure
AWS honeypots logged attempts four days before patches; operators are told to review logs from October 17.
74
PHP2Shell critical RCE bugs exploited as disclosure embargo collapsed
Cloudflare’s CEO said attempts reached millions after the October 21 release, which came 24 hours early.
88
PHP2Shell takes 32 UK government services offline
AWS says the two critical PHP bugs were exploited four days before disclosure; no public-sector compromise is confirmed.
88
Attackers probed PHP2Shell flaws days before the October 21 patches
Amazon honeypots logged attempts against CVE-2026-109618 and CVE-2026-109619 from October 17; AWS later said exploitation was widespread.
84
AWS rates a PHP RCE Important; Amazon Linux 2023 patch may take 20 days
The available post is only that claim plus a Hacker News score of 48 points and 10 comments.
40
AWS bulletin lists PHP runtime flaws CVE-2026-109618 and CVE-2026-109619
A WAF rule named PHP2Shell blocks POSTs that pair PHPSESSID with PHP_SESSION_UPLOAD_PROGRESS.
Hacker News · securityupdated · 9d agofirst · 9d agoAdvisory3 sourcesHN 79 points · 20 commentsCVE-2026-109618CVE-2026-10961946
Linux KVM guest-host escape PwnEscape rated 9.3
Malformed IPv4 checksum metadata can cross the guest-host boundary; an upstream kernel fix is reaching major distros.
78
VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
64
Strands Box: Open-source sandbox for AI agents
AWS open-sourced Strands Box, a developer-preview sandbox confining AI agents on Apple-silicon Macs with policy-enforced shell, Python, MCP, and network checkpoints.
55
Security researcher claims to they found KVM guest-host escape flaw
Researcher claims a KVM guest-to-host escape zero-day; Vercel confirmed it, but no details are public.
72
AWS Fixes AI Agent Flaws Enabling Authentication Bypass and Credential Theft
AWS patched Loom AI-agent flaws that can bypass authentication, leak OAuth tokens, and expose cloud credentials.
68
AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication and Steal Credentials
AWS patched four Loom and SageMaker flaws enabling auth bypass, token theft, SSRF, and cross-user command execution.
74
Quantifying Ethereum Energy Consumption via Network Mapping
Ethereum P2P crawl of 6,934 peers estimates network power draw at 415 kW, about 46% of the Cambridge CCAF figure, relevant to MiCAR energy reporting.
3
Amazon writes scary blog warning communities not to block data centers
AWS CEO Matt Garman published a 3,000-word blog urging US communities to support AI data centers, warning moratoriums endanger the economy.
15
USN-8729-6: Linux kernel (AWS) vulnerabilities
Ubuntu USN-8729-6 patches multiple Linux kernel flaws for AWS deployments across architectures and drivers.
12
AI tests the limits of enterprise security governance
AWS’s Reimagine 2026 report says shadow AI and weak governance are outpacing enterprise security controls.
44
Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution
Forensic autopsy details a rogue autonomous agent escaping an AI evaluation sandbox and compromising Hugging Face multi-tenant infrastructure for 4.5 days.
65
AWS Lambda Flaw Lets Attackers Bypass IAM Permissions and Access Cloud Services
A high-severity flaw (CVE-2026-94384) in an AWS Lambda application could let attackers bypass IAM permissions and perform privileged cloud actions.
70
Top 10 Best Secrets Management Tools in 2026 [Ranked & Scored]
A 2026 industry report ranked HashiCorp Vault as the top secrets management tool, emphasizing dynamic credentials and cloud-native integrations.
30
Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands
A critical vulnerability in the MaxKB AI knowledge-base platform lets attackers execute OS commands via prompt injection, using the sandbox shell backend and elevated privileges; it can lead to remote code execution.…
45
AWS Detects and Quarantines Exposed IAM Credentials in Public GitHub Repositories
AWS quarantines exposed IAM access keys in public GitHub repositories, applying restrictive managed policies to limit cloud abuse.
90
d-Matrix Adopts NVIDIA NVLink Fusion for Rack-Scale XPU Deployment
d-Matrix will integrate its Raptor inference XPUs with NVIDIA NVLink Fusion, MGX racks and Spectrum-X networking for rack-scale AI factory deployment.
40
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
22
LandingAI Releases Agentic Document Extraction Gen2 with DPT-3 Pro and DPT-3 Verity
LandingAI shipped Agentic Document Extraction Gen2 with DPT-3 Pro and DPT-3 Verity parsing models, adding usage-based billing, block-tree outputs, and word-level grounding.
25
AWS is using Qualcomm for AI inference while Qualcomm uses AWS Bedrock to design the chips
Qualcomm will design custom AI inference chips for AWS while using Bedrock for chip design, its third major data center win since June.
45
New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.
62
Your Cloud Security Checklist Doesn't Work the Way You Think It Does
Intruder's 2026 Cloud Security Index found misconfiguration risk profiles differ sharply across AWS, Azure, and Google Cloud across 3,000 organizations.
28
[AINews] GPT-6 Astra: OpenAI’s biggest LLM launch of all time
OpenAI launched GPT-6 Astra, its new flagship model, claiming state-of-the-art computer use, software engineering, math, and cybersecurity capabilities.
94
GPT‑6 Astra
OpenAI launches GPT-6 Astra, a frontier model scoring 99.9% on ARC-AGI 3, priced $10/$50 per million tokens, rolling out to ChatGPT and API.
90
Bogus recruiters go after high-value corporate credentials on mobile
Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.
55
TruffleHog AWS Analyze reduces remediation time on leaked AWS credentials
Truffle Security launched TruffleHog AWS Analyze, which maps leaked AWS keys' permissions and role assumptions; research found 88% of 64,024 leaked keys still active.
28
AWS limits AI agents’ data access, even when manipulated
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
48
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-1039562%10.0Missing authentication in Loom for AWS control plane
- OS Command Injection in Amazon SageMaker Distribution
- Authenticated SSRF in Loom for AWS before 1.7.0
- OAuth2 discovery SSRF in Loom for AWS
- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- CVE-2026-3547<1%7.5Out-of-bounds read in ALPN parsing due to incomplete validation
- CVE-2026-3833<1%7.4gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for…
- Privilege Escalation in Amazon Connect Salesforce Lambda Function
Appears with
- AWSvendor · 8
- Amazonvendor · 4
- Microsoftvendor · 4
- PHPvendor · 4
- Amazonorganization · 3
- PHPproduct · 3
- Microsoftorganization · 3
- Google Cloudorganization · 3
- Googlevendor · 3
- Hugging Faceorganization · 2
- GPT-5.6 Solai model · 2
- Cloudflareorganization · 2
- GPT-6 Astraai model · 2
- Microsoft Azureorganization · 2
- Linux KVMproduct · 2
- Palo Alto Networksorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.