PHP2Shell exploitation surges while most public PHP stays unpatched
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
86
Organization
OX Security
- Mentions · 7d0
- Mentions · 30d4
- All mentions7
- First seenAug 31, 2026
- Last mentioned7d ago
Timeline
7 articles · newest firstPillow 13.0.0 fixes critical image-handling flaws, including EPS code execution
CVE-2026-112900 affects Pillow 2.6.0 through 12.3.0 when Ghostscript is installed; none of the flaws is known to be under attack.
72
PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
OX Security's review of 15,465 public MCP servers found no marketplace vetting and easy domain takeover risks.
55
101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
OX Security found 101 malicious npm packages totaling 490,000 downloads that hijack developers' WhatsApp accounts into attacker-controlled groups.
55
MCP Is Creating Major Governance Gaps, Researchers Warn
Ox Security says thousands of MCP servers lack governance and can bypass enterprise security controls.
58
Debian developers rejected an LLM ban and left disclosure voluntary
Debian developers voted to encourage voluntary disclosure of AI assistance in contributions rather than banning or mandating labeling of LLM-generated code.
30
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-1123931%9.2Heap overflow in Pillow compressed TIFF save without fileno
- CVE-2026-112403<1%9.2Heap overflow in Pillow JPEG draft/thumbnail before 13.0.0
- CVE-2026-1129001%9.2Ghostscript argument injection in Pillow EPS handling
Appears with
- Anthropicorganization · 3
- Model Context Protocolproduct · 2
- PHPproduct · 2
- Anthropicvendor · 2
- WhatsApporganization · 1
- SafeDeporganization · 1
- npmorganization · 1
- Debianvendor · 1
- ngrokproduct · 1
- Debianorganization · 1
- OpenAIorganization · 1
- Pillowvendor · 1
- Cisco Talosorganization · 1
- GitGuardianorganization · 1
- PHP Foundationorganization · 1
- GPT-5.6 Solai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.