PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Organization
PHP Foundation
- Mentions · 7d17
- Mentions · 30d17
- All mentions17
- First seenOct 21, 2026
- Last mentioned2h ago
Timeline
17 articles · newest firstPHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
62
Third PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
72
PHP2Shell exploitation surges while most public PHP stays unpatched
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
86
Essay says AI shrank PHP2Shell exploit time to hours
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
34
AINews 'Black October' roundup clusters AI-linked security disclosures
The digest says many incidents were found earlier and disclosed together, while exploitation scale is disputed.
38
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
92
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
90
PHP2Shell exploit attempt hit Amazon honeypot before disclosure
CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.
91
Attackers exploited critical PHP flaws days before patches landed
AWS honeypots logged PHP2Shell attempts on October 17, four days before Wednesday's disclosure, and exploitation is now described as broad.
88
PHP says Chainguard broke embargo on critical PHP2shell bugs
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and at least one hits every PHP release back to 5.4.
88
PHP 8.x security updates fix two remote code execution flaws
Exploit notices circulated October 20 with a wrong CVSS of 10.0; the stated score is 9.2.
76
PHP says AI review revived critical bugs first flagged in 2024
Cloudflare saw exploitation attempts Wednesday, while the foundation says Chainguard published the fix before coordinated disclosure.
76
PHP patches two critical unauthenticated remote code execution flaws
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; WordPress updates do not patch PHP itself.
90
PHP patches two critical remote code execution flaws
Unauthenticated code execution was demonstrated on Apache with mod_php under default settings for the memory bug.
82
PHP rates two PHP2Shell flaws 9.2; fix due October 21
No attacks are reported, PHP offered no workaround, and disabling upload progress is not a full fix.
76
Patchstack and Cloudflare report early PHP2Shell exploitation
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.
88
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- PHPproduct · 12
- Wizorganization · 10
- OpenAIorganization · 8
- Califorganization · 7
- Cloudflareorganization · 7
- PHPvendor · 5
- Chainguardorganization · 4
- GPT-5.6 Solai model · 2
- OpenAIvendor · 2
- NSAorganization · 2
- Claude Mythosai model · 2
- Trail of Bitsorganization · 2
- Cisco Talosorganization · 2
- Amazon Web Servicesorganization · 2
- watchTowrorganization · 2
- CrowdStrikeorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.