CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
84
Organization
VulnCheck
- Mentions · 7d5
- Mentions · 30d23
- All mentions32
- First seenAug 20, 2026
- Last mentioned1d ago
Timeline
32 articles · newest firstUnsloth loader can run Python even with trust disabled
CVE-2026-93348, scored 8.6, is fixed in Unsloth 2026.8.20 and Unsloth Zoo 2026.8.14.
62
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
72
UK pentester claims $2,000 Bitcoin prize for PHP2Shell CTF RCE
Jaydip Modhwadia says he achieved remote code execution in about three hours after a PHP endpoint was added.
52
PHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
74
VulnCheck exploit bypasses ASLR for PHP2Shell remote code execution
The private exploit chains a memory leak into RCE on PHP 8.4.26 with ASLR on and display_errors off.
82
PHP2Shell exploitation began days before the patches
Amazon says probing started October 17; CISA urges PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
92
The Blind Spots of Agentic Pentesting and How to Close Them
Picus says agentic pentesting misses unreachable assets and flaws that lack safe exploits.
44
PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover
Public PoC shows Telegram Desktop before 7.2.9 can leak local files and sessions via a crafted link.
64
Critical Flaw in Multiple Atlassian Products Exploited in the Wild
Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.
80
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Anthropic expands vetted Claude cyber access after Glasswing verified 129,000 software flaws.
78
Anthropic reconfigures its cool kids security program
Anthropic merged Glasswing and its Cyber Verification Program into three tiers that change Claude security refusals.
64
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Former NSA director Nakasone says a reported AI- and China-focused agency overhaul is probably necessary.
58
The AI app builder your team trusts has a root-level backdoor
Attackers actively exploit unauthenticated RCE CVE-2026-0768 (CVSS 9.8) in internet-facing Langflow instances to run code as root and steal credentials.
86
AI accelerates n-day attacks, as flaw disclosures and exploits double
Google Threat Intelligence says 141 flaws were exploited by August 2026, exceeding all of 2025, with AI tooling accelerating n-day weaponization and shrinking exploit timelines.
58
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are scanning Rejetto HFS for CVE-2026-61500, a critical flaw enabling admin session forgery and RCE.
74
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
Attackers are exploiting CVE-2026-61500, a critical Rejetto HFS authentication-bypass and code-execution flaw found with Anthropic Mythos.
76
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
Attackers are exploiting Rejetto HFS flaw CVE-2026-61500 to forge admin cookies and gain code execution.
76
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Attackers are exploiting Rejetto HFS CVE-2026-61500 to forge admin sessions and gain remote code execution.
78
Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows
Attackers are exploiting CVE-2026-61500, a critical Rejetto HFS auth bypass discovered by Anthropic’s Mythos.
74
CISA outlines improvement plan for CVE program
CISA published a white paper to improve CVE quality as disclosure volume surges.
46
Anthropic-linked CVEs pile up, attackers mostly shrug
VulnCheck finds only one of 225 Anthropic Glasswing-linked CVEs, Ghost SQL injection CVE-2026-26980, exploited in the wild.
62
Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
78
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.
45
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own sandbox via an unauthenticated local API; fixed in 0.1.2-alpha.2.
58
Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)
Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.
65
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
88
Why The Vulnerability Backlog Is About To Get Worse
Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.
45
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
74
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-615002%9.3Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same…
- CVE-2026-07682%9.8Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2026-502736%8.8Authenticated Path Traversal Arbitrary File Write in Langflow Files API
- CVE-2024-2369299%9.8Unauthenticated Template Injection RCE in Rejetto HTTP File Server 2.3m
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-076941%9.8Unauthenticated Eval Injection RCE in Langflow (eval_custom_component_code)
- CVE-2026-2698070%7.5Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads
- CVE-2026-3301796%9.3Unauthenticated RCE in Langflow AI Workflow Builder
Appears with
- CISAorganization · 10
- Anthropicorganization · 9
- Mythosai model · 7
- HTTP File Serverproduct · 6
- Rejettovendor · 6
- PHPvendor · 5
- OpenAIorganization · 5
- watchTowrorganization · 5
- Horizon3.aiorganization · 4
- Anthropicvendor · 4
- NISTorganization · 3
- Sophosorganization · 3
- Cloudflareorganization · 3
- Miraimalware · 3
- Microsoftvendor · 3
- PHPproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.