PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Organization
watchTowr
- Mentions · 7d4
- Mentions · 30d51
- All mentions88
- First seenAug 15, 2026
- Last mentioned9h ago
Timeline
88 articles · newest firstPHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
30
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
72
PHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
PHP shares mitigation for unpatched RCE CVE-2026-115560
Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.
68
Critical PHP flaws prompt site shutdowns as exploit attempts surge
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
90
PHP2Shell exploitation began days before the patches
Amazon says probing started October 17; CISA urges PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
92
PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild
Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4, 8.0 and 8.1 get emergency source backports only.
90
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
88
PHP patches PHP2Shell RCE bugs as exploit attempts hit sensors
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, are fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
92
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Sites go offline as two critical PHP bugs draw early attacks
Fixes are out only for PHP 8.2 and newer; Cloudflare and watchTowr report emerging attacks dubbed PHP2Shell.
90
PHP patches two critical PHP2Shell RCE flaws as exploit attempts appear
CVE-2026-109618 and CVE-2026-109619 are unauthenticated runtime flaws rated 9.2, including on a simple PHP page.
90
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
PHP rates two PHP2Shell flaws 9.2; fix due October 21
No attacks are reported, PHP offered no workaround, and disabling upload progress is not a full fix.
76
Critical PHP RCE flaws leaked a day before scheduled patches
CERT-EU told operators to prepare to patch or isolate internet-facing PHP apps; the PHP team rates the flaws CVSS 9.2, not 10.
78
PHP schedules emergency fixes for two critical RCE flaws
watchTowr reproduced CVE-2026-109618 privately, while PHP has not confirmed scope or published a workaround.
74
Emergency PHP patches due for two critical RCE flaws as attacks emerge
Cloudflare reports early attacks; expected fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with older branches unfixed.
88
Leaked PHP2Shell flaws may allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.
80
PHP to ship emergency fixes for two critical RCE flaws rated 9.2
Only branches 8.2 through 8.5 can be patched; affected versions and exploit details remain unconfirmed.
82
PHP schedules October 21 fixes for two flaws rated 9.2
watchTowr cites CVE-2026-109618 and CVE-2026-109619, but PHP has not confirmed identifiers or scope.
82
PHP warns of two critical flaws, patches due October 21
Each flaw is rated CVSS v4.0 9.2; PHP has not confirmed CVE IDs, versions, or remote code execution.
76
PHP to release two emergency 9.2-severity patches
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real; maintainers have not confirmed active exploitation.
78
Patchstack and Cloudflare report early PHP2Shell exploitation
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.
88
PHP patches two leaked critical core RCE flaws after early disclosure
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; watchTowr reports no observed attacks.
86
PHP to fix two critical RCEs, CVE-2026-109618 and CVE-2026-109619
The official fix is due October 21 at 14:00 UTC; PHP 8.1 and older will not get one.
82
PHP warns of two critical flaws, emergency patches due October 21
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real RCEs and has not seen exploitation.
76
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
87
Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
86
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Attackers exploited critical Atlassian flaw CVE-2026-21589 within hours, alongside arrests, malware updates, and certificate hijacks.
82
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr details a PaperCut pre-auth RCE chain exploited in the wild and repeated patch bypasses.
86
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.
80
Critical Flaw in Multiple Atlassian Products Exploited in the Wild
Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.
80
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
Attackers are scanning Atlassian products for CVE-2026-21589, a traversal bug that can read web files.
72
Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
Attackers are probing Atlassian Data Center products for critical file-read flaw CVE-2026-21589 one day after patches.
85
PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access
watchTowr released a detection PoC for unauthenticated Atlassian file-read CVE-2026-21589 that can yield Jira admin access.
72
Hackers exploit critical Atlassian flaw after public PoC release
Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.
88
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Unauthenticated Atlassian Data Center flaw CVE-2026-21589 saw exploitation attempts within two hours.
83
Atlassian Patches Critical Vulnerability Affecting 8 Products
Atlassian patched unauthenticated file-read flaw CVE-2026-21589 in eight products, and no exploitation has been observed.
77
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
Atlassian patched CVE-2026-21589, a pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, and other Data Center products.
84
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-19489<1%8.8Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-194786%9.1Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
Appears with
- CISAorganization · 35
- Citrixvendor · 21
- PHPvendor · 19
- NetScaler ADCproduct · 18
- NetScaler Gatewayproduct · 18
- Cloudflareorganization · 11
- CERT-EUorganization · 10
- watchTowrvendor · 10
- Atlassianvendor · 10
- Wizorganization · 9
- Crucibleproduct · 9
- Fisheyeproduct · 9
- PHPproduct · 7
- Citrixorganization · 7
- OpenAIorganization · 7
- Mandiantorganization · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.