Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
36
Product
Drupal
- Mentions · 7d12
- Mentions · 30d14
- All mentions14
- First seenOct 15, 2026
- Last mentioned22h ago
Timeline
14 articles · newest firstPHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
Critical PHP flaws prompt site shutdowns as exploit attempts surge
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
90
Searchlight releases php2shell-scanner for two PHP RCE bugs
The open-source scanner forces a PHP out-of-memory condition instead of trusting version banners.
62
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
90
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
92
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Calif Research shows pre-auth PHP2Shell RCE on default PHP
The authors say paths dating to PHP 5.4.0 yield RCE, including on WordPress, Drupal, and Joomla.
82
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
86
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
82
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal patched critical Field UI RCE CVE-2026-108097, reachable without login through some contributed modules, with no attacks reported.
74
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- WordPressproduct · 12
- Joomlaproduct · 9
- PHPproduct · 8
- Magentoproduct · 5
- Wizorganization · 4
- Cloudflareorganization · 4
- PHPvendor · 4
- OpenAIorganization · 4
- CERT-EUorganization · 4
- Califorganization · 3
- watchTowrorganization · 3
- Laravelproduct · 3
- Field UIproduct · 2
- GPT-5.6 Solai model · 2
- Drupalvendor · 2
- NSAorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.