PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
Product
Joomla
- Mentions · 7d0
- Mentions · 30d9
- All mentions10
- First seenSep 2, 2026
- Last mentioned7d ago
Timeline
10 articles · newest firstSearchlight releases php2shell-scanner for two PHP RCE bugs
The open-source scanner forces a PHP out-of-memory condition instead of trusting version banners.
62
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
90
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
92
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Calif Research shows pre-auth PHP2Shell RCE on default PHP
The authors say paths dating to PHP 5.4.0 yield RCE, including on WordPress, Drupal, and Joomla.
82
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
Wiz details PHP2Shell RCEs in core PHP back to 5.4
Unauthenticated attackers can run code or read worker memory that may hold passwords, tokens and keys; PHP patched on October 21, 2026.
86
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
52
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Drupalproduct · 9
- WordPressproduct · 9
- PHPproduct · 6
- Magentoproduct · 4
- CERT-EUorganization · 4
- PHPvendor · 3
- Cloudflareorganization · 3
- OpenAIorganization · 2
- PHP Groupvendor · 2
- Laravelproduct · 2
- watchTowrorganization · 2
- Wizorganization · 2
- Califorganization · 2
- Spurvendor · 1
- Microsoft Entra IDproduct · 1
- Validinvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.