Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
64
Product
Laravel
- Mentions · 7d4
- Mentions · 30d4
- All mentions5
- First seenAug 21, 2026
- Last mentioned2d ago
Timeline
5 articles · newest firstTalos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.
90
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
A $25 template helped scammers build hundreds of phantom bank domains
Allure Security researchers found 838 live phantom bank sites sharing a $25 template, built to lend credibility to investment and romance scams.
41
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Drupalproduct · 3
- WordPressproduct · 3
- PHPproduct · 3
- Joomlaproduct · 2
- CERT-EUorganization · 2
- Magentoproduct · 2
- Djangoproduct · 1
- Patchstackorganization · 1
- Classtands Crestvictim · 1
- Cloudflarevendor · 1
- Jupyterproduct · 1
- Shopwareproduct · 1
- go2rtcproduct · 1
- watchTowrorganization · 1
- National Cyber Security Centreorganization · 1
- Symantecvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.