Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
- Mentions · 7d0
- Mentions · 30d3
- All mentions7
- First seenAug 27, 2026
- Last mentioned9d ago
Timeline
7 articles · newest firstAI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Unit 42 says unattributed cluster CL-UNK-1211 backdoored government Linux servers and stole administrator credentials.
74
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Unit 42 says cluster CL-UNK-1211 used AI-generated payloads to spy on government Linux infrastructure.
78
WebPros security advisory (AV26-961)
Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.
68
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.
73
WebPros security advisory (AV26-866)
Canada's Cyber Centre relays a WebPros advisory for CVE-2026-67394, a Plesk privilege escalation flaw to root, fixed in 18.0.79.9 and 18.0.80.5.
30
WebPros security advisory (AV26-854)
Canadian Centre for Cyber Security relayed a WebPros advisory covering Plesk vulnerabilities CVE-2026-65642 and CVE-2026-65647 with fixed versions released.
32
Related CVEs
by mentions- Authenticated Privilege Escalation to Root RCE in cPanel & WHM
- Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- Authenticated OS Command Injection in Plesk Yields Root Code Execution
- CVE-2026-673941%9.0Command Injection Local Privilege Escalation in Plesk for Linux
- CVE-2026-65647<1%8.7Authenticated Root RCE via Improper Symlink Handling in Plesk
- Authenticated Root Code Execution via Untrusted Search Path in Plesk RESTful API
- CVE-2026-65642<1%8.6Authenticated IDOR in WebPros Plesk exposes other customers' databases
- CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
Appears with
- WebProsvendor · 4
- Canadian Centre for Cyber Securityorganization · 3
- cPanelproduct · 3
- Palo Alto Networksorganization · 2
- Palo Alto Networksvendor · 2
- CL-UNK-1211threat actor · 2
- PHPproduct · 2
- WebProsorganization · 2
- Cortex XDRproduct · 2
- WP Toolkitproduct · 2
- Unit 42organization · 2
- WHMproduct · 2
- Canadian Centre for Cyber Securityvendor · 1
- Site Importproduct · 1
- cPanelvendor · 1
- Drupalproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.