php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
- Mentions · 7d28
- Mentions · 30d106
- All mentions108
- First seenSep 10, 2026
- Last mentioned1d ago
Timeline
108 articles · newest firstCISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
84
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
86
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
86
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
30
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
58
CISA says PHP2Shell flaws are exploited for remote code execution
Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.
88
CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
86
CISA says attackers are exploiting critical PHP2Shell bugs
US civilian federal agencies have three days to patch passwordless remote break-ins in widely used PHP.
86
CISA adds exploited PHP2Shell flaws to its KEV catalog
Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.
88
CISA says PHP2Shell flaws are exploited for remote code execution
FCEB agencies must remediate CVE-2026-109618 and CVE-2026-109619 by Thursday; a separate RCE still has no patch.
86
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
88
Tenable outlines detection and patching for PHP2Shell
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
34
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
68
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
74
PHP2Shell exploitation confirmed with working shells on honeypots
Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.
84
CISA adds two exploited PHP flaws to the KEV catalog
CVE-2026-109618 and CVE-2026-109619 are known exploited; BOD 26-04 tells FCEB agencies to remediate them first.
84
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
75
PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26
A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.
88
PHP urges workaround for unpatched RCE CVE-2026-115560
The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.
62
PHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
Public PHP2Shell scripts drive mass scans of internet-facing PHP
Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.
74
Public PoC exploits PHP2Shell for RCE on PHP 8.4.26
The PoC is tuned for Alpine PHP 8.4.26 and succeeded in seven of ten lab runs.
74
Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
84
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Unofficial patch targets PHP2Shell OOM in PHP 5.4–5.6
The community backport covers unsupported PHP 5.4, 5.5, and 5.6 for CVE-2026-109618 and CVE-2026-109619.
46
PHP2Shell attack attempts began before public disclosure
AWS honeypots logged attempts four days before patches; operators are told to review logs from October 17.
74
PHP posts informational advisory on session upload progress
The oss-security note only links a PHP.net post and does not state impact, versions, or a fix.
24
PHP 8.2–8.5 OOM RCE cited again (CVE-2026-109618)
Christian Fischer's October 23 reply only links a CrowdStrike blog about PHP RCE zero-days.
42
PHP 8.2–8.5 stale-state RCE cited again (CVE-2026-109619)
The follow-up only links CrowdStrike's blog and gives no patch or attack details.
42
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
78
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP warns of unpatched RCE in rare session setup (CVE-2026-115560)
Only apps that switch the session serialize handler at runtime and leave upload progress on are exposed; no attacks on this bug are reported.
56
Essay says AI shrank PHP2Shell exploit time to hours
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
34
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
78
PHP2Shell attack attempts continue with no confirmed compromises
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
PHP before 8.2.35 and related releases allows remote code execution
Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.
78
Criminal forums go offline after PHP2Shell disclosure
BreachForums, DarkForums, PwnForums and Dread paused or migrated within 48 hours, citing risk to member data.
56
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2026-03222%8.6Authenticated root RCE in Palo Alto PAN-OS management
- CVE-2026-17544<1%8.1Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from…
- CVE-2026-91766<1%5.9PHP HTTP Stream Wrapper Leaks Credentials on Redirects
- CVE-2026-7260<1%5.4Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.*…
Appears with
- CISAorganization · 20
- Cloudflareorganization · 20
- watchTowrorganization · 19
- Wizorganization · 15
- OpenAIorganization · 12
- Amazonorganization · 10
- CERT-EUorganization · 8
- Califorganization · 8
- Sophosorganization · 7
- PHP-FPMproduct · 6
- Miraimalware · 6
- WordPressproduct · 6
- Potassiummalware · 6
- VulnCheckorganization · 5
- NCSCorganization · 5
- PHP Foundationorganization · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.