Criminal forums go offline after PHP2Shell disclosure
Original title: The adversary economy: How threat actors are reacting to PHP2Shell
BreachForums, DarkForums, PwnForums and Dread paused or migrated within 48 hours, citing risk to member data.
Tenable says criminal forum operators scrambled after disclosure on October 20 of two critical unauthenticated PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored CVSS v4.0 9.2. Within 48 hours, BreachForums, DarkForums, PwnForums and Dread posted shutdown or maintenance notices, restricted registrations, or moved communications to Telegram. Tenable says the forums store member identities, messages and stolen credentials, and face risk from both law enforcement and rival criminals. The article credits frontier AI models with discovery and the exploitation chain.
Unconfirmed: Forum notices are reported by Tenable; the article does not confirm that any forum was successfully exploited.
- DarkForums said it would stay offline until PHP was patched globally.
- Dread’s maintenance notice named both CVEs.
- Tenable Vulnerability Watch labeled both flaws Vulnerabilities of Concern.
- DarkOwl described email addresses, IP logs, messages and transaction records behind forum PHP apps.
Impact: Potential exposure of forum member identities and stolen credentials
| Product | Affected |
|---|---|
| PHP | — |
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
7 min read at tenable.com
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key takeaways The adversary economy operates on the same fundamental principles as the legitimate economy.
By Raymond Carney · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.