PrestaShop debug mode allows PHP injection (CVE-2026-124916)
A back-office user who can edit debug settings can inject PHP; 9.2.1 fixes it, but affected releases are unconfirmed.
Stories per day · 30 days
3 RSS
Relatedphp2shell130remote-code-execution69rce65wordpress26mod-php19web12cloudflare11coordinated-disclosure11memory-corruption11cisa10honeypot10php-fpm10wiz9kev8mirai8openai8waf8nodejs7
192 stories, newest first · one card per story
Stories tagged #php
PHP2Shell heap exploitation leads to RCE in PHP
Author shares step-by-step research on PHP2Shell UAF chain using OOM and session handling for remote code execution.
1
Insignary releases free tool to detect PHP2Shell and Node2Shell exposures
insignary-chk is a free read-only scanner that helps organizations find Linux servers and container images exposed to PHP2Shell and Node2Shell vulnerabilities.
ADOdb vulnerability fixed in Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS (USN-7530-2)
USN-7530-2 provides updates for the ADOdb vulnerability in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
AI-assisted exploit turns PHP memory error into server code execution
PHP2Shell vulnerability in legacy PHP allows arbitrary code execution via out-of-memory error, discovered and patched with AI tools before any exploitation.
1
PHP2Shell vulnerability exploitable but impractical for unskilled attackers
Experiment on stealmybitcoin.com showed PHP2Shell drains Bitcoin wallets but required specific setup and only one of tens of thousands succeeded.
Hacktober 2026 wave of cyberattacks hits Binance, PHP, Node.js, and LiteLLM
Binance reports $6.3B unauthorized transactions while PHP and Node.js vulnerabilities are fixed and the Pentagon breach affects millions.
Blogger rejects LLMs for research and criticizes AI security marketing
The post contrasts Calif, OpenAI and Wiz narratives on PHP flaws and says a Tailscale hash drop was not responsibly disclosed.
1
Attackers chain PHP2Shell flaws to root Palo Alto PAN-OS firewalls
Hunt.io says 24 perimeter firewalls and one internal management server were compromised, including a US government-affiliated environment.
Critical PHP RCE flaws may affect Cisco products
CVE-2026-109618 and CVE-2026-109619, called PHP2shell, were fixed in a PHP security release announced October 21.
Japan reports a wave of AI-assisted attacks on firms and agencies
Officials cite data on about 260 million people since April, while leak reports rose from 303 in September to 830 in October.
2
ESET October roundup covers PHP2Shell, store attacks and Denmark breach
The video recaps PHP flaws, attacks on refrigeration at up to 700 French stores, an 8.8 million-person Danish registry leak, and preinstalled Android malware.
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
1
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
Checkmarx says PHP patch rush shows remediation bottlenecks
A PHP advisory requires a runtime update because the attack path can run before application code.
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
Hirundo says weight edits can remove Qwen3-Coder's pro-CCP bias
Even after the change, generated apps still failed a security benchmark more than half the time.
1
Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
1
CISA says PHP2Shell flaws are exploited for remote code execution
Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.