PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
Stories per day · 30 days
Relatedphp94remote-code-execution35rce33wordpress16mod-php11cloudflare9web9honeypot8mirai6waf6coordinated-disclosure5php-fpm5potassium5aslr4pre-disclosure4wiz4botnet3emergency-patch3
21 stories, newest first · one card per story
Stories tagged #php2shell
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
Animated explainer walks through how PHP2Shell works
A Lobsters post points to a video that tries to explain a single-request PHP server compromise in its first three minutes.
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
3
Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
PHP2Shell attack attempts began before public disclosure
AWS honeypots logged attempts four days before patches; operators are told to review logs from October 17.
PHP2Shell flaws can give unauthenticated control of website servers
Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.
PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
Blog argues php2shell is unlikely to be mass-exploited
A public PoC needs four hits on one PHP worker plus the exact build, which the author says is slow to brute-force.
SANS finds published php2shell exploits unreliable outside lab setups
Working demos need an 8 MB memory limit, one prefork worker and on-box library offsets, and commands are capped at 14 bytes.
Third PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
PHP2Shell exploitation surges while most public PHP stays unpatched
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
PHP2Shell attack attempts continue with no confirmed compromises
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
1
AI bug hunting accelerates as PHP2Shell draws mass exploit attempts
Cloudflare's CEO said exploit attempts rose from thousands before disclosure to millions within hours.
Attackers exploited critical PHP flaws days before patches landed
AWS honeypots logged PHP2Shell attempts on October 17, four days before Wednesday's disclosure, and exploitation is now described as broad.
PHP patches PHP2Shell RCE bugs as exploit attempts hit sensors
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, are fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
2
Calif Research shows pre-auth PHP2Shell RCE on default PHP
The authors say paths dating to PHP 5.4.0 yield RCE, including on WordPress, Drupal, and Joomla.
Cloudflare WAF adds full-transaction detection and response rules
The features are generally available on every plan, including Free, and the first managed rules target php2shell.
PHP rushes emergency patches as early php2shell attacks reported
Cloudflare says early attacks are emerging and has pushed temporary firewall rules to all customers, including free accounts.