Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
1
Stories per day · 30 days
Relatedphp6php2shell3rce3remote-code-execution2cvss1mod-php1palo-alto-networks1php-fpm1security-release1unit-421use-after-free1
6 stories, newest first · one card per story
Stories tagged #web-servers
PHP patches two unauthenticated RCE flaws in four current branches
Maintainers say updating is the only fix, with the highest risk on Apache mod_php.
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
2
PHP patches unauthenticated RCE flaws dubbed PHP2Shell
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.
1
PHP security team schedules critical release for October 21
Two flaws each scored 9.2 will be detailed with patched versions at 14:00 UTC, or sooner if they leak.
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.
1