56 results for “PHP”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types122 Articles56 Advisories27 Write-ups19 Repos7 Threads7

More types3

Talks4 Other1 Tools1

📄 Articles “PHP”Clear all

securityweek.comarticle🛡️ Security

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

PAN-OSPHPWordPress+2

CVE-2026-109618CVE-2026-109619PHP2Shell+8

Threat Intel, AppSec· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

Fresh WordPress Vulnerability in Attackers’ Crosshairs

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

WordPressWordfencePHP

DefianteMudhrarace condition

AppSec, Threat Intel· Published and added 30 Oct 2026

rekt.newsarticle🧠 AI

Rekt - News or Hype?

Rekt's "News or Hype?" compares four October 2026 AI headlines with their sources. These are Justin Drake's "bunker mode" ECDSA warning, Anthropic's Claude tracing NIST curve seeds to lrand48, OpenAI's agent spending Sepolia ETH from a default-mnemonic account, and Wiz's "AI uncovers" PHP RCE claim of 70% reach. It ends with four questions for checking claims.

ECDSABitcoinEthereum+11

CVE-2026-109618CVE-2026-109619Justin Drake+17

ai-safety, agents, ai-policy· Added 30 Oct 2026

rekt.newsarticle🛡️ Security

Rekt - News or Hype?

Rekt News piece tracing three AI-security headlines back to their sources. It covers Justin Drake's October 2026 "bunker mode" warning about AI breaking ECDSA, OpenAI's report of a model spending Sepolia test ETH from a default developer mnemonic, and Wiz's "70% of the Internet" claim for PHP CVE-2026-109618 and CVE-2026-109619. It closes with four questions for checking a claim.

OpenAIPHPEthereum+3

CVE-2026-109618CVE-2026-109619Justin Drake+13

AI Security, other· Added 29 Oct 2026

aikido.devarticle🛡️ Security

What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained

Explainer on "shell" vulnerabilities, the -Shell naming for RCE flaws that began with Log4Shell (CVE-2021-44228). It compares memory-corruption bugs (PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Node2Shell, CVE-2026-111497, in the Brotli decoder) with design-flaw bugs (Log4Shell, React2Shell, CVE-2025-55182). It covers shared traits, exposure through inherited components, and Brotli patch status across runtimes and distributions.

PHPNode.jsReact+3

CVE-2026-109618CVE-2026-109619CVE-2026-111497+16

AppSec, Learning· Added 30 Oct 2026, published 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

A quiet week in infosec <.<

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

GoWindowsOpenAI+3

NIK C2PHP2ShellNode2Shell+7

Threat Intel, AI Security· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

Linux kernelLinuxPHP+1

CVE-2026-46300CVE-2026-109618CVE-2026-109619+9

Threat Intel, Offensive Security· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

SecurityWeek roundup of patches from Adobe, Veeam and Juniper Networks covering over three dozen vulnerabilities. Adobe fixed 12 flaws (eight critical in Campaign Classic), Veeam fixed nine (including a cross-tenant RCE in Backup for Microsoft 365), and Juniper fixed 18 in Session Smart Router and Conductor. None were reported exploited. Juniper said CVE-2026-109618 (PHP2Shell) affects Junos OS but is not exploitable there.

Adobe Campaign ClassicVeeam Backup & ReplicationVeeam Backup for Microsoft 365+2

CVE-2026-109618PHP2Shell

other· Published and added 29 Oct 2026

aikido.devarticle🛡️ Security

Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster

Aikido's analysis of the PHP2Shell disclosures (CVE-2026-109618 and CVE-2026-109619), published October 2026. It covers the timeline: the CVE IDs leaked on 20 October, PHP moved its release to 21 October, and Amazon reports exploitation attempts from 17 October. It cites Censys data (32.5 million services still affected on 27 October) and argues that AI-driven discovery and exploit building call for shorter embargoes and faster patching.

PHPAikido SecurityCodex+2

CVE-2026-109618CVE-2026-109619PHP2Shell+8

AI Security, AppSec· Added 28 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

PHPLinux kernelSSH+2

CVE-2026-109618CVE-2026-109619CVE-2026-46300+7

Threat Intel, Offensive Security· Published and added 28 Oct 2026

akamai.comarticle🛡️ Security

TLP Is Not a Suggestion

Akamai SIG argues that vendors and researchers broke embargo norms during the October 2026 PHP2Shell leak, when the PHP fix shipped a day early on 21 October. It explains the four TLP 2.0 labels, tabulates past embargo breaks (Heartbleed, a collapsed six-month kernel-era embargo, the Alibaba Cloud and MIIT case), and lists seven practices, such as no proofs of concept or CVE numbers before the fix.

PHP

CVE-2026-111497PHP2ShellTraffic Light Protocol+11

other· Added 30 Oct 2026, published 28 Oct 2026

wiz.ioarticle🛡️ Security

PHP2Shell: Exploitation Attempts and Remediation Trends

Wiz Research follow-up on PHP2Shell (CVE-2026-109618, CVE-2026-109619) after the 21 October 2026 disclosure. Honeypot data shows two variants of an open source exploit kit, one stopped by post_max_size and the other by failed memory leaks and worker pinning, plus PHP2Shell-branded tools that rely on session poisoning and LFI. Daily exposed vulnerable machines fell about 67%.

PHPApacheRoundcube

CVE-2026-109618CVE-2026-109619PHP2Shell+7

Threat Intel, Offensive Security· Published and added 27 Oct 2026

blog.cloudflare.comarticle🛡️ Security

Introducing the Cloudflare PHP Capture the Flag challenge

The Cloudflare PHP Capture the Flag challenge is a HackerOne bug bounty CTF. Researchers must bypass Cloudflare WAF rules protecting CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) on stock PHP 8.5.11 with Apache mod_php in a Cloudflare Container, get RCE, and read /flag. The post lists scope (POST to /php/* only), report requirements and duplicate rules, which count only materially distinct WAF bypasses.

CloudflarePHPHackerOne+1

CVE-2026-109618CVE-2026-109619PHP2Shell+1

AppSec, Offensive Security· Added 29 Oct 2026, published 27 Oct 2026

aikido.devarticle🛡️ Security

How to patch PHP2Shell with free Aikido Images

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

PHPDockerAikido Security+1

CVE-2026-109618CVE-2026-109619PHP2Shell

DevSecOps, AppSec· Published and added 26 Oct 2026

securityweek.comarticle🛡️ Security

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical unauthenticated RCE flaws in the PHP engine, patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Industrial vendors including Schneider Electric, Siemens, ABB, B&R, Johnson Controls, Belden, HMS Networks and Wibu-Systems have confirmed affected OT products, with fixed versions or mitigations listed. Rockwell Automation and Hitachi Energy were still assessing, and Moxa reported no impact.

PHPCloudflareDokuWiki+1

CVE-2026-109618CVE-2026-109619PHP2Shell+11

AppSec, Threat Intel· Published and added 26 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Moves From Probes to Working Shells

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

PHPApache

CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 26 Oct 2026

securitylabs.datadoghq.comarticle🛡️ Security

Code security for new coders

Code security for new coders is a Datadog Security Labs primer for vibe coders on first-party versus third-party code, hardcoded secrets and software supply chain risk (vulnerable and malicious dependencies). It lists security questions to put to a coding agent before and after code is written. It also defines SCA, SAST, IAST, DAST, IaC scanning and secret scanning, and cites the PHP2Shell vulnerabilities.

Datadog Code SecurityGuardDogSupply Chain Firewall+1

PHP2ShellOWASP

Learning, AppSec, Supply Chain· Added 29 Oct 2026, published 26 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships

Galaxy Research's weekly brief includes a section on PHP2Shell, two decade-old PHP remote code execution bugs affecting versions back to 5.4, patched in an emergency release. It reports an Amazon honeypot exploit attempt four days before disclosure, thousands of attempts in the 10 hours before the patch per Cloudflare's Matthew Prince, and NSA and FBI offline advice. The author argues the bugs were found with GPT-5.6 Sol and that defence must become agentic. It also lists the week's other incidents, including a CVSS 10.0 GitLab bug and eMudhra's guessable private keys.

PHPWordPressOpenAI+3

PHP2ShellPatch the PlanetCalif+7

Threat Intel, AI Security· Added 24 Oct 2026

endorlabs.comarticle🛡️ Security

Everything, everywhere, all at once… the week software broke | Endor Labs

Endor Labs roundup of the 20 to 21 October 2026 patch wave: eMudhra certificate authority keys that anyone can recover, PHP2Shell (CVE-2026-109618, CVE-2026-109619), Node2Shell (CVE-2026-111497) and malware in LiteLLM 1.107.0. It lists fixed versions (PHP 8.2.35 to 8.5.12, Node.js 22.23.4, 24.22.1, 26.12.1, LiteLLM back to 1.106.2) and explains why many separate trust-store copies each need updating. It closes with advice on triage, remediation and SBOM/VEX reporting.

PHPNode.jsLiteLLM+3

CVE-2026-109618CVE-2026-109619CVE-2026-111497+3

Supply Chain, AppSec· Published and added 24 Oct 2026

orca.securityarticle🛡️ Security

PHP2Shell: What This Week Tells Us About the Web We Built

PHP2Shell is the name for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4 9.2), in the PHP engine back to version 5.4. The post covers the leaked October 2026 embargo, AI-assisted exploit building by Calif and others, patch availability by PHP version, and a 72-hour and quarterly response plan covering inventory, patching, secret rotation and edge virtual patching. It ends with a short Orca product section.

PHPWordPressOrca Security

CVE-2026-109618CVE-2026-109619PHP2Shell+6

Blue Team & Detection, AppSec, GRC· Published and added 23 Oct 2026

securityweek.comarticle🛡️ Security

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) are unauthenticated RCE bugs in PHP, patched on 21 October 2026. Sophos, Arctic Wolf and Hunt.io tie exploitation attempts to the Potassium Mirai variant, and VulnCheck built an ASLR-bypassing exploit. SOCRadar and Hunt.io found an exposed attacker server, and Qualys data shows about 110 million instances on end-of-life PHP. No confirmed compromise exists.

PHPApacheWiz+1

CVE-2026-109618CVE-2026-109619PHP2Shell+14

Threat Intel, AppSec, Offensive Security· Published and added 23 Oct 2026

latent.spacearticle🧠 AI

[AINews] Black October

AINews issue for 21-22 October 2026, built from 12 subreddits and 544 Twitter accounts. It leads with "Black October", a 48-hour run of AI-found vulnerability disclosures (PHP2Shell, a GitLab CVSS 10 flaw, a LiteLLM 1.107.0 password stealer, eMudhra CA keys). It also covers MiniMax M3.1 Flash, Carbon-X and Flint releases, Artificial Analysis coding-agent and CritPt v2 results, and a METR/Redwood audit of OpenAI monitoring.

vLLMLiteLLMPHP+14

Latent SpaceAINewsAnthropic+43

models, evals, ai-safety· Published and added 23 Oct 2026

securityweek.comarticle🛡️ Security

Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’

Quest Diagnostics disclosed in a regulatory filing on Thursday that an unauthorized party accessed its Quanum Lab Services Manager, a platform where clients order tests and look up results. The company found the breach on Wednesday and notified federal law enforcement. The number of patients and records affected is unknown, and Quest said the breach is not related to the PHP vulnerabilities disclosed that week.

PHP

Quest DiagnosticsQuanum Lab Services ManagerAmerican Medical Collection Agency+1

Threat Intel· Published and added 23 Oct 2026

horizon3.aiarticle🛡️ Security

PHP2Shell Exposure Depends on More Than Whether You Use PHP

Horizon3.ai post on assessing exposure to PHP2Shell (CVE-2026-109618, CVE-2026-109619), two memory-handling flaws in PHP. It says affected PHP may be bundled in third-party products, containers or managed hosting, and that finding it shows a remediation need, not proven exploitability. It lists questions to ask hosting providers and says Horizon3.ai has validated exploitation under specific preconditions that are still being characterized.

PHP

CVE-2026-109618CVE-2026-109619PHP2Shell

AppSec, Offensive Security· Added 29 Oct 2026, published 22 Oct 2026

tldrsec.comarticle🛡️ Security

[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner

tl;dr sec #351 is a weekly security newsletter. Clint Gibler describes working with OpenAI, Calif, Wiz and the PHP maintainers on the PHP2Shell unauthenticated RCE disclosure, which affects 13 years of PHP. It also covers Datadog's pathrunner AWS IAM escalation framework, Trail of Bits' patching-bugs and regression-hunt Codex plugins, XBOW finding de-duplication, backdoored open-weight models, and CREBench.

PHPAWS IAMCodex+3

PHP2ShellPatch the PlanetCalif+10

AppSec, AI Security, Cloud & Infra· Added 30 Oct 2026, published 22 Oct 2026

securityweek.comarticle🛡️ Security

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

SecurityWeek roundup of responses to PHP2Shell, two critical unauthenticated RCE flaws (CVE-2026-109618, CVE-2026-109619) fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the exploitation timeline (first attempt 17 October), vendor exposure checks, Red Hat's lower 8.1 score against NVD's 9.8, detections from Cisco Talos, CrowdStrike and Corelight, and government alerts.

PHPAWSGoogle Cloud+3

CVE-2026-109618CVE-2026-109619PHP2Shell+6

Blue Team & Detection, AppSec· Published and added 22 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Exploitation Started Days Before Patches

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHPCloudflareVirusTotal+1

CVE-2026-109618CVE-2026-109619PHP2Shell+4

Threat Intel, AppSec· Published and added 22 Oct 2026

latent.spacearticle🧠 AI

[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

AINews issue for 20-21 October 2026. The top story covers PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two PHP-engine memory-corruption bugs found separately by Calif researchers using GPT-5.6 Sol under OpenAI's Patch the Planet and by Wiz, followed by two months of coordinated remediation. It also covers the Flint coding MoE, DeepSeek's DeepInfer, TorchTPU, eval critiques and agent product launches. The text is truncated.

PHPWordPressDrupal+11

CVE-2026-109618CVE-2026-109619OpenAI+35

models, inference, evals· Published and added 22 Oct 2026

latent.spacearticle🧠 AI

[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

This AINews issue (20 to 21 October 2026) leads with PHP2Shell, two PHP-engine memory-corruption bugs (CVE-2026-109618 and CVE-2026-109619). Calif researchers found them with GPT-5.6 Sol under OpenAI's Patch the Planet, and Wiz reportedly found them independently with Gemini 4 Argon. It reconstructs the two-month coordinated response, Cloudflare WAF stopgaps and NSA guidance, and the dispute over vetted researcher access to models. Only the first 40,000 of 114,281 characters were reviewed.

PHPWordPressDrupal+6

CVE-2026-109618CVE-2026-109619OpenAI+18

ai-policy, models· Added 23 Oct 2026, published 22 Oct 2026

latent.spacearticle🛡️ Security

[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

AINews issue of 20-21 October 2026 whose top story reconstructs PHP2Shell (CVE-2026-109618, CVE-2026-109619), two PHP-engine memory-corruption bugs with reported pre-auth RCE against WordPress, Drupal and Joomla. It covers the two-month coordinated disclosure, independent discovery by Calif/OpenAI (GPT-5.6 Sol) and Wiz, Cloudflare WAF stopgaps and NSA guidance. It flags missing primary sources: fixed versions, CVSS and leak details.

PHPWordPressDrupal+3

CVE-2026-109618CVE-2026-109619PHP2Shell+9

AppSec, AI Security· Published and added 22 Oct 2026

Showing 30 of 56