🕵️ PHP2Shell

The items that name it 61

• Was I wrong about open models & cyber risks?
  articleas classification.key entities2026-10-30
• Japan Airlines suffers third-party data breach exposing passenger info
  articleas threat actors2026-10-29It is written here as PHP2Shell (threat linked by the page to ANA's suspension of certain website and mobile app services since October 21, 2026, not to the Amadeus incident).

  threat linked by the page to ANA's suspension of certain website and mobile app services since October 21, 2026, not to the Amadeus incident

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas threat actors2026-10-29
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
  advisoryas threat actors2026-10-29It is written here as PHP2Shell (name for CVE-2026-109618 and CVE-2026-109619; actively exploited against internet-exposed PAN-OS management interfaces, reported 29 October 2026).

  name for CVE-2026-109618 and CVE-2026-109619; actively exploited against internet-exposed PAN-OS management interfaces, reported 29 October 2026

• A quiet week in infosec <.<
  articleas threat actors2026-10-29It is written here as PHP2Shell (named in a Talos podcast episode title; related to the critical PHP vulnerabilities).

  named in a Talos podcast episode title; related to the critical PHP vulnerabilities

• [tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers
  articleas threat actors2026-10-29It is written here as PHP2Shell (exploited in the Steal My Bitcoin CTF).

  exploited in the Steal My Bitcoin CTF

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas classification.key entities2026-10-29
• Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
  articleas threat actors2026-10-29It is written here as PHP2Shell (name given to a set of vulnerabilities in a separate Juniper Networks advisory).

  name given to a set of vulnerabilities in a separate Juniper Networks advisory

• Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
  articleas threat actors2026-10-29It is written here as PHP2Shell (name for two PHP runtime vulnerabilities, present for about twenty years; exploitation attempts reported widespread, with a few successful ones).

  name for two PHP runtime vulnerabilities, present for about twenty years; exploitation attempts reported widespread, with a few successful ones

• The OpenSourceMalware Show #27
  talkas threat actors2026-10-29It is written here as PHP2Shell (PHP vulnerabilities, now exploited in the wild by attackers after an initial period with no working exploits).

  PHP vulnerabilities, now exploited in the wild by attackers after an initial period with no working exploits

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  articleas classification.key entities2026-10-28
• TLP Is Not a Suggestion
  articleas classification.key entities2026-10-28
• CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
  articleas classification.key entities2026-10-28
• PHP2Shell: Exploitation Attempts and Remediation Trends
  articleas classification.key entities2026-10-27
• Introducing the Cloudflare PHP Capture the Flag challenge
  articleas threat actors2026-10-27It is written here as php2shell (name given to the PHP vulnerabilities behind the events of the previous week).

  name given to the PHP vulnerabilities behind the events of the previous week

• How to patch PHP2Shell with free Aikido Images
  articleas threat actors2026-10-26It is written here as PHP2Shell (name for the pair of PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Cloudflare reports exploitation has started).

  name for the pair of PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Cloudflare reports exploitation has started

• Trail of Bits (@trailofbits) on X
  threadas classification.key entities2026-10-26
• PHP2Shell: From the attacker’s perspective
  writeupas classification.key entities2026-10-26
• Industrial Vendors Check Products for PHP2Shell Vulnerabilities
  articleas classification.key entities2026-10-26
• PHP2Shell Exploitation Moves From Probes to Working Shells
  articleas classification.key entities2026-10-26
• Code security for new coders
  articleas classification.key entities2026-10-26
• Podcast: Kimi K3.1 Pro, the new cyber reality, and Muse musings
  talkas classification.key entities2026-10-25
• Bye Bye Brotli? Google's Compression Library Is a Security Mess
  articleas classification.key entities2026-10-25
• Everything, everywhere, all at once… the week software broke | Endor Labs
  articleas classification.key entities2026-10-24
• CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available
  advisoryas threat actors2026-10-23It is written here as PHP2Shell (name used for exploitation of CVE-2026-109618 and CVE-2026-109619; earliest reported attempt October 17, 2026 by Amazon Threat Intelligence).

  name used for exploitation of CVE-2026-109618 and CVE-2026-109619; earliest reported attempt October 17, 2026 by Amazon Threat Intelligence

• PHP2Shell: What This Week Tells Us About the Web We Built
  articleas classification.key entities2026-10-23
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  articleas classification.key entities2026-10-23
• Xavier Rivera (@XavierRiveraX) on X
  advisoryas threat actors2026-10-23It is written here as PHP2Shell (named as the issue whose emergency patches were released two days before this post).

  named as the issue whose emergency patches were released two days before this post

• Previdian (@PrevidianCyber) on X
  threadas classification.key entities2026-10-23
• Python Packages Vulnerable to Node2Shell
  writeupas classification.key entities2026-10-23
• Marcus Hutchins (@MalwareTechBlog) on X
  threadas classification.key entities2026-10-23
• PHP2Shell Exposure Depends on More Than Whether You Use PHP
  articleas classification.key entities2026-10-22
• [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
  articleas classification.key entities2026-10-22
• Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  articleas classification.key entities2026-10-22
• Paul Dragoonis (@dr4goonis) on X
  threadas classification.key entities2026-10-22
• PHP2Shell Exploitation Started Days Before Patches
  articleas classification.key entities2026-10-22
• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas classification.key entities2026-10-22
• [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
  articleas classification.key entities2026-10-22
• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
  articleas classification.key entities2026-10-22
• There isn't an easy exploit for this PHP vulnerability
  articleas classification.key entities2026-10-21
• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
  articleas classification.key entities2026-10-21
• PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Remotely exploitable PHP bug found on 70% of world’s websites
  articleas classification.key entities2026-10-21
• PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
  articleas classification.key entities2026-10-21
• PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs
  advisoryas threat actors2026-10-21It is written here as PHP2Shell (name for the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619; Cloudflare reports attackers are already mutating payloads to evade its WAF rules).

  name for the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619; Cloudflare reports attackers are already mutating payloads to evade its WAF rules

• PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  articleas classification.key entities2026-10-21
• Two critical RCEs in PHP core
  advisoryas classification.key entities2026-10-21
• PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Cloudflare deploys protections against php2shell vulnerability
  articleas classification.key entities2026-10-21
• Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)
  advisoryas threat actors2026-10-21It is written here as PHP2Shell (informal name for the two PHP vulnerabilities; no confirmed in-the-wild exploitation reported yet; Sansec expects mass exploitation within 15 minutes of patch release).

  informal name for the two PHP vulnerabilities; no confirmed in-the-wild exploitation reported yet; Sansec expects mass exploitation within 15 minutes of patch release

• Introducing full transaction detection for Cloudflare WAF
  articleas classification.key entities2026-10-21
• PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
  writeupas classification.key entities2026-10-21
• eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  repoas classification.key entities2026-10-21
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
  articleas threat actors2026-10-21It is written here as PHP2Shell (public name for the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619; no exploitation in the wild seen by WatchTowr or Huntress).

  public name for the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619; no exploitation in the wild seen by WatchTowr or Huntress

• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.key entities2026-10-21
• Critical vulnerabilities in PHP (PHP2SHELL)
  advisoryas threat actors2026-10-21It is written here as PHP2SHELL (name used in the page title for the PHP vulnerabilities; the page names no threat actor and gives no exploitation details).

  name used in the page title for the PHP vulnerabilities; the page names no threat actor and gives no exploitation details

• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeupas threat actors2026-10-21It is written here as PHP2Shell (name for exploitation of CVE-2026-109618 and CVE-2026-109619; AWS reported exploitation attempts in the wild as early as October 17, 2026, and multiple reports of active exploitation and broad untargeted scanning as of October 21, 2026).

  name for exploitation of CVE-2026-109618 and CVE-2026-109619; AWS reported exploitation attempts in the wild as early as October 17, 2026, and multiple reports of active exploitation and broad untargeted scanning as of October 21, 2026

• Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619)
  advisoryas threat actors2026-10-20It is written here as PHP2Shell (name for CVE-2026-109618 and CVE-2026-109619; exploitation observed in the wild since October 21, 2026; no attribution made public).

  name for CVE-2026-109618 and CVE-2026-109619; exploitation observed in the wild since October 21, 2026; no attribution made public

• Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
  articleas classification.key entities
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
  advisoryas classification.key entities
• PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)
  writeupas classification.key entities