articleas classification.key entities2026-11-01
articleas classification.key entities2026-10-30
articleas threat actors2026-10-29It is written here as PHP2Shell (threat linked by the page to ANA's suspension of certain website and mobile app services since October 21, 2026, not to the Amadeus incident).
threat linked by the page to ANA's suspension of certain website and mobile app services since October 21, 2026, not to the Amadeus incident
articleas threat actors2026-10-29
advisoryas threat actors2026-10-29It is written here as PHP2Shell (name for CVE-2026-109618 and CVE-2026-109619; actively exploited against internet-exposed PAN-OS management interfaces, reported 29 October 2026).
name for CVE-2026-109618 and CVE-2026-109619; actively exploited against internet-exposed PAN-OS management interfaces, reported 29 October 2026
articleas threat actors2026-10-29It is written here as PHP2Shell (named in a Talos podcast episode title; related to the critical PHP vulnerabilities).
named in a Talos podcast episode title; related to the critical PHP vulnerabilities
articleas threat actors2026-10-29It is written here as PHP2Shell (exploited in the Steal My Bitcoin CTF).
exploited in the Steal My Bitcoin CTF
articleas classification.key entities2026-10-29
articleas threat actors2026-10-29It is written here as PHP2Shell (name given to a set of vulnerabilities in a separate Juniper Networks advisory).
name given to a set of vulnerabilities in a separate Juniper Networks advisory
articleas threat actors2026-10-29It is written here as PHP2Shell (name for two PHP runtime vulnerabilities, present for about twenty years; exploitation attempts reported widespread, with a few successful ones).
name for two PHP runtime vulnerabilities, present for about twenty years; exploitation attempts reported widespread, with a few successful ones
talkas threat actors2026-10-29It is written here as PHP2Shell (PHP vulnerabilities, now exploited in the wild by attackers after an initial period with no working exploits).
PHP vulnerabilities, now exploited in the wild by attackers after an initial period with no working exploits
articleas classification.key entities2026-10-28
articleas classification.key entities2026-10-28
articleas classification.key entities2026-10-28
articleas classification.key entities2026-10-27
articleas threat actors2026-10-27It is written here as php2shell (name given to the PHP vulnerabilities behind the events of the previous week).
name given to the PHP vulnerabilities behind the events of the previous week
articleas threat actors2026-10-26It is written here as PHP2Shell (name for the pair of PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Cloudflare reports exploitation has started).
name for the pair of PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619; Cloudflare reports exploitation has started
threadas classification.key entities2026-10-26
writeupas classification.key entities2026-10-26
articleas classification.key entities2026-10-26
articleas classification.key entities2026-10-26
articleas classification.key entities2026-10-26
talkas classification.key entities2026-10-25
articleas classification.key entities2026-10-25
articleas classification.key entities2026-10-24
advisoryas threat actors2026-10-23It is written here as PHP2Shell (name used for exploitation of CVE-2026-109618 and CVE-2026-109619; earliest reported attempt October 17, 2026 by Amazon Threat Intelligence).
name used for exploitation of CVE-2026-109618 and CVE-2026-109619; earliest reported attempt October 17, 2026 by Amazon Threat Intelligence
articleas classification.key entities2026-10-23
articleas classification.key entities2026-10-23
advisoryas threat actors2026-10-23It is written here as PHP2Shell (named as the issue whose emergency patches were released two days before this post).
named as the issue whose emergency patches were released two days before this post
threadas classification.key entities2026-10-23
writeupas classification.key entities2026-10-23
threadas classification.key entities2026-10-23
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
threadas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-22
articleas classification.key entities2026-10-21
repoas tools2026-10-21
Research toolkit by devploit for pre-auth RCE against CVE-2026-109618/CVE-2026-109619 in session.upload_progress; includes version-aware dispatcher, profile engine, Docker labs, calibration factory and instrumentation.
articleas classification.key entities2026-10-21
advisoryas classification.key entities2026-10-21
articleas classification.key entities2026-10-21
articleas classification.key entities2026-10-21
advisoryas threat actors2026-10-21It is written here as PHP2Shell (name for the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619; Cloudflare reports attackers are already mutating payloads to evade its WAF rules).
name for the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619; Cloudflare reports attackers are already mutating payloads to evade its WAF rules
articleas classification.key entities2026-10-21
advisoryas classification.key entities2026-10-21
advisoryas tools2026-10-21It is written here as PHP2Shell: proof-of-concept tool for the PHP vulnerabilities that surfaced online after the leak..
articleas classification.key entities2026-10-21
advisoryas threat actors2026-10-21It is written here as PHP2Shell (informal name for the two PHP vulnerabilities; no confirmed in-the-wild exploitation reported yet; Sansec expects mass exploitation within 15 minutes of patch release).
informal name for the two PHP vulnerabilities; no confirmed in-the-wild exploitation reported yet; Sansec expects mass exploitation within 15 minutes of patch release
articleas classification.key entities2026-10-21
writeupas tools2026-10-21It is written here as php2shell: Wiz Research exploit script combining the PHP bugs to achieve unauthenticated remote code execution.
repoas classification.key entities2026-10-21
articleas threat actors2026-10-21It is written here as PHP2Shell (public name for the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619; no exploitation in the wild seen by WatchTowr or Huntress).
public name for the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619; no exploitation in the wild seen by WatchTowr or Huntress
advisoryas classification.key entities2026-10-21
advisoryas threat actors2026-10-21It is written here as PHP2SHELL (name used in the page title for the PHP vulnerabilities; the page names no threat actor and gives no exploitation details).
name used in the page title for the PHP vulnerabilities; the page names no threat actor and gives no exploitation details
writeupas threat actors2026-10-21It is written here as PHP2Shell (name for exploitation of CVE-2026-109618 and CVE-2026-109619; AWS reported exploitation attempts in the wild as early as October 17, 2026, and multiple reports of active exploitation and broad untargeted scanning as of October 21, 2026).
name for exploitation of CVE-2026-109618 and CVE-2026-109619; AWS reported exploitation attempts in the wild as early as October 17, 2026, and multiple reports of active exploitation and broad untargeted scanning as of October 21, 2026
advisoryas threat actors2026-10-20It is written here as PHP2Shell (name for CVE-2026-109618 and CVE-2026-109619; exploitation observed in the wild since October 21, 2026; no attribution made public).
name for CVE-2026-109618 and CVE-2026-109619; exploitation observed in the wild since October 21, 2026; no attribution made public
articleas classification.key entities
advisoryas classification.key entities
writeupas classification.key entities