Section
Research
Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.
32 matching records, 6 with confirmed exploitation.
-
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
*October 26, 2026: This advisory has been updated to clarify language describing exploitability and potential impact.*October 23, 2026: This advisory has been updated with new ThreatLabz analysis and Zscaler Deception telemetry…
-
php2shell one week later: Why one exploit doesn’t work everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the…
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free…
-
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. Change log Update October 28…
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits…
-
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.
-
Censys takes census of the Internet like no one else
Key Takeaways: A messy week for PHP: how PHP2Shell was disclosed On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both…
-
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key…
-
Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
Executive Summary PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 score of 9.2, that can allow unauthenticated remote code execution on PHP installations serving web…
-
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Categories: Threat Research Tags: advisory, vulnerability, php
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including…
-
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level…
-
PHP2Shell Remote Code Execution Vulnerabilities
What is the Vulnerability? The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management…
-
PHP2Shell: What to know about two critical PHP flaws
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
-
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell…
-
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.
-
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to…
-
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell.
-
PHP2Shell Was Exploited Before the Patch
PHP2Shell was exploited four days before its patch. Learn why exploitation is moving ahead of disclosure and how security teams can respond.
-
CVE-2026-109618 / CVE-2026-109619
Advisory for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): affected PHP versions, fixed releases, mitigations, monitoring guidance, and the NodeZero Rapid Response check.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure can extend into bundled runtimes, containers, and hosted applications. Learn why identifying affected PHP is only the first step toward validating exploitability.
-
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed…
-
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
-
Lessons from Cybersecurity Black Week
A critical PHP flaw, leaked Linux kernel reports, a poisoned LiteLLM release, and more, all in seven days. Which threats called for immediate action, and which generated more noise than real danger?
-
This month in security with Tony Anscombe – October 2026 edition
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
-
PHP2Shell: Exploitation Attempts and Remediation Trends
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
-
(Reliable)? php2shell exploitability
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
-
PHP Vulnerability Wrap-Up
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never…
-
Putting models to the secure coding test: Security rules
We tested Sonnet 5, Composer 2.5, and GPT 5.5 using set security rules to see whether using them produces measurably more secure code.
-
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
Reuse this view
Same filters as JSON: /api/items?category=research&window=30d&vendor=PHP&limit=100. RSS for this section: feed.xml.