Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.
bleepingcomputer.com
· 2026-10-26
Researchers discovered two long-dormant vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that let attackers break into password-protected servers running the widely used web language. The PHP Foundation released public patches on Wednesday after giving major internet companies and hosting providers early access, prompting banks, hospitals, retailers and government agencies worldwide to take sites offline to update their systems.
techcrunch.com
· 2026-10-24
Security researchers disclosed a flaw in Brotli decoder versions 1.0.3 through 1.2.0 that lets maliciously crafted compressed data trigger an out-of-bounds write, potentially causing crashes, memory leaks, or remote code execution. The bug, rated 9.2 Critical by GitHub, affects any software built on Google's C decoder, including Node.js's built-in fetch and zlib bindings, Python's requests and aiohttp libraries, and frameworks like Express and body-parser that decompress Brotli-encoded data.
broccoli2shell.com
· 2026-10-24
A critical out-of-bounds write vulnerability in Google's Brotli decompression library, first disclosed in Node.js as CVE-2026-111497 on October 21, has been confirmed to affect Python, C++, bun, Envoy and other HTTP-related software. The bug lets an attacker send crafted Brotli-compressed data to corrupt memory, leak data, crash processes or potentially run arbitrary code; patches exist for some affected projects while others are still pending, and Apache and Nginx are not affected by default since they don't decode Brotli.
aikido.dev
· 2026-10-24
Gambit Security reported that over five days in September, a Chinese-speaking attacker used three AI agent frameworks and both open-weight and public AI models to target 105 e-commerce sites, compromising at least 27, including a Fortune 500 company. The attackers stole over 600,000 payment card records from two targets and installed skimmers on five others, spending an average of $25.46 per successfully breached target. Separately, Silverfort researchers said a lab test using Claude Opus achieved full domain compromise from initial access in eight minutes for about $12.
darkreading.com
· 2026-10-23
Researchers at Eye Security found that Time4Popcorn, a Popcorn Time fork, used an insecure HTTP updater pointing to an abandoned domain that accepted unsigned executables, letting anyone controlling the domain run code as SYSTEM or root. The firm registered the domain and 14 related ones, observed roughly 3 million Windows and 350,000 macOS connections, and between November 2025 and March 2026 pushed remediation code to disable the vulnerable updater, collecting no host data in the process.
bleepingcomputer.com
· 2026-10-23
The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
bleepingcomputer.com
· 2026-10-23
A Hacker News user named petecooper publicly apologized after posting details of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, ahead of a coordinated disclosure embargo. They said contacts had told them no embargo existed, and that they only wanted to warn others following PHP's four-week release cycle. The PHP Foundation had to move up its official announcement after multiple leaks, including one from Chainguard, surfaced before the planned release.
tomshardware.com
· 2026-10-23
Amazon's Threat Intelligence team says it detected an attempt to exploit two critical PHP vulnerabilities on October 17th, using a honeypot monitoring system, days before an official patch was released this week. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely execute malicious code on PHP-based systems including WordPress sites. The PHP Foundation's executive director Elizabeth Barron says there's no known successful remote code execution so far, but urges all affected systems be updated immediately.
theverge.com
· 2026-10-22
Amazon Threat Intelligence found an exploitation attempt against the PHP2Shell vulnerability (CVE-2026-109618/CVE-2026-109619) in its MadPot honeypot telemetry dated Oct. 17, 2026, four days before the embargoed flaw was publicly disclosed. The attempt came from an IP tied to a commercial anonymization service. After the embargo lifted on Oct. 21, Amazon observed multiple proof-of-concept exploits and additional attacks from varied anonymized infrastructure within hours, and the vulnerability is now reportedly being exploited broadly in the wild.
aws.amazon.com
· 2026-10-22
Security researchers disclosed two vulnerabilities affecting the PHP programming language, which is used by an estimated 70 percent of websites including Wikipedia, WordPress and Drupal. The flaws exist in every version of PHP released over roughly the past 20 years, and sites like DeviantArt and 4Chan were temporarily taken offline after disclosure.
theverge.com
· 2026-10-22
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.
news.ycombinator.com
· 2026-10-22
GoKawiil