[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3bG15Sw-T5scdjIHBnHxwWBnxrq8-o1QEC5Nc5u_i5o":3},{"article":4,"iocs":54,"watch_terms":64,"solutions":65,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f0e080be-9953-4494-b7e2-b15af42e44e3","CISA confirms PHP2Shell vulnerabilities now exploited in attacks","cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks-c79b90","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]","CISA has added the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to patch them by Thursday. These critical flaws allow unprivileged attackers to achieve remote code execution on unpatched systems. Exploitation attempts were detected by multiple security firms before patches were released, with active exploitation confirmed by honeypots.","CISA confirms PHP2Shell vulnerabilities are now actively exploited in attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F26\u002FPHP.jpg","2026-10-27T08:20:54+00:00","2026-10-27T09:00:14.236977+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"PHP","product",{"name":24,"type":19},"Cloudflare",{"name":26,"type":19},"Amazon",{"name":28,"type":19},"Hadrian",{"name":30,"type":19},"watchTowr","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61],{"type":56,"value":57,"context":58},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":56,"value":60,"context":58},"CVE-2026-109619",{"type":56,"value":62,"context":63},"CVE-2026-115560","Unpatched RCE flaw in PHP",[18,24,26],{"controls":66,"vendors":146},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,105,113],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":97,"product_name":102,"url":103,"description":104},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":53,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,138],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[147,152],{"slug":148,"name":24,"logo_path":149,"roles":150},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[151],"reported_by",{"slug":153,"name":30,"logo_path":154,"roles":155},"watchtowr","\u002Fvendor-logos\u002Fwatchtowr.png",[151],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":168},"php2shell-rce-vulnerabilities-actively-exploited-before-patches-applied","PHP2Shell RCE Vulnerabilities Actively Exploited Before Patches Applied","Attackers are actively exploiting two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unprivileged remote code execution on unpatched systems, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Exploitation was detected by honeypots before many organizations had an opportunity to patch, highlighting the dangerously narrow window between public disclosure and weaponization. This incident underscores that unpatched internet-facing services remain one of the most reliable attack vectors, and that organizations without rapid, prioritized patching processes are disproportionately exposed. Federal agencies now face a hard patching deadline, but private sector organizations with no equivalent mandate are equally at risk if they lack mature vulnerability management programs.",[161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":169,"PCI DSS Requirement 6":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"OWASP A06:2021 Vulnerable and Outdated Components":172,"CIS Control 7: Continuous Vulnerability Management":173,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":174,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":175},"NIS2 requires entities to implement vulnerability handling and patching policies as part of cybersecurity risk management, making timely remediation of known exploited vulnerabilities a regulatory obligation.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying critical security patches within defined timeframes, which would have driven faster remediation of these critical RCE flaws.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timelines, directly addressing the failure to patch critical RCE vulnerabilities before exploitation began.","PHP2Shell is a third-party component; this OWASP risk category specifically calls out the danger of running unpatched or outdated software components exposed to the internet.","Continuous vulnerability scanning and a defined remediation timeline would have identified the PHP2Shell flaws and triggered patching before active exploitation reached production systems.","This control mandates timely identification and remediation of technical vulnerabilities in systems, which would have obligated organizations to act on PHP2Shell patches before attackers exploited the flaws.","The vulnerabilities allow unprivileged attackers to achieve RCE, indicating that layered access controls and least-privilege principles on the application tier could have reduced the blast radius of exploitation."]