[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyDP87AU7P6kY8sBf3Eg-wVw7trddllEC4_xlY69nt5E":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"eeefb136-901d-4e3b-8f45-d5c874126a78","'PHP2Shell' Bugs Signal Red Alert for Security Industry","php2shell-bugs-signal-red-alert-for-security-industry-46f087","Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.","Security teams are actively remediating two critical PHP vulnerabilities labeled 'PHP2Shell' following the disclosure of technical details and confirmed reports of exploitation attempts in the wild. The vulnerabilities pose significant risk to web applications and servers running affected PHP versions.","Two critical PHP vulnerabilities dubbed 'PHP2Shell' reported with exploitation attempts underway.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fphp2shell-bugs-red-alert-security-industry","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt67e9fa778860769f\u002F6ad8fdb74b1e4143168658d7\u002Fwarning_sign_with_siren-DSGpro-GettyImages-184878150.jpg?width=720&quality=80&disable=upscale","2026-10-21T19:19:17+00:00","2026-10-21T20:00:13.704813+00:00",7,[17],{"name":18,"type":19},"PHP","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"malware","PHP2Shell","Vulnerability exploitation campaign targeting PHP applications",[18],{"controls":48,"vendors":131},[49,78,106],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,90,98],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":79,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":40,"name":107,"problem":108,"products":109},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[110,118,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":119,"product_name":120,"url":121,"description":122},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":144},"php2shell-critical-php-vulnerabilities-exploited-in-the-wild","PHP2Shell: Critical PHP Vulnerabilities Exploited in the Wild","Two critical PHP vulnerabilities, collectively dubbed 'PHP2Shell,' are being actively exploited, exposing web servers and applications to remote code execution risks. The root cause lies in delayed or absent patch application across PHP-powered infrastructure, compounded by slow organizational response once exploitation details become public. When technical details of a vulnerability are disclosed, threat actors move rapidly — often within hours — meaning unpatched systems become easy targets. This incident underscores that web-facing applications running outdated or vulnerable language runtimes represent a broad and easily enumerated attack surface. Organizations without mature vulnerability tracking and emergency patching processes will consistently lag behind attackers.",[137,138,139,140,141,142,143],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(b)":145,"PCI DSS Requirement 6":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"OWASP A06:2021 Vulnerable and Outdated Components":148,"CIS Control 7: Continuous Vulnerability Management":149,"MITRE ATT&CK T1190: Exploit Public-Facing Application":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151},"NIS2 requires operators of essential and important services to implement incident handling and vulnerability management measures, including timely patching of critical software like PHP to reduce exploitation risk.","Requirement 6 mandates that organizations develop and maintain secure systems by installing critical security patches within one month, which would have mitigated the window of exposure created by unpatched PHP2Shell vulnerabilities on payment-handling web servers.","SI-2 requires organizations to identify, report, and correct information system flaws — mandating the kind of emergency patching cadence that would have closed PHP2Shell before in-the-wild exploitation.","PHP2Shell is a textbook A06 scenario — using a vulnerable runtime component in production; OWASP guidance calls for continuous inventory and rapid upgrade of affected components to prevent exactly this type of attack.","PHP2Shell exploits a known, patchable flaw; a continuous vulnerability management program with defined SLAs for critical patches would have ensured timely remediation before exploitation attempts began.","PHP2Shell attacks align directly with T1190, where adversaries exploit vulnerabilities in internet-facing applications to gain initial access — understanding this technique drives prioritization of patching and WAF controls for public PHP endpoints.","This control explicitly requires organizations to obtain timely information about technical vulnerabilities in used software and take appropriate action, directly addressing the delayed patching that allowed PHP2Shell exploitation."]