[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdC5PMFV4aTvfmzm4vaQUu6jPx5Eqefl4Nhufzs02tEw":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e0e7f1eb-531f-4043-b9c4-24f0b4ce4d78","PHP2Shell: Early Attack Activity Through Imperva’s Lens","php2shell-early-attack-activity-through-imperva-s-lens-91582f","Following the public disclosure of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research observed a sharp increase in scanning and exploitation attempts across protected environments. What had been a small number of unsuccessful probes before disclosure quickly grew into widespread automated activity targeting sites across industries and regions. Before public disclosure, Imperva participated in the coordinated […] The post PHP2Shell: Early Attack Activity Through Imperva’s Lens appeared first on Blog.","Following public disclosure of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research documented a sharp spike in scanning and exploitation attempts, recording 482,342 requests across 122,311 attack sessions targeting 21,998 sites in 103 countries within the first 24 hours. The activity exhibited opportunistic spray-and-pray scanning patterns with an average of 3.9 requests per session, concentrated in the United States (64.5% of targets) and spanning multiple industries including Business, Education, and Financial Services. Imperva had participated in coordinated disclosure alongside Wiz, OpenAI, and others, enabling rapid deployment of detection rules before the October 21 embargo lift.","PHP2Shell CVE-2026-109618\u002F109619 sees 482K requests targeting 22K sites in 24 hours post-disclosure.","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fphp2shell-early-attack-activity-through-impervas-lens\u002F","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fwp-content\u002Fuploads\u002Fsites\u002F9\u002F2026\u002F10\u002Fimperva_shield.png","2026-10-22T16:30:48+00:00","2026-10-23T15:08:56.549702+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"Imperva","vendor",{"name":21,"type":19},"Wiz",{"name":23,"type":19},"OpenAI",{"name":25,"type":26},"PHP2Shell","campaign",{"name":28,"type":29},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-109618","PHP2Shell vulnerability disclosed October 21, 2026",{"type":53,"value":57,"context":55},"CVE-2026-109619",[18,21,23],{"controls":60,"vendors":146},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":50,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":119,"name":120,"problem":121,"products":122},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[123,130,138],{"vendor_slug":124,"vendor_name":18,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",[147],{"slug":124,"name":18,"logo_path":125,"roles":148},[149],"reported_by"]