[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f184anWczvgPCdIep9MiIXQrgoS8F52OP0hx8taJZkLo":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"edd8d853-052f-439d-bf50-70aa83304942","PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors","php2shell-patches-land-as-first-exploitation-attempts-hit-sensors-d40bfd","Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches. The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.","PHP has released patches for two critical-severity vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allowing unauthenticated remote code execution. Exploitation attempts were observed in the wild by multiple security firms, including before the patches were available. These vulnerabilities, affecting nearly all PHP releases back to version 5.4, could also lead to the exposure of sensitive process memory like credentials and API keys.","PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) are patched after exploitation attempts.","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-patches-land-as-first-exploitation-attempts-hit-sensors\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fphp-exploit-code.webp","2026-10-21T16:50:40+00:00","2026-10-21T18:00:06.508135+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"PHP Foundation","vendor",{"name":24,"type":19},"Apache",{"name":26,"type":19},"mod_php",{"name":28,"type":19},"PHP-FPM",{"name":30,"type":19},"php-cgi","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-109618","PHP2Shell vulnerability (out-of-memory corruption)",{"type":56,"value":60,"context":61},"CVE-2026-109619","PHP2Shell vulnerability (stale global state)",[21,18,24],{"controls":64,"vendors":144},[65,94,119],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":95,"product_name":116,"url":117,"description":118},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":53,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":140,"product_name":141,"url":142,"description":143},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[145,151,156],{"slug":146,"name":147,"logo_path":148,"roles":149},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[150],"reported_by",{"slug":152,"name":153,"logo_path":154,"roles":155},"vega","Vega","\u002Fvendor-logos\u002Fvega.png",[150],{"slug":157,"name":158,"logo_path":159,"roles":160},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png",[150],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"critical-php-rce-vulnerabilities-exploited-before-patches-available","Critical PHP RCE Vulnerabilities Exploited Before Patches Available","Two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were actively exploited in the wild before patches were even released, highlighting the danger of zero-day exposure windows in widely-deployed software. The flaws affect nearly all PHP versions back to 5.4, meaning a vast portion of the internet's web infrastructure was at risk simultaneously. Beyond code execution, these vulnerabilities could leak sensitive process memory including credentials and API keys, compounding the potential damage. This incident underscores why organizations must treat critical vulnerability disclosures as emergency events requiring immediate response, not routine patch cycles.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":174,"PCI DSS Requirement 6":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"OWASP A06:2021 Vulnerable and Outdated Components":177,"CIS Control 7: Continuous Vulnerability Management":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":180},"NIS2 mandates that essential and important entities handle incidents and apply security updates promptly; exploitation of a critical unpatched vulnerability in a core component like PHP would constitute a reportable failure under this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by installing critical security patches within one month, which directly applies to the delayed or absent patching of these critical PHP RCE vulnerabilities on any system handling cardholder data.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; an emergency remediation process mandated by this control would have accelerated patch deployment before widespread exploitation occurred.","PHP versions as old as 5.4 being in active use directly maps to this risk category, where failure to track and update third-party components exposes applications to known critical vulnerabilities.","Regular vulnerability scanning and a defined remediation SLA for critical findings would have ensured PHP systems were patched or mitigated the moment patches became available, closing the exploitation window as quickly as possible.","This control explicitly requires timely identification of technical vulnerabilities and evaluation of organizational exposure, which would have prompted an emergency response process when these critical PHP flaws were disclosed.","Because the vulnerabilities enabled unauthenticated remote code execution, enforcing strong access controls and minimizing the attack surface of PHP endpoints would have reduced the risk posed by unauthenticated exploitation paths."]