[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2kR5gPJYV3TOXEwSu8tXKyFFajy7N7Jc87ymLfTETRE":3},{"article":4,"iocs":53,"watch_terms":66,"solutions":67,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"d62e4b16-9950-45a8-a85d-25642cbdf307","Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits","reports-of-php-bug-exploitation-attempts-grow-as-experts-downplay-viability-of-e-e6136b","The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track — and a lot to debunk.","Two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), dubbed PHP2Shell, are attracting widespread exploitation attempts dating back to October, with Amazon, Sophos, Google, and others reporting activity. However, dozens of security experts contend that nearly all attempts have failed and that publicly available proof-of-concept exploits only work in lab environments, not on properly configured production systems. The main barrier is ASLR (Address Space Layout Randomization), though VulnCheck has developed a novel bypass technique, and experts warn that patching vulnerable systems remains critical.","PHP2Shell vulnerabilities see rising exploitation attempts, but experts say most PoCs fail in real-world conditions.","https:\u002F\u002Ftherecord.media\u002Fphp-php2shell-exploitation-attempts-pocs","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fphp_shahadat_rahman_unsplash_14f00bee62.jpg","2026-10-23T04:00:00+00:00","2026-10-23T18:01:14.676826+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Amazon","vendor",{"name":24,"type":22},"Google",{"name":26,"type":22},"Sophos",{"name":28,"type":22},"VulnCheck",{"name":30,"type":31},"ASLR (Address Space Layout Randomization)","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60,63],{"type":55,"value":56,"context":57},"cve","CVE-2026-109618","PHP vulnerability part of PHP2Shell pair",{"type":55,"value":59,"context":57},"CVE-2026-109619",{"type":47,"value":61,"context":62},"Potassium botnet","Botnet linked to PHP2Shell exploitation attempts observed by Arctic Wolf",{"type":47,"value":64,"context":65},"Mirai botnet","Botnet variant linked to PHP2Shell exploitation attempts observed by Cobalt researchers",[24,21,26],{"controls":68,"vendors":153},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,110,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":99,"product_name":107,"url":108,"description":109},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":52,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":147,"vendor_name":24,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[154,157],{"slug":147,"name":24,"logo_path":148,"roles":155},[156],"reported_by",{"slug":158,"name":26,"logo_path":159,"roles":160},"sophos","\u002Fvendor-logos\u002Fsophos.png",[156],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"php2shell-exploitation-attempts-highlight-patching-and-configuration-gaps","PHP2Shell Exploitation Attempts Highlight Patching and Configuration Gaps","Two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have attracted widespread exploitation attempts, though most have failed against properly configured production systems due to ASLR. This incident illustrates that even when environmental mitigations reduce immediate risk, unpatched systems remain a ticking clock — as demonstrated by VulnCheck's novel ASLR bypass technique, which proves viable exploitation is a matter of time and attacker ingenuity. Organizations that delay patching because exploits 'seem unlikely to succeed' are gambling on a shrinking window of protection. The case also underscores that security hardening measures like ASLR are a defense-in-depth layer, not a substitute for prompt patching.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":174,"PCI DSS Requirement 6":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"CIS Control 17: Incident Response Management":177,"OWASP A06:2021 Vulnerable and Outdated Components":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180},"NIS2 mandates that essential and important entities implement vulnerability handling and disclosure policies, which would compel the timely patching cadence needed to address these PHP flaws.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches within defined timeframes, directly applicable to the PHP vulnerabilities being actively targeted.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, directly mandating the rapid patching that would have neutralized these PHP vulnerabilities.","The widespread exploitation attempts reported by Amazon, Sophos, and Google underscore the need for a practiced incident response capability to triage, assess, and contain active exploitation activity quickly.","The PHP2Shell vulnerabilities are a textbook example of the risk posed by running outdated or unpatched software components in production web environments.","Regular vulnerability scanning and time-bound remediation would have ensured PHP systems were patched before active exploitation attempts reached production environments.","This control requires timely identification and remediation of technical vulnerabilities in systems, which would have driven patching of the PHP flaws before exploitation attempts escalated."]