[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHz9Rt1DT0TN2S8fiGhFTKtb7BpXfc3w8G9SHDlBKDzs":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"a6155a0d-1804-459f-8199-f61ee7e7254c","426 Android and iOS Apps Linked to PHP2Shell Backend Risks","426-android-and-ios-apps-linked-to-php2shell-backend-risks-27f2d2","Research found 426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns…","Security researchers discovered 426 mobile applications on Android and iOS that connect to backend servers potentially vulnerable to PHP2Shell flaws. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute code on affected servers. Developers are urged to verify their backend server versions and apply patches to prevent potential exploitation.","426 Android and iOS apps linked to servers with PHP2Shell vulnerabilities.","https:\u002F\u002Fhackread.com\u002F426-android-ios-apps-linked-php2shell-backend-risks\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002F426-android-ios-apps-linked-php2shell-backend-risks.jpg","2026-10-23T12:41:06+00:00","2026-10-23T13:00:05.371887+00:00",8,[17,20,23],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"mod_php","technology",{"name":24,"type":25},"NowSecure","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":51,"value":55,"context":53},"CVE-2026-109619",[24,18],{"controls":58,"vendors":142},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":89,"product_name":110,"url":111,"description":112},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":114,"name":115,"problem":116,"products":117},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"426-mobile-apps-expose-backend-servers-to-unauthenticated-remote-code-execution","426 Mobile Apps Expose Backend Servers to Unauthenticated Remote Code Execution","Hundreds of Android and iOS applications were found connecting to backend servers running a vulnerable version of PHP2Shell, exposing them to two critical CVEs that allow unauthenticated remote code execution. The root cause is straightforward: developers failed to keep their server-side dependencies patched and audited, creating a silent but severe attack surface behind otherwise functional mobile apps. This matters because exploiting these flaws requires no credentials, meaning any internet-connected attacker could fully compromise the backend and the data of every user served by those 426 apps. The scale of the exposure — spanning both major mobile platforms — illustrates how a single unpatched backend component can become a systemic risk across an entire developer ecosystem.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":156,"PCI DSS Requirement 6":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 requires entities to implement vulnerability handling and patching policies as part of their cybersecurity risk-management measures, directly applicable to the failure to patch these backend server flaws.","Requirement 6 mandates secure development practices and timely patching of vulnerabilities in system components; compliance would have ensured backend servers were assessed and updated against known CVEs.","SI-2 requires organisations to identify, report, and correct information system flaws; applying that control to backend dependencies would have mandated timely patching of CVE-2026-109618 and CVE-2026-109619.","This finding is a textbook A06 scenario — developers deployed and retained an outdated server-side component with known critical vulnerabilities, exactly the risk OWASP A06 is designed to prevent.","Regular automated scanning of backend servers against known CVEs would have identified the vulnerable PHP2Shell versions before attackers could exploit them.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in systems; adherence would have required tracking and patching the PHP2Shell flaws across all backend servers.","The vulnerabilities allow unauthenticated attackers to execute code, highlighting that backend endpoints lacked proper access controls that this framework profile explicitly requires."]