[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQy3X567CfxPJaj8XnIfQdy8jGU2JB4s_R4OaIfgGPqM":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"6d691702-680c-470c-9dd2-6897fd91fca9","PHP2Shell Exploitation Moves From Probes to Working Shells","php2shell-exploitation-moves-from-probes-to-working-shells-70e22a","Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24. The post PHP2Shell Exploitation Moves From Probes to Working Shells appeared first on SecurityWeek.","Researchers have confirmed successful exploitation of the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against honeypot servers. Attackers launched 35 shells from two IP addresses, demonstrating actual remote code execution beyond mere probes. While PHP released patches on October 21, exploitation attempts, including those bypassing ASLR, were observed prior to the fixes.","Attackers successfully exploited PHP2Shell vulnerabilities, launching 35 shells from two IP addresses.","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploitation-moves-from-probes-to-working-shells\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-10-26T13:30:10+00:00","2026-10-26T14:00:07.509529+00:00",8,[17,20,23],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"mod_php","technology",{"name":24,"type":25},"Mirai Botnet Operators","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":46,"value":50,"context":48},"CVE-2026-109619",[18],{"controls":53,"vendors":137},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":84,"product_name":105,"url":106,"description":107},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"php2shell-rce-active-exploitation-highlights-patching-urgency","PHP2Shell RCE: Active Exploitation Highlights Patching Urgency","Attackers successfully exploited two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to launch 35 remote shells against honeypot servers, confirming real-world weaponization beyond scanning activity. Exploitation was observed prior to the release of official patches on October 21, meaning organizations had a narrow window of exposure that many likely missed. The fact that ASLR bypass techniques were employed demonstrates that attackers were using sophisticated methods, not just opportunistic scanning. This incident underscores how quickly critical vulnerabilities move from proof-of-concept to active exploitation, leaving organizations that lack rapid patch deployment processes severely exposed.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"MITRE ATT&CK T1566: Phishing":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157},"NIS2 mandates vulnerability handling and disclosure practices for essential entities; operators bound by NIS2 would be required to have processes ensuring rapid response to critical vulnerabilities like these.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching, which would have required applying the PHP fix within the defined remediation window.","While not phishing-specific, the ATT&CK framework's coverage of initial access via exploitation of public-facing applications (T1190) directly maps to this incident, informing detection and response playbooks for RCE attempts against web servers.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; adherence would have mandated emergency patching of these critical CVEs within days of disclosure.","The exploitation directly targeted a known vulnerability in an unpatched PHP component, exactly the risk A06 addresses by requiring organizations to track and update third-party software.","Regularly scanning for and remediating vulnerabilities on a defined timeline would have flagged PHP2Shell as a critical priority and driven patching before exploitation occurred.","This control requires timely identification and remediation of technical vulnerabilities; a process aligned with A.8.8 would have ensured the October 21 patch was applied before exploitation escalated."]