[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpS1RbTlx-givBWgYztedIW676FplKCDVg3z3NytS5mI":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c18923fe-9759-4550-925a-fc2b766ab43d","PHP2Shell Exploitation Started Days Before Patches","php2shell-exploitation-started-days-before-patches-514a03","Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.","Threat actors began exploiting critical remote code execution vulnerabilities in PHP, known as PHP2Shell, four days before official patches were released. Exploitation attempts were observed as early as October 17, originating from anonymized IP addresses, with mass exploitation occurring shortly after patches became available on October 21. While initial exploitation attempts were largely unsuccessful, the rapid circulation of proof-of-concept exploits and the sheer volume of vulnerable PHP servers indicate a significant ongoing risk.","PHP2Shell RCE vulnerabilities exploited days before patches were released.","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploitation-started-days-before-patches\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F04\u002FLow-Code-No-Code-Security.jpg","2026-10-22T09:48:58+00:00","2026-10-22T12:00:04.277741+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Amazon","vendor",{"name":24,"type":22},"Cloudflare",{"name":26,"type":22},"JFrog",{"name":28,"type":22},"Hetzner",{"name":30,"type":22},"DigitalOcean","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-109618","Remote code execution vulnerability in PHP.",{"type":51,"value":55,"context":53},"CVE-2026-109619",[21,24,26],{"controls":58,"vendors":145},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":48,"name":118,"problem":119,"products":120},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[146,151],{"slug":147,"name":24,"logo_path":148,"roles":149},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[150],"reported_by",{"slug":152,"name":26,"logo_path":153,"roles":154},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[150],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"php2shell-zero-day-exploited-days-before-patch-release","PHP2Shell Zero-Day Exploited Days Before Patch Release","Threat actors began exploiting critical remote code execution vulnerabilities in PHP servers four days before official patches were available, highlighting the danger of the pre-patch window. The rapid emergence of proof-of-concept exploits and mass exploitation immediately after patch release demonstrates how quickly attackers weaponize newly disclosed vulnerabilities. Organizations relying solely on vendor patch cycles are left exposed during this critical gap period. Proactive compensating controls — such as web application firewalls, virtual patching, and aggressive monitoring — are essential to survive the window between disclosure and remediation.",[160,161,162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":168,"PCI DSS Requirement 6":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"CIS Control 17: Incident Response Management":171,"OWASP A06:2021 Vulnerable and Outdated Components":172,"CIS Control 7: Continuous Vulnerability Management":173,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":174},"NIS2 requires entities to implement incident handling and vulnerability management measures, obligating operators of essential services to have processes that address pre-patch exploitation scenarios.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches within defined timeframes, which would have enforced rapid remediation of the critical PHP RCE vulnerabilities.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, directly addressing the failure to apply mitigations during the critical pre-patch exploitation window.","A mature incident response capability with pre-defined playbooks for critical RCE vulnerabilities would have enabled faster deployment of compensating controls and containment during the pre-patch exploitation period.","PHP2Shell exploitation directly targets vulnerable and unpatched server-side components, which OWASP A06 identifies as one of the most critical and pervasive risks in web application security.","Continuous vulnerability scanning would have flagged unpatched PHP servers as high-risk targets immediately upon CVE disclosure, enabling faster prioritization before mass exploitation began.","This control mandates timely identification and remediation of technical vulnerabilities, including the use of compensating controls when patches are not yet available — exactly the gap exploited here."]