[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVdMr4-V63Nr8z1IqYLWr4VnyhKg_QhBirOm7V2b0hAQ":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8986fd6c-ec46-4dbb-a17e-4c3840ddf0aa","PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws","php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-e286c3","Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek.","Two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS 9.2 scores have been leaked online before official patches scheduled for October 21, 2026. The flaws, collectively named PHP2Shell, could enable unauthenticated remote code execution on affected PHP versions 5 and later. Security firms WatchTowr and Huntress have confirmed the vulnerabilities are real, while Sansec predicts mass exploitation will commence within 15 minutes of patch release.","Critical PHP vulnerabilities CVE-2026-109618\u002F109619 leaked ahead of coordinated disclosure, enabling unauthenticated","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-mass-exploitation-looms-for-leaked-critical-php-flaws\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002FPHP.jpeg","2026-10-21T07:02:06+00:00","2026-10-21T08:00:04.760961+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"PHP2Shell","campaign",{"name":24,"type":25},"WatchTowr","vendor",{"name":27,"type":25},"Huntress",{"name":29,"type":25},"Sansec","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"cve","CVE-2026-109618","Critical PHP vulnerability, reported as use-after-free flaw, enables unauthenticated RCE",{"type":48,"value":52,"context":53},"CVE-2026-109619","Critical PHP vulnerability with CVSS 9.2, enables unauthenticated RCE",[24,27,29],{"controls":56,"vendors":139},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,106],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":87,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":45,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":135,"product_name":136,"url":137,"description":138},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[140,145],{"slug":141,"name":27,"logo_path":142,"roles":143},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[144],"reported_by",{"slug":146,"name":147,"logo_path":148,"roles":149},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png",[144],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"php2shell-pre-patch-leak-triggers-mass-exploitation-race","PHP2Shell: Pre-Patch Leak Triggers Mass Exploitation Race","Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were leaked publicly before official patches were available, creating a dangerous window where attackers can exploit unauthenticated remote code execution across PHP 5 and later versions. The premature disclosure eliminates the usual buffer organizations have between patch release and active exploitation, compressing response time to near-zero. With security researchers predicting mass exploitation within 15 minutes of patch release, organizations without mature vulnerability management programs and rapid patching capabilities face near-certain compromise. This incident underscores the critical importance of proactive vulnerability tracking, pre-patch mitigations, and rehearsed emergency response procedures.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 17: Incident Response Management":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"NIS2 mandates that essential and important entities maintain incident handling capabilities and apply security measures proportionate to risk, requiring operators of PHP-based services to have rapid response plans for exactly this kind of mass-exploitation event.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; a mature flaw remediation process with emergency patch procedures is precisely what is needed to respond to a pre-patch disclosure scenario.","With exploitation predicted within 15 minutes of patch release, only organizations with a pre-defined, rehearsed incident response plan can contain and recover from compromise before it spreads laterally across their environment.","The PHP2Shell vulnerabilities affect PHP 5 and later, including end-of-life versions; OWASP A06 specifically calls out the risk of using vulnerable or outdated components and the need for continuous monitoring and patching of dependencies.","Regular, continuous vulnerability scanning would have ensured affected PHP versions were identified across the environment before exploitation began, enabling prioritized emergency remediation ahead of the patch release window.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly addressing the need for pre-patch mitigations and rapid response when a critical PHP vulnerability is publicly leaked.","The vulnerabilities enable unauthenticated remote code execution, meaning the absence of authentication controls on PHP endpoints amplifies risk; enforcing access controls on web-facing PHP services would reduce the attack surface."]