[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1Y0_ewDqr-gJzdVrE_oCEEYrZXnNYly-AhFMcf3Yt4U":3},{"article":4,"iocs":44,"watch_terms":53,"solutions":54,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"321515c0-eea7-461b-95c5-3d093a32b7aa","PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet","php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet-5534c9","PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives […]","Millions of attacks have been detected targeting two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. While no successful exploitation has been confirmed in the wild, exploit development is advancing, with researchers creating a bypass for ASLR. Attackers are observed scanning for vulnerable systems and attempting to deliver malware, including a Mirai variant.","Millions of PHP2Shell attacks observed targeting critical CVEs, with exploit development ongoing.","https:\u002F\u002Fsecurityaffairs.com\u002F201538\u002Fhacking\u002Fphp2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fimage-56.png","2026-10-23T10:52:00+00:00","2026-10-23T15:09:05.72288+00:00",9,[17,20,23],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Potassium","threat_actor",{"name":24,"type":25},"Mirai","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,51],{"type":46,"value":47,"context":48},"cve","CVE-2026-109618","Critical vulnerability in PHP affecting web requests.",{"type":46,"value":50,"context":48},"CVE-2026-109619",{"type":38,"value":21,"context":52},"Mirai variant observed in PHP2Shell traffic.",[18],{"controls":55,"vendors":138},[56,85,110],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":86,"product_name":107,"url":108,"description":109},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":43,"name":111,"problem":112,"products":113},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[139,145],{"slug":140,"name":141,"logo_path":142,"roles":143},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[144],"reported_by",{"slug":146,"name":147,"logo_path":148,"roles":149},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[144],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"mass-exploitation-attempts-target-critical-php-rce-vulnerabilities","Mass Exploitation Attempts Target Critical PHP RCE Vulnerabilities","Two critical unauthenticated remote code execution vulnerabilities in PHP are being actively scanned and attacked by millions of attempts, with researchers already developing ASLR bypasses that could pave the way for confirmed exploitation. The fact that no successful exploitation has been confirmed yet represents a narrow window of opportunity for defenders to patch before attackers refine their techniques. Organizations running vulnerable PHP installations on internet-facing servers face severe risk, as unauthenticated RCE can lead to full system compromise, data theft, and inclusion in botnets like Mirai. This incident underscores that active scanning and exploit development often precede mass exploitation by only days or weeks, making rapid patch deployment critical.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":163,"PCI DSS Requirement 6":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"NIS2 mandates that essential and important entities handle incidents and implement vulnerability management practices; the mass scanning activity constitutes an incident trigger requiring detection, response, and timely patching under this obligation.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches promptly, which would directly address the unpatched PHP RCE flaws being mass-exploited here.","SI-2 requires organizations to identify, report, and correct software flaws within organizationally defined time periods — directly mandating the rapid patching needed to close these critical RCE vulnerabilities before successful exploitation occurs.","The attack directly exploits vulnerable PHP components that have known patches; OWASP A06 specifically calls for inventorying and promptly updating software components to eliminate this class of risk.","Millions of attack attempts were launched against known, patchable PHP vulnerabilities; continuous scanning and a defined remediation timeline would have identified and closed the exposure before exploit development matured.","This control requires timely identification and remediation of technical vulnerabilities in software; had it been followed rigorously, affected PHP versions would have been patched promptly upon disclosure.","The vulnerabilities allow unauthenticated remote code execution, meaning the absence of any authentication barrier amplifies the impact; this framework area reinforces the need to enforce access controls that limit exposure of critical functionality to unauthenticated users."]