[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffS70rzzDxNQkAOgMe6aaFyucgyPhVjaWoGL0wE421eY":3},{"article":4,"iocs":43,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4554ef09-5610-44cf-9368-f22768bbe54a","PHP2Shell security flaws now sucessfully exploited in the wild","php2shell-security-flaws-now-sucessfully-exploited-in-the-wild-7c54e7","Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]","Two critical RCE vulnerabilities, collectively tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been confirmed to be exploited in the wild against Apache mod_php installations running PHP 8.4.26. While initial exploitation attempts were limited to scanning and non-working exploits, recent activity shows successful remote code execution with memory disclosure. The PHP security team has released patches for these flaws.","Two critical RCE vulnerabilities in PHP2Shell are now being exploited in the wild.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphp2shell-security-flaws-now-sucessfully-exploited-in-the-wild\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F26\u002FPHP-headpic.jpg","2026-10-26T09:19:57+00:00","2026-10-26T10:00:14.43682+00:00",9,[17,20,22],{"name":18,"type":19},"Apache mod_php","product",{"name":21,"type":19},"PHP 8.4.26",{"name":23,"type":24},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50],{"type":45,"value":46,"context":47},"cve","CVE-2026-109618","PHP2Shell critical RCE vulnerability",{"type":45,"value":49,"context":47},"CVE-2026-109619",{"type":45,"value":51,"context":52},"CVE-2026-115560","New RCE vulnerability in PHP with no patch",[18,21],{"controls":55,"vendors":141},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":86,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":42,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"php2shell-rce-exploits-confirm-risk-of-delayed-patching-on-apachephp-stacks","PHP2Shell RCE Exploits Confirm Risk of Delayed Patching on Apache\u002FPHP Stacks","Two critical remote code execution vulnerabilities in PHP 8.4.26 (CVE-2026-109618 and CVE-2026-109619) have moved from theoretical risk to confirmed in-the-wild exploitation, including memory disclosure, despite patches being available from the PHP security team. The root cause is straightforward: organisations running Apache mod_php installations failed to apply available security fixes before threat actors weaponised working exploits. This pattern — where initial scanning activity escalates to successful exploitation — is a well-documented threat actor playbook that relies on defender inertia. The fact that patches existed at the time of confirmed exploitation means every affected organisation that was breached could have avoided the incident entirely through timely patch deployment. This matters because RCE with memory disclosure can cascade into credential theft, lateral movement, and full infrastructure compromise.",[147,148,149,150,151,152,153],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":155,"PCI DSS Requirement 6":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"OWASP A06:2021 Vulnerable and Outdated Components":158,"CIS Control 7: Continuous Vulnerability Management":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 mandates that essential and important entities implement vulnerability handling and disclosure policies; organisations subject to NIS2 that failed to patch these known CVEs may face regulatory scrutiny following confirmed exploitation.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through timely patching; any cardholder-data-adjacent Apache\u002FPHP server left unpatched against PHP2Shell would constitute a direct compliance failure.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; adherence to this control would have mandated urgent patching of these critical RCE vulnerabilities upon disclosure.","PHP2Shell directly exploits a vulnerable, unpatched version of a widely deployed component (PHP on Apache), which is precisely the risk scenario A06:2021 addresses by requiring organisations to track and remediate vulnerable dependencies.","A continuous vulnerability management programme with defined remediation timelines would have ensured the available PHP patches were applied before threat actors successfully exploited the CVEs in the wild.","This control explicitly requires timely identification of technical vulnerabilities in information systems and the taking of appropriate measures to address them, which would have driven remediation before exploitation was confirmed.","Successful RCE with memory disclosure can expose credentials and session tokens in memory; enforcing least-privilege process accounts and memory protections on web servers would have limited the blast radius of exploitation even if initial access was achieved."]