[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYm-YEZwKhvc4DolsU0dn8NcsV83RXoeA2vPArVhwNYQ":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3c00a0b7-488c-4815-bdb9-47b4a0e9a483","Tech and Security Companies Respond to PHP2Shell Vulnerabilities","tech-and-security-companies-respond-to-php2shell-vulnerabilities-76f735","Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.","Two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed, enabling unauthenticated remote code execution. PHP released patches on October 21st, but exploitation attempts were detected as early as October 17th. Numerous tech vendors, including Cisco, AWS, and Google Cloud, are actively checking and updating their products, while security firms are shipping detections and mitigations.","PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow remote code execution; patches released.","https:\u002F\u002Fwww.securityweek.com\u002Ftech-and-security-companies-respond-to-php2shell-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F05\u002Ffirewall.jpeg","2026-10-22T12:20:23+00:00","2026-10-22T14:00:05.686037+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":22},"AWS",{"name":26,"type":22},"Google Cloud",{"name":28,"type":22},"Palo Alto Networks",{"name":30,"type":22},"Fortinet","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-109618","PHP2Shell vulnerability allowing remote code execution",{"type":51,"value":55,"context":53},"CVE-2026-109619",[21,24,28],{"controls":58,"vendors":145},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":48,"name":118,"problem":119,"products":120},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[146,151,156],{"slug":147,"name":21,"logo_path":148,"roles":149},"cisco","\u002Fvendor-logos\u002Fcisco.png",[150],"reported_by",{"slug":152,"name":153,"logo_path":154,"roles":155},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[150],{"slug":157,"name":158,"logo_path":159,"roles":160},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[161],"affected",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"php2shell-zero-day-exploited-before-patch-release-highlights-patch-urgency","PHP2Shell Zero-Day Exploited Before Patch Release Highlights Patch Urgency","Two critical unauthenticated remote code execution vulnerabilities in PHP2Shell were actively exploited at least four days before the official patch was released, demonstrating the danger of zero-day and near-zero-day exploitation windows. Organizations relying solely on vendor patch cycles without compensating controls were left exposed during this critical gap period. The broad impact across major cloud and networking vendors underscores how widely embedded third-party components can amplify a single vulnerability's blast radius. Rapid, coordinated patch deployment and real-time threat detection are essential to surviving situations where defenders must act faster than attackers.",[167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":175,"PCI DSS Requirement 6":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"OWASP A06:2021 Vulnerable and Outdated Components":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including rapid response to actively exploited critical vulnerabilities like these RCE flaws.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching and security updates, which would have driven faster remediation of these critical PHP2Shell flaws.","SI-2 requires organizations to identify, report, and correct software flaws within defined timeframes, which directly addresses the need for rapid response once CVE-2026-109618 and CVE-2026-109619 were disclosed.","PHP2Shell is a third-party component; A06 specifically warns against using components with known vulnerabilities and calls for continuous monitoring of component versions and associated CVEs.","Exploitation began four days before the patch was released; continuous vulnerability scanning and a defined patching cadence would have ensured the fix was applied at the earliest possible moment and compensating controls were in place during the gap.","This control mandates timely identification and remediation of technical vulnerabilities, including tracking vendor advisories — precisely the process that would have narrowed the exploitation window in this incident.","The vulnerabilities enabled unauthenticated remote code execution, meaning enforcing strong authentication controls around affected services would have directly blocked the primary attack vector."]