[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:php2shell-critical-pre-auth-rce-in-php-core-under-broad":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"php2shell-critical-pre-auth-rce-in-php-core-under-broad","rapid-alert","PHP2Shell: Critical Pre-Auth RCE in PHP Core Under Broad Exploitation, Patch Now","Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), allow unauthenticated remote code execution. Exploitation began four days before the 21 Oct patches. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fphp2shell-critical-pre-auth-rce-in-php-core-under-broad-f10ea3b4-cover.png","PHP2Shell rapid alert: Running PHP on the internet? One crafted request and code runs.","Marcus Lenngren","2026-10-23T12:58:01.88+00:00","![PHP2Shell rapid alert: Running PHP on the internet? One crafted request and code runs.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fphp2shell-critical-pre-auth-rce-in-php-core-under-broad-f10ea3b4-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nTwo critical vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, allow unauthenticated remote code execution through specially crafted HTTP requests. Both are rated 9.2 on CVSS. They were found by researchers from Calif, OpenAI and Google-owned Wiz.\n\nThe flaws sit in PHP's memory management and error handling, parts of the runtime that nearly every request touches. The PHP Foundation says this is what made them serious and hard to fix without breaking compatibility. Because the issues can be triggered before application security checks run, every reachable PHP endpoint is at risk: static forms, login routes and health checks included. The exposure is independent of the CMS, framework or plug-ins in use.\n\nPatches shipped on 21 Oct in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release was pulled forward by a day after the CVE IDs and mitigation advice leaked online on 20 Oct, and after Chainguard published built images containing the fix ahead of embargo.\n\n## Timeline\n\n- 17 Oct: Amazon's MadPot honeypot records the first exploit attempt, from a commercial anonymisation IP, while the flaws are under embargo.\n- 20 Oct: CVE IDs and details leak online. PHP Foundation moves the release forward.\n- 21 Oct about 02:00 UTC: Amazon flags the earliest PoC attempt, with more over the next six hours.\n- 21 Oct about 08:36 UTC: ELLIO sees its first request, shortly after Chainguard published fixed images.\n- 21 Oct: Patches released. Cloudflare counts thousands of attempts before announcement, rising to millions.\n- 23 Oct: Sophos, Arctic Wolf and others report attempts to drop a Mirai variant called Potassium.\n\n## Am I affected?\n\nYou are affected if you run any PHP release in the 7.x or 8.x series that is not patched. According to VulnCheck, VirusTotal and Censys, more than 1 million PHP servers were unpatched as of 21 Oct, and VulnCheck saw over 2.6 million internet-facing PHP hosts, nearly all vulnerable. More than 700,000 run PHP 3.x to 7.3 and nearly 400,000 run 7.4, 8.0 or 8.1, all end of life with no upstream fix.\n\nPHP powers a large share of the web, including WordPress, Drupal, Joomla and Magento, so forgotten and shadow installations are a real risk.\n\n## What to do now\n\n1. Update to a fixed version immediately: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CISA and the UK NCSC both urge this now.\n2. If you cannot patch at once, take the server offline or put it behind a WAF rule, as NCSC advises.\n3. Restrict what a web-facing PHP process can launch, access or connect to. ThreatLocker notes this is a backstop, not a substitute for patching.\n4. If you run an end-of-life branch with no fix, plan migration or removal now, and isolate the host.\n5. Inventory every PHP installation you own, including those bundled in OS distributions and historic systems.\n\n## How to hunt\n\n- Watch for PHP processes unexpectedly launching command shells or downloading files, as the FBI advises.\n- Note that successful attacks leave almost no trace. CrowdStrike says worker processes stay stable, responses return HTTP 200, and application logs record nothing, because no application code runs. The one server-side clue is a single memory-limit fatal in the web server error log, often dismissed as noise.\n- Check for connections to the Mirai Potassium infrastructure reported by Sophos: 134.199.154[.]64 (C2, TCP 50792), the loader at 92.118.112[.]100, and sources 85.11.167[.]243, 217.60.242[.]76 and 45.198.224[.]169.\n- Block or alert on the C2 domain thunder.godofthunder[.]st.\n\n## What does not help\n\nDo not assume you are safe because current PoCs fail. WatchTowr and Sophos report that circulating exploits mostly do not work, crash the target or only test timing. But SOCRadar found a 'one-click' exploit for PHP 8.4.26 under Apache mod_php, and work on defeating ASLR is progressing. Reliable exploitation is a matter of time. Do not rely on PoC failure, patch.\n\n## Sources\n\n- [PHP2Shell Exploitation Started Days Before Patches](https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploitation-started-days-before-patches\u002F), SecurityWeek, 22 Oct\n- [Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fsomeone-tried-to-exploit-php2shell-4.html), The Hacker News, 22 Oct\n- [Amazon says PHP2Shell exploitation began 4 days before patches](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Famazon-says-php2shell-exploitation-began-4-days-before-patches\u002F), BleepingComputer, 22 Oct\n- [PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fphp2shell-exploit-attempts-hit-millions.html), The Hacker News, 23 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,45],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",{"slug":37,"kind":38,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":44},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":46,"kind":6,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":18},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00"]