{"id":"CVE-2026-109618","kind":"vulnerability","aliases":["CVE-2026-109618"],"related":[],"title":"PHP: out-of-memory handling flaw lets a web request run code","description":"Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI\n\nOctober 21, 2026\n\n# Patch the Planet: global response coordination as agents uncover critical vulnerabilities\n\nOver the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet⁠(opens in a new window) initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.\n\nFor organizations using PHP, the priority now is applying the fixes. We’re sharing a PHP version checker as a Codex skill⁠(opens in a new window) to help operators identify potentially vulnerable PHP versions and, alongside PHP’s and their providers’ guidance, determine which updates apply.\n\nGiven the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.\n\nTo our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.\n\nTo help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services.\n\nAs significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months. Drawing on our experience thus far, we’re sharing a proposed approach, appropriate for the AI era, to responding to critical vulnerabilities in widely used software, and we’re asking the security community to help improve this framework. It brings together our models, security expertise, and maintainers to help turn findings into protection and build a response that can scale as AI capabilities advance.\n\n## Coordinating a global response\n\nGetting a fix into use can mean adapting it for older releases, preparing provider mitigations, and updating systems across many organizations. A repeatable process helps those teams act quickly as more vulnerabilities are discovered.\n\nThrough Patch the Planet, we contributed security expertise and model access to support the PHP response, and worked with maintainers and research partners to test fixes and prepare guidance. We also helped coordinate with infrastructure providers on protections for affected systems and engaged government cyber agencies to help guidance reach critical organizations. This supported the maintainer-led response and helped other defenders prepare.\n\nFor some findings, researchers can work directly with the software’s maintainers to investigate the issue and develop a fix. Others need a wider response because they affect many products or because distributors and service providers need time (which may be in short supply if frontier capabilities are not too far ahead of those that are broadly available) to prepare updates and protections. In those cases, the proposed framework can help maintainers identify who needs to be involved and coordinate the work. The response can involve five stages:\n\n- Validate and fix the upstream vulnerability. The maintainer, researchers, and essential technical partners confirm the finding, assess its impact, and develop and test a fix. This process includes adversarial testing with frontier models to look for ways around the patch and related variants of the vulnerability. \n- Give affected organizations time to act. We propose a framework for considering which organizations need advance information to prepare protections, while maintainers decide whom to involve. We help with outreach, information-sharing agreements, and coordination between teams. A distributor might adapt a fix for an older release, a hosting provider might test a mitigation, and a security provider might prepare detection or prevention measures, including web application firewall (WAF) rules. \n- Coordinate with government partners to help protect critical systems. Government agencies play an essential role in coordinating a wider response and helping security guidance reach organizations responsible for critical infrastructure and other essential services. In the case of PHP, we worked, in collaboration with our partners, to engage with multiple parts of the U.S. government, including the White House’s Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners to support that effort.\n- Prepare updates across affected products. As the fix, guidance, and disclosure plans become stable, maintainers can involve additional distributors, hosting and service providers, response teams, and operators to prepare updates and address gaps in coverage.\n- Once a patch is available, publish guidance and support deployment. Public guidance helps people assess their exposure, find authoritative updates or interim mitigations, and check that a fix is running. The response continues as operators deploy updates and report where they need help.\n\nThe proposed framework considers an organization’s protective role, including protecting its own systems and customers, the time needed to act, and its ability to handle sensitive information. The same criteria would apply to comparable organizations, with maintainers deciding whom to involve ahead of disclosure.\n\nEach participant receives the information needed to carry out their protective work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits. Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.\n\nTeams following this framework would work with maintainers to give defenders time to prepare and reassess the timeline if there’s active exploitation in the wild, a leak, a revealing public patch, or increased risk to users from stalled remediation.\n\nThe Patch the Planet website⁠(opens in a new window) brings together public disclosures and guidance to help operators identify affected systems, find the right update, and verify that the updated software is running properly. For PHP, it points to the maintainers’ official patch and upgrade instructions and our partners’ technical research. The guidance also covers interim mitigations, when to involve a provider or expert, and backup and recovery. Interim protections can reduce risk, but we’ll make their limits and operational tradeoffs clear. \n\nOperators can use CISA’s guidance on prioritization and remediation⁠(opens in a new window) to assess how quickly to act based on exposure, exploitation, and potential impact. That may mean emergency patching, immediate mitigation, or a planned update, alongside forensic triage where warranted to assess whether systems have already been compromised. Priorities should be reassessed as conditions change, with a clear path to lasting remediation. \n\n## Giving maintainers the capacity and resources to respond\n\nGlobal coordination depends on the people who maintain the software. Many projects are run by small teams that review security reports alongside routine development. Those teams need help separating new issues from duplicates, assessing impact, and testing fixes across supported releases. We support that work with funding, access to capable models, and hands-on engineering help.\n\nPowerful AI capabilities are advancing across the industry, and we expect AI to play a growing role in helping defenders find vulnerabilities, monitor systems, and respond to threats. We’re investing in models, tools, and partnerships to help defenders put those capabilities to work.\n\nOur investments include subscriptions for all maintainers through Codex for OSS and direct sponsorship of projects such as the Rust Foundation⁠(opens in a new window) for maintainers and technical work. Each project sets its own priorities. Reusable tests and security workflows can reduce the effort needed to handle future findings. Open-source projects can apply to Patch the Planet⁠(opens in a new window) for hands-on support.\n\nWe’re also calibrating additional blocking classifiers for Daybreak to help reduce the potential for misuse. This involves difficult tradeoffs: safeguards intended to prevent abuse can also block legitimate security work. Broad access to capable models and effective protections against misuse are both critical. Our aim is to preserve the capabilities defenders need to find and fix vulnerabilities while limiting harmful use. We’ll continue refining that balance as capabilities advance and we learn from how these tools are used.\n\n## Building more secure software foundations\n\nAs models become more capable, the opportunity extends beyond finding and fixing individual vulnerabilities. We want to help engineers build more secure software from the start. Improvements to a widely used component can prevent bugs or limit their impact across many products and services.\n\nAI can help engineers understand existing code, prepare changes, and develop tests, while maintainers and security experts verify that those changes preserve the behavior users depend on. We see opportunities in several areas:\n\n- Secure code from the start. Coding models can help developers choose safer defaults, use security libraries correctly, and catch risky patterns as they write. Preventing vulnerabilities during development means fewer emergency fixes for maintainers and users.\n- Memory-safe software. Moving critical components to memory-safe languages can eliminate common classes of memory errors. AI can help with migrations, with tests and expert review to check behavior and compatibility.\n- Formal verification. Mathematical proofs can show that critical components satisfy specified security properties under stated assumptions. Applying these methods to widely used components could help rule out classes of vulnerabilities across the services and critical infrastructure that depend on them.\n- Stronger isolation. Systems need protection against vulnerabilities that have not yet been found or fixed. Running software that processes untrusted files, images, or media in tightly restricted sandboxes can limit the damage if it is compromised. AI can help engineers test and strengthen widely used sandboxing technologies, improving protections across many applications.\n\n## Help us improve this approach\n\nWe’re sharing our approach so maintainers, researchers, response teams, providers, and operators can help make it workable. We want to understand where it would help, where it could add delay or burden, and what we’ve missed. Examples from past disclosures would be especially useful.\n\nWe’re particularly interested in: \n\n- Disclosure windows. How much time do maintainers, operators, and defenders need to prepare and deploy reliable fixes? What evidence should trigger earlier disclosure, especially when some users can be protected sooner than others?\n- Emergency patching. When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access? What safeguards should apply? We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or pa","summary":"PHP mishandles out-of-memory conditions during a web request, which lets an attacker's request run code on the server. Public proof-of-concept code exists and the sources report active exploitation.","severity":"critical","cvss":9.8,"epss":0.1162,"exploited":true,"exploited_at":null,"products":[{"name":"php","fixed":["8.2.35"],"affected":">= 7.3.0, < 8.2.35","ecosystem":"vendor"},{"name":"php","fixed":["8.3.36"],"affected":">= 8.3.0, < 8.3.36","ecosystem":"vendor"},{"name":"php","fixed":["8.4.27"],"affected":">= 8.4.0, < 8.4.27","ecosystem":"vendor"},{"name":"php","fixed":["8.5.12"],"affected":">= 8.5.0, < 8.5.12","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.2.7"],"affected":">= 10.2.0, < 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.10","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.11","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.13","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.15","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.16","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.17","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.18","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.1.4"],"affected":">= 11.1.0, < 11.1.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.10","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.11","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.13","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.15","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.16","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.2.4"],"affected":">= 11.2.0, < 11.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.10","ecosystem":"vendor"},{"name":"php","fixed":["8.2.35"],"affected":">= 8.2.0, < 8.2.35","ecosystem":"vendor"},{"name":"pan-os","fixed":["12.2.4-h1","12.1.4-h13","12.1.7-h11","12.1.10-h3","11.2.4-h23","11.2.7-h23","11.2.10-h16","11.2.13-h4","11.2.16-h1","11.1.4-h38","11.1.6-h40","11.1.7-h12","11.1.10-h36","11.1.13-h16","11.1.16-h4","10.2.7-h39","10.2.10-h42","10.2.13-h27","10.2.16-h12","10.2.18-h13"],"affected":"12.2 < 12.2.4-h1; 12.1 < 12.1.4-h13, 12.1.7-h11, 12.1.10-h3; 11.2 < 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1 < 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2 < 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["web-servers","php-fpm","cloudflare","akamai","self-hosted","frankenphp","runtime","openai","aws","poc-public","mod_php","lab-disclosure","apache","php"],"not_affected_if":["patched-php-version"],"how_to_check":"- Run `php -v` on each host and compare the version with the fixed versions in the Fix field.\n- Check the PHP version your web server actually loads (PHP-FPM, mod_php, FrankenPHP), since it can differ from the CLI binary.\n- The sources do not say whether CLI-only use is exposed.","fix":"- PHP 8.2 branch: upgrade to `8.2.35`.\n- PHP 8.3 branch: upgrade to `8.3.36`.\n- PHP 8.4 branch: upgrade to `8.4.27`.\n- PHP 8.5 branch: upgrade to `8.5.12`.\n- Until patched, WAF managed rules have shipped from Cloudflare (emergency release 2026-10-22) and AWS; see their changelogs. These are interim mitigations, not fixes.","status":"resolved","published_at":"2026-10-21T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-24T17:49:42+00:00","updated_at":"2026-10-25T12:41:34+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-24T17:49:42Z","model":"claude-haiku-5-5","output":{"fix":"- PHP 8.2 branch: upgrade to `8.2.35`.\n- PHP 8.3 branch: upgrade to `8.3.36`.\n- PHP 8.4 branch: upgrade to `8.4.27`.\n- PHP 8.5 branch: upgrade to `8.5.12`.\n- Until patched, WAF managed rules have shipped from Cloudflare (emergency release 2026-10-22) and AWS; see their changelogs. These are interim mitigations, not fixes.","reach":"internet","title":"PHP: out-of-memory handling flaw lets a web request run code","impact":"high","summary":"PHP mishandles out-of-memory conditions during a web request, which lets an attacker's request run code on the server. Public proof-of-concept code exists and the sources report active exploitation.","category":"runtime","nicknames":["php2shell"],"who_cares":["php","php-fpm","mod_php","frankenphp","self-hosted","web-servers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the web server through a single request.","analyst_note":"Confirm the affected and fixed versions for Siemens RUGGEDCOM APE1808 and PAN-OS 10.2.x, and whether CLI-only PHP is exposed; see https://nvd.nist.gov/vuln/detail/CVE-2026-109618 and https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities.","how_to_check":"- Run `php -v` on each host and compare the version with the fixed versions in the Fix field.\n- Check the PHP version your web server actually loads (PHP-FPM, mod_php, FrankenPHP), since it can differ from the CLI binary.\n- The sources do not say whether CLI-only use is exposed.","needs_analyst":true,"not_affected_if":["patched-php-version"],"who_is_affected":"Any PHP install in the affected ranges that serves web requests is exposed, from PHP 7.3.0 up to the fixed release for each branch. The sources also list Siemens RUGGEDCOM APE1808 firmware and several PAN-OS 10.2.x releases as affected, but give no version details for them. Installs already on a fixed PHP release can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001956,"input_tokens":8186,"output_tokens":2275,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD entry and no affected PHP versions or patched releases; check the NVD page and PHP's security advisories for the fixed version and whether the flaw needs a specific SAPI or setting.","search":"'-109618':16A,19A '-2026':15A,18A '1':492C '2026':248C '21':247C '5.6':301C 'access':497C,658C 'across':632C 'act':641C 'activ':232B 'adapt':621C 'address':276C 'advanc':609C 'adversari':828C 'affect':687C,739C 'agenc':693C 'agent':241C,256C 'ahead':352C,479C,763C 'ai':429C,457C,561C,607C 'akamai':181B 'alongsid':391C 'alreadi':527C 'also':318C,444C,678C 'among':521C 'apach':197B 'ape1808':28A 'appli':363C,401C 'applic':293C 'approach':557C 'appropri':558C 'ask':575C 'assess':816C 'attack':213B,446C,462C 'avail':769C 'aw':188B 'billion':493C 'bring':585C 'broad':768C 'bug':519C 'build':600C 'calif':294C 'capabl':442C,488C,608C,758C 'case':777C 'checker':372C 'cloudflar':180B,340C 'coalit':268C 'code':13A,217B,226B 'codex':375C 'come':544C 'commit':491C 'communiti':578C 'concept':225B 'condit':205B 'confirm':813C 'consid':414C 'contribut':343C,653C 'coordin':239C,254C,348C,610C,680C,791C 'critic':243C,258C,277C,297C,566C,698C 'cve':14A,17A 'cyber':692C 'daybreak':496C,499C 'defend':466C,485C,502C,710C 'determin':398C 'develop':448C,729C,820C 'direct':718C 'disclosur':196B,354C,481C 'discov':320C,647C 'distributor':744C 'draw':546C 'engag':690C 'era':562C 'essenti':511C,810C 'exist':227B 'expect':536C 'experi':549C 'expertis':590C,655C 'exploit':233B,452C 'far':551C,762C 'find':538C,596C,714C,815C 'firmware':29A 'five':798C 'fix':330C,365C,476C,533C,616C,673C,731C,802C,824C 'flaw':7A,298C,407C,433C 'focus':503C 'found':458C,528C 'fpm':179B 'framework':583C,780C 'frankenphp':185B 'frontier':456C,757C,831C 'frontlin':501C 'get':614C 'given':402C 'global':237C,252C,612C 'govern':691C 'gpt':300C 'guidanc':397C,676C,696C 'handl':6A 'help':383C,445C,483C,580C,594C,638C,679C,695C,708C,782C 'highlight':427C 'host':184B 'identifi':295C,385C,784C 'impact':420C,438C,818C 'improv':581C 'includ':827C 'increas':540C 'independ':319C 'infrastructur':682C 'initi':315C 'internet':436C 'internet-scal':435C 'investig':725C 'involv':789C,797C 'issu':422C,727C 'knowledg':455C 'lab':195B 'lab-disclosur':194B 'languag':286C 'led':266C,328C,705C 'let':8A,211B 'like':338C 'limit':507C 'maintain':270C,327C,470C,592C,667C,704C,723C,783C,807C 'maintainer-l':703C 'mani':633C,740C 'may':751C 'mean':620C 'memori':5A,204B,425C 'mishandl':200B 'mitig':628C 'mod':192B 'model':588C,657C,832C 'month':264C,545C 'need':733C,748C,786C 'new':313C,380C 'octob':246C 'offens':449C 'older':624C 'one':416C 'open':283C,310C,377C,464C 'open-sourc':282C 'openai':187B,245C 'oper':384C 'organ':356C,505C,634C,699C 'os':33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,89A,93A,97A,101A,105A,109A,113A,117A,121A,125A,129A,133A,137A,141A,145A,149A,153A,157A,161A,165A,169A,173A 'other':342C,732C 'out-of-memori':2A,201B 'paloaltonetworks':30A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,90A,94A,98A,102A,106A,110A,114A,118A,122A,126A,130A,134A,138A,142A,146A,150A,154A,158A,162A,166A 'pan':32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,92A,96A,100A,104A,108A,112A,116A,120A,124A,128A,132A,136A,140A,144A,148A,152A,156A,160A,164A,168A,172A 'pan-os':31A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A,95A,99A,103A,107A,111A,115A,119A,123A,127A,131A,135A,139A,143A,147A,151A,155A,159A,163A,167A,171A 'part':304C 'partner':337C,670C,812C 'past':262C 'patch':234C,249C,307C,649C 'php':1A,22A,23A,24A,25A,170A,178B,193B,198B,199B,280C,325C,358C,370C,388C,392C,409C,662C 'php-fpm':177B 'php2shell':20A,21A 'planet':236C,251C,651C 'planet⁠':309C 'poc':190B 'poc-publ':189B 'potenti':386C 'prepar':350C,475C,626C,675C,711C,771C 'prioriti':360C 'process':637C,826C 'product':741C 'program':285C 'proof':223B 'proof-of-concept':222B 'propos':556C,779C 'protect':351C,478C,510C,598C,685C,774C 'provid':274C,396C,473C,627C,683C,747C 'public':191B,221B 'quick':642C 'rapid':447C 're':367C,553C,574C 'reach':697C 'recent':424C 'releas':332C,625C 'repeat':636C 'report':231B,322C 'request':11A,209B,215B 'research':271C,344C,669C,715C,808C 'resourc':509C 'respond':564C 'respons':238C,253C,602C,613C,663C,706C,736C,795C 'ruggedcom':27A 'run':12A,216B,289C 'runtim':186B 'scale':437C,605C 'secur':273C,421C,432C,472C,508C,577C,589C,654C 'self':183B 'self-host':182B 'server':176B,220B 'servic':512C,746C 'sever':404C,522C 'share':368C,554C 'sharpli':541C 'short':754C 'siemens':26A 'signific':514C,523C 'similar':537C 'skill⁠':376C 'softwar':571C,721C 'sol':302C 'sourc':230B,284C 'stage':799C 'subsid':495C 'suppli':755C 'support':346C,660C,701C 'system':631C,688C 'team':335C,640C 'technic':345C,811C 'test':672C,822C,829C 'thus':550C 'time':749C 'togeth':586C 'tool':450C 'turn':595C 'two':263C 'uncov':242C,257C,431C 'updat':400C,630C,772C 'upstream':804C 'use':287C,299C,357C,412C,486C,570C,618C 'valid':800C 've':490C,526C 'version':371C,389C 'vulner':244C,259C,278C,324C,387C,460C,524C,567C,645C,805C 'web':10A,175B,208B,292C 'web-serv':174B 'websit':290C 'wide':569C 'wider':735C 'widespread':411C 'window':314C,381C,468C 'wiz':317C,339C 'work':531C,665C,717C,793C","nicknames":["PHP2Shell","php2shell"],"mitigations":[{"kind":"platform-fix","scope":null,"since":null,"covers":"AWS Elastic Beanstalk PHP platforms 8.2 through 8.5 with the upstream PHP fix","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","confidence":0.9,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"Enable Managed Platform Updates, or manually update the environment platform version"},{"kind":"platform-fix","scope":"Amazon Linux PHP packages","since":null,"covers":"Updated PHP packages available in all regions for Amazon Linux","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","confidence":0.8,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"Apply the updated PHP packages as soon as available"},{"kind":"platform-fix","scope":"Amazon Lightsail PHP blueprints","since":null,"covers":"Updated Lightsail blueprints available in all regions","limits":"AWS cannot update running Lightsail instances in place","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","confidence":0.85,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"Create new instances from the updated blueprints and migrate applications"},{"kind":"platform-fix","scope":"Amazon WorkMail","since":null,"covers":"AWS-operated WorkMail service upgraded to PHP 8.3.36 with configuration-level controls applied","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","confidence":0.7,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"No customer action required"},{"kind":"workaround","scope":"Amazon EMR on EC2 clusters with Ganglia in the application set (releases 4.2.0–6.15.0)","since":null,"covers":"New EMR on EC2 clusters launched without Ganglia","limits":"Existing clusters with Ganglia remain affected; EMR 7.0.0+ and clusters without Ganglia are not affected","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"Team","seen_at":"2026-10-24T19:12:56Z","confidence":0.8,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"Omit Ganglia when launching new clusters when not required; upgrade to EMR 7.x where possible"},{"kind":"waf-rule","scope":"AWS WAF Core rule set (CRS) managed rule group","since":"2026-10-21","covers":"Request bodies over 8 KB (8,192 bytes) via the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group, as interim protection for CVE-2026-109618.","limits":"Only blocks request bodies over 8 KB; superseded by PHP2Shell_BODY_Extended for direct detection.","source":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","sources":["https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html"],"confidence":0.9,"source_title":"AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director","customer_action":"none stated"},{"kind":"waf-rule","scope":"Requests proxied through Akamai App & API Protector and HTTP requests passing through Akamai's edge, covered by Adaptive Security Engine rule 3000991 v1 (PHP Remote Code Execution Attack Detected) and Rapid Rule 3000991, plus the existing command injection rules for weaponized payloads of these PHP flaws","since":"2026-10-21","covers":"Requests proxied through Akamai App & API Protector and HTTP requests passing through Akamai's edge are covered by Adaptive Security Engine rule 3000991 v1 (PHP Remote Code Execution Attack Detected) and Rapid Rule 3000991, and weaponized payloads for these PHP flaws are covered by Akamai App & API Protector's existing command injection rules.","limits":"None stated in the rows; Rapid Rule 3000991 was deployed network-wide in Alert mode at 10:00 AM ET and switched to deny at 1:36 PM ET on Oct 21, 2026.","source":"https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core","vendor":"Akamai","seen_at":"2026-10-24T18:43:22Z","sources":["https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core","https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence"],"confidence":0.9,"source_title":"Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai","customer_action":"Upgrade to the patched PHP releases; the WAF rules are a stopgap for organizations that cannot patch immediately and an important layer, but patches remain essential."},{"kind":"waf-rule","scope":null,"since":"2026-10-21","covers":"HTTP requests proxied through Cloudflare, matched by Cloudflare Managed Ruleset rules for CVE-2026-109618 and CVE-2026-109619 (named 'PHP Remote Code Execution Attack', set to Block, on Free, Professional, Business and Enterprise plans), plus origin HTTP responses matched by the Managed Response Firewall Default ruleset for php2shell.","limits":"Covers only traffic proxied through Cloudflare; does not undo actions already performed at the origin; the rules name only CVE-2026-109618 and CVE-2026-109619, and the response-side document does not confirm php2shell is one of the listed flaws; the changelogs say detection logic is unchanged and only rule metadata and descriptions were updated; customers who override ruleset behavior or whose Managed Ruleset is not in block mode are not covered; the document does not state coverage of non-HTTP paths and does not say the PHP runtime is patched.","source":"https://blog.cloudflare.com/full-transaction-waf/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:32Z","sources":["https://blog.cloudflare.com/full-transaction-waf/","https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/"],"confidence":0.9,"source_title":"Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog","customer_action":"Patch the PHP runtime and keep the WAF rules and response rules enabled while patching; on paid plans, confirm the Managed Ruleset deploys in block mode; review detections in Security Analytics and, if false positives occur, restrict the managed ruleset's scope to specific paths. The documents do not say the rules replace patching."},{"kind":"waf-rule","scope":"AWS WAF PHP Managed Rule Group","since":"2026-10-22","covers":"HTTP requests inspected by AWS WAF using the PHP Managed Rule Group (default version), including requests matching CVE-2026-109618 via rule PHP2Shell_BODY_Extended, and CVE-2026-109619 per the bulletin.","limits":"Patching is the only complete fix; the document does not state other limits.","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","vendor":"AWS","seen_at":"2026-10-24T19:12:56Z","sources":["https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html"],"confidence":0.9,"source_title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","customer_action":"Use the default managed rule group version, or update a pinned version to the latest; still upgrade PHP as first priority."}],"who_affected":"Any PHP install in the affected ranges that serves web requests is exposed, from PHP 7.3.0 up to the fixed release for each branch. The sources also list Siemens RUGGEDCOM APE1808 firmware and several PAN-OS 10.2.x releases as affected, but give no version details for them. Installs already on a fixed PHP release can skip this.","tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T18:35:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@php.net","poc_count":12,"sources":[{"source":"nvd","external_id":"CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","severity":null,"published_at":"2026-10-21T14:17:09+00:00","modified_at":"2026-10-23T16:26:54+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109618:238","url":null,"severity":null,"published_at":"2026-10-23T22:30:58+00:00","modified_at":"2026-10-23T22:30:58+00:00","first_seen_at":"2026-10-23T22:30:58+00:00","fetched_at":"2026-10-23T22:30:58+00:00","note":"Primary source GHSA-w8hw-w9fx-j79w (CVSS 4.0 9.2): fixed in 8.2.35/8.3.36/8.4.27/8.5.12. Exploited: Datadog cites AWS reporting attempts from 2026-10-17, public PoCs exist. Corrected PAN-OS entries (earlier ones looked wrong); Siemens RUGGEDCOM APE1808 entry not verified, so unknown. Same-day sibling CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is related."},{"source":"lab","external_id":"https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities#CVE-2026-109618","url":"https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities","severity":null,"published_at":"2026-10-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T00:16:52+00:00","fetched_at":"2026-10-24T00:16:52+00:00","note":"OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI"},{"source":"github-poc","external_id":"saaudsdk/php2shell-cve-2026-109618-109619-fix","url":"https://github.com/saaudsdk/php2shell-cve-2026-109618-109619-fix","severity":null,"published_at":"2026-10-24T00:27:16+00:00","modified_at":null,"first_seen_at":"2026-10-24T00:39:46+00:00","fetched_at":"2026-10-24T00:39:46+00:00","note":null},{"source":"github-poc","external_id":"ytbsamsu007/CVE-2026-109618-109619-Docker-Lab-Tutorial","url":"https://github.com/ytbsamsu007/CVE-2026-109618-109619-Docker-Lab-Tutorial","severity":null,"published_at":"2026-10-24T02:05:38+00:00","modified_at":null,"first_seen_at":"2026-10-24T02:16:07+00:00","fetched_at":"2026-10-24T02:16:07+00:00","note":null},{"source":"github-poc","external_id":"vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","url":"https://github.com/vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","severity":null,"published_at":"2026-10-24T06:50:02+00:00","modified_at":null,"first_seen_at":"2026-10-24T07:03:18+00:00","fetched_at":"2026-10-24T07:03:18+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109618","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/#CVE-2026-109618","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","severity":null,"published_at":"2026-10-22T17:17:46+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset · Changelog"},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/#CVE-2026-109618","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","severity":null,"published_at":"2026-10-22T17:17:48+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset · Changelog"},{"source":"lab","external_id":"https://blog.cloudflare.com/full-transaction-waf/#CVE-2026-109618","url":"https://blog.cloudflare.com/full-transaction-waf/","severity":null,"published_at":"2026-10-21T14:10:42+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog"},{"source":"lab","external_id":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/#CVE-2026-109618","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","severity":null,"published_at":"2026-10-21T13:56:45+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog"},{"source":"lab","external_id":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html#CVE-2026-109618","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T17:33:06+00:00","fetched_at":"2026-10-24T17:33:06+00:00","note":"AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director"},{"source":"lab","external_id":"https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence#CVE-2026-109618","url":"https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence","severity":null,"published_at":"2026-10-22T08:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Akamai: Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence"},{"source":"lab","external_id":"https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core#CVE-2026-109618","url":"https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core","severity":null,"published_at":"2026-10-21T13:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai"},{"source":"github-poc","external_id":"devzyai/CVE-2026-109618-POC","url":"https://github.com/devzyai/CVE-2026-109618-POC","severity":null,"published_at":"2026-10-24T18:44:44+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:53:46+00:00","fetched_at":"2026-10-24T18:53:46+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/#CVE-2026-109618","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T19:12:58+00:00","note":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)"},{"source":"github-poc","external_id":"akamor2800/php-5.4-cve-2026-php2shell-patch","url":"https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch","severity":null,"published_at":"2026-10-24T19:32:31+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:38:53+00:00","fetched_at":"2026-10-24T19:38:53+00:00","note":null},{"source":"github-poc","external_id":"GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","url":"https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","severity":null,"published_at":"2026-10-25T03:51:20+00:00","modified_at":null,"first_seen_at":"2026-10-25T05:21:19+00:00","fetched_at":"2026-10-25T05:21:19+00:00","note":null},{"source":"github-poc","external_id":"catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free","url":"https://github.com/catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free","severity":null,"published_at":"2026-10-25T12:38:45+00:00","modified_at":null,"first_seen_at":"2026-10-25T12:41:34+00:00","fetched_at":"2026-10-25T12:41:34+00:00","note":null}],"documents":[{"id":520,"url":"https://news.ycombinator.com/item?id=50210997","title":"A small audit script and config notes for the new PHP CVEs","kind":"post","source":"hackernews","text":"A small audit script and config notes for the new PHP CVEs\nhttps://github.com/mc493/php2shell-enterprise-hardening-cve-2026-109618-109619\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-23T15:51:16+00:00","relation":"discussion","confidence":null,"note":null},{"id":450,"url":"https://x.com/sans_isc/status/2112893906035626040","title":"@sans_isc: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://t.co/BgXfR","kind":"post","source":"x","text":"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) https://t.co/BgXfR1KYW1 . Infocon yellow.\n\nlikes 30 reposts 19","published_at":"2026-10-21T13:08:57+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":457,"url":"https://x.com/watchtowrcyber/status/2113585201880113451","title":"@watchtowrcyber: Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts ar","kind":"post","source":"x","text":"Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts are already underway.\n\nJake Knott, Head of Threat Intelligence at watchTowr, shares what we're seeing, what's being attempted, and what to do now in our latest Threat Briefing.\n\nhttps://t.co/mMuYBrwPnd\n\nlikes 49 reposts 9","published_at":"2026-10-23T10:55:55+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":463,"url":"https://x.com/watchtowrcyber/status/2112613730848809170","title":"@watchtowrcyber: yes, we mean CVE-2026-109618 and CVE-2026-109619","kind":"post","source":"x","text":"yes, we mean CVE-2026-109618 and CVE-2026-109619\n\nlikes 59 reposts 4","published_at":"2026-10-20T18:35:38+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":586,"url":"https://news.ycombinator.com/item?id=50204912","title":"PHP2Shell (CVE-2026-109618) Exploit","kind":"post","source":"hackernews","text":"PHP2Shell (CVE-2026-109618) Exploit\nhttps://www.exploit-db.com/exploits/52704\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-23T05:48:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":679,"url":"https://github.com/Ghost-Bx1/POC-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577","title":"Ghost-Bx1/POC-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-23T15:14:01+00:00","relation":"poc","confidence":null,"note":null},{"id":449,"url":"https://x.com/sans_isc/status/2113088117091823956","title":"@sans_isc: SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Ex","kind":"post","source":"x","text":"SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More\n https://t.co/knzRtA2cLX https://t.co/pufBWe95hJ\n\nlikes 6 reposts 1","published_at":"2026-10-22T02:00:41+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":1491,"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","title":"GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (php-src)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1493,"url":"https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/","title":"PHP2Shell: detection, analysis, remediation (Datadog Security Labs)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1494,"url":"https://security.paloaltonetworks.com/CVE-2026-109618","title":"Palo Alto Networks PSIRT: CVE-2026-109618 PAN-OS impact","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1495,"url":"https://www.openwall.com/lists/oss-security/2026/10/21/6","title":"oss-security: CVE-2026-109618 PHP 8.2-8.5 RCE via OOM corruption","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1496,"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-013","title":"Red Hat RHSB-2026-013 php2shell","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":69,"url":"https://x.com/SocketSecurity/status/2113696934372245885","title":"@SocketSecurity: Good news, everyone!\n\nPHP2Shell exploits are a massive fail (so far) 🤞 https://t","kind":"post","source":"x","text":"Good news, everyone!\n\nPHP2Shell exploits are a massive fail (so far) 🤞 https://t.co/S2dYcN1dxm\n\nlikes 29 reposts 5","published_at":"2026-10-23T18:19:54+00:00","relation":"discussion","confidence":null,"note":"@SocketSecurity"},{"id":98,"url":"https://x.com/TheHackersNews/status/2113602912530444768","title":"@TheHackersNews: The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on Oc","kind":"post","source":"x","text":"The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on October 21.\n\nCVE-2026-115560 is NOT fixed by those emergency updates.\n\nPHP says exploitation requires an unusual session configuration and considers the risk unlikely in practice.\n\nNo attacks reported.\n\nlikes 98 reposts 20","published_at":"2026-10-23T12:06:17+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":119,"url":"https://x.com/clintgibler/status/2113718227817881675","title":"@clintgibler: 📚tl;dr sec 351\n\n😈 PHP2Shell, \n🧑🏻‍💻 Autopatching Skills, \n🤖 AWS Pathrunner\n\nhttps","kind":"post","source":"x","text":"📚tl;dr sec 351\n\n😈 PHP2Shell, \n🧑🏻‍💻 Autopatching Skills, \n🤖 AWS Pathrunner\n\nhttps://t.co/eTi8ezZKgw\n\nlikes 10 reposts 0","published_at":"2026-10-23T19:44:31+00:00","relation":"discussion","confidence":null,"note":"@clintgibler"},{"id":151,"url":"https://x.com/eastdakota/status/2113079352682570051","title":"@eastdakota: Some stats on #php2shell. In the 10 hours before it was publicly announced, acro","kind":"post","source":"x","text":"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.\n\nlikes 22562 reposts 3266","published_at":"2026-10-22T01:25:51+00:00","relation":"discussion","confidence":null,"note":"@eastdakota"},{"id":212,"url":"https://x.com/rauchg/status/2112989629536440400","title":"@rauchg: It was inspiring to watch the behind-the-scenes¹ of the industry coming together","kind":"post","source":"x","text":"It was inspiring to watch the behind-the-scenes¹ of the industry coming together, weeks in advance, to protect the world's infrastructure and mitigate php2shell.\n\nWe deployed Vercel WAF mitigations that have already successfully prevented attempts on PHP origins. Assume more https://t.co/h99Nh8pCJX\n\nlikes 450 reposts 17","published_at":"2026-10-21T19:29:19+00:00","relation":"discussion","confidence":null,"note":"@rauchg"},{"id":268,"url":"https://x.com/troyhunt/status/2113364817037975914","title":"@troyhunt: Have we seen any documented breaches / exploitation traced back to either PHP2Sh","kind":"post","source":"x","text":"Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive headlines this week, what’s the impact so far (other than all the scrambling to patch etc)?\n\nlikes 440 reposts 19","published_at":"2026-10-22T20:20:11+00:00","relation":"discussion","confidence":null,"note":"@troyhunt"},{"id":274,"url":"https://x.com/vxunderground/status/2113540887380963480","title":"@vxunderground: Lots of arguments online surrounding who truly discovered PHP2Shell, who gets th","kind":"post","source":"x","text":"Lots of arguments online surrounding who truly discovered PHP2Shell, who gets the clout, etc.\n\nI am the person who found. I found it in like 2013, or something, whatever. Trust me, bro. I'm hardcore and 1337.\n\nNow give me lots of monies and clout. Don't be a hater https://t.co/9DpsAQC4ry\n\nlikes 1822 reposts 60","published_at":"2026-10-23T07:59:49+00:00","relation":"discussion","confidence":null,"note":"@vxunderground"},{"id":279,"url":"https://x.com/vxunderground/status/2113086117927178490","title":"@vxunderground: Today silly shenanigans:\n- PHP2shell, leak, bad stuff\n- Something about Railway?","kind":"post","source":"x","text":"Today silly shenanigans:\n- PHP2shell, leak, bad stuff\n- Something about Railway?\n- The number 4 is a valid cert\n- NodeJS and something about broccoli?\n- LiteLLM supply chain attack \n- GitLab CVSS 10\n- OpenCode leaking API keys \n\nWhat does this all mean? Idk https://t.co/dr91Zv7doj\n\nlikes 2600 reposts 219","published_at":"2026-10-22T01:52:44+00:00","relation":"discussion","confidence":null,"note":"@vxunderground"},{"id":391,"url":"https://x.com/craiu/status/2113579352470479184","title":"@craiu: A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243","kind":"post","source":"x","text":"A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243\n\nlikes 56 reposts 15","published_at":"2026-10-23T10:32:40+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":392,"url":"https://x.com/craiu/status/2112924512471953730","title":"@craiu: Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status","kind":"post","source":"x","text":"Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status, patches, here: https://t.co/w20rTaVxMG\n\nlikes 158 reposts 46","published_at":"2026-10-21T15:10:34+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":442,"url":"https://x.com/rez0__/status/2113262565983973773","title":"@rez0__: My non-hacking buddy asked me how much the person who found the php2shell made. ","kind":"post","source":"x","text":"My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation:\n\nHack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.\n\nlikes 2700 reposts 76","published_at":"2026-10-22T13:33:52+00:00","relation":"discussion","confidence":null,"note":"@rez0__"},{"id":446,"url":"https://x.com/sans_isc/status/2113723736214180323","title":"@sans_isc: (Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5zi","kind":"post","source":"x","text":"(Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5ziwwB3\n\nlikes 0 reposts 1","published_at":"2026-10-23T20:06:24+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":448,"url":"https://x.com/sans_isc/status/2113577565160182077","title":"@sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal","kind":"post","source":"x","text":"SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked\n https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC\n\nlikes 1 reposts 2","published_at":"2026-10-23T10:25:34+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":458,"url":"https://x.com/watchtowrcyber/status/2112923764270768398","title":"@watchtowrcyber: Congratulations to the team at @calif_io (specifically @lcfr_hax)  for the disco","kind":"post","source":"x","text":"Congratulations to the team at @calif_io (specifically @lcfr_hax)  for the discovery of PHP2Shell. \n\nWe've now shared further information aimed at helping end users, but credit for this amazing work goes to @calif_io and @lcfr_hax \n\nhttps://t.co/4ibdwkmvZb\n\nlikes 154 reposts 31","published_at":"2026-10-21T15:07:36+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":533,"url":"https://news.ycombinator.com/item?id=50203437","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-23T01:29:04+00:00","relation":"discussion","confidence":null,"note":null},{"id":539,"url":"https://news.ycombinator.com/item?id=50199203","title":"Why governments pulled websites offline over the decades-old PHP language","kind":"post","source":"hackernews","text":"Why governments pulled websites offline over the decades-old PHP language\nhttps://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-22T18:25:46+00:00","relation":"discussion","confidence":null,"note":null},{"id":544,"url":"https://news.ycombinator.com/item?id=50195017","title":"Re: Hours later – No, there is an easy way to exploit this vulnerability","kind":"post","source":"hackernews","text":"Re: Hours later – No, there is an easy way to exploit this vulnerability\nhttps://github.com/cookiengineer/actual-php2shell\n\n4 points, 3 comments on Hacker News","published_at":"2026-10-22T13:27:02+00:00","relation":"discussion","confidence":null,"note":null},{"id":546,"url":"https://news.ycombinator.com/item?id=50194701","title":"PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them","kind":"post","source":"hackernews","text":"PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them\nhttps://www.getastra.com/blog/security-advisory/php2shell-php-vulnerabilities/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-22T12:56:57+00:00","relation":"discussion","confidence":null,"note":null},{"id":553,"url":"https://news.ycombinator.com/item?id=50188558","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-21T22:28:39+00:00","relation":"discussion","confidence":null,"note":null},{"id":561,"url":"https://news.ycombinator.com/item?id=50183570","title":"Your Sites Are Protected Against the PHP2Shell Vulnerabilities","kind":"post","source":"hackernews","text":"Your Sites Are Protected Against the PHP2Shell Vulnerabilities\nhttps://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/\n\n4 points, 0 comments on Hacker News","published_at":"2026-10-21T16:23:52+00:00","relation":"discussion","confidence":null,"note":null},{"id":562,"url":"https://news.ycombinator.com/item?id=50182037","title":"PHP2Shell: Critical PHP RCE Vulnerabilities Explained","kind":"post","source":"hackernews","text":"PHP2Shell: Critical PHP RCE Vulnerabilities Explained\nhttps://moneo.com.tr/blog/php2shell-critical-php-rce-vulnerabilities-explained\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-21T14:51:59+00:00","relation":"discussion","confidence":null,"note":null},{"id":564,"url":"https://news.ycombinator.com/item?id=50181326","title":"Cloudflare deploys protections against php2shell vulnerability","kind":"post","source":"hackernews","text":"Cloudflare deploys protections against php2shell vulnerability\nhttps://blog.cloudflare.com/php-vulnerabilities-waf-protection/\n\n132 points, 24 comments on Hacker News","published_at":"2026-10-21T14:11:14+00:00","relation":"discussion","confidence":null,"note":null},{"id":567,"url":"https://news.ycombinator.com/item?id=50181037","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n2 points, 1 comments on Hacker News","published_at":"2026-10-21T13:56:05+00:00","relation":"discussion","confidence":null,"note":null},{"id":569,"url":"https://news.ycombinator.com/item?id=50180810","title":"Simple Proxy to secure your PHP from PHP2Shell vulnerability","kind":"post","source":"hackernews","text":"Simple Proxy to secure your PHP from PHP2Shell vulnerability\nhttps://github.com/Qbix/proxy\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-21T13:41:30+00:00","relation":"discussion","confidence":null,"note":null},{"id":571,"url":"https://news.ycombinator.com/item?id=50178312","title":"PHP2Shell: Critical Vulnerabilities in PHP","kind":"post","source":"hackernews","text":"PHP2Shell: Critical Vulnerabilities in PHP\nhttps://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell\n\n3 points, 0 comments on Hacker News","published_at":"2026-10-21T09:59:01+00:00","relation":"discussion","confidence":null,"note":null},{"id":574,"url":"https://news.ycombinator.com/item?id=50175425","title":"PHP2Shell","kind":"post","source":"hackernews","text":"PHP2Shell\nhttps://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-21T02:42:03+00:00","relation":"discussion","confidence":null,"note":null},{"id":587,"url":"https://news.ycombinator.com/item?id=50204453","title":"PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive","kind":"post","source":"hackernews","text":"PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive\nhttps://opennhp.org/blog/php2shell-attackers-cannot-exploit-what-they-cannot-reach/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-23T04:16:39+00:00","relation":"discussion","confidence":null,"note":null},{"id":594,"url":"https://news.ycombinator.com/item?id=50199595","title":"Php2shell is not exploitable in real production enviroment","kind":"post","source":"hackernews","text":"Php2shell is not exploitable in real production enviroment\nhttps://berardinellidaniele.com/posts/php2shell/\n\n3 points, 2 comments on Hacker News","published_at":"2026-10-22T19:00:38+00:00","relation":"discussion","confidence":null,"note":null},{"id":611,"url":"https://news.ycombinator.com/item?id=50195054","title":"Amazon says PHP2Shell exploitation began 4 days before patches","kind":"post","source":"hackernews","text":"Amazon says PHP2Shell exploitation began 4 days before patches\nhttps://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-22T13:29:48+00:00","relation":"discussion","confidence":null,"note":null},{"id":615,"url":"https://news.ycombinator.com/item?id=50194070","title":"Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure","kind":"post","source":"hackernews","text":"Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure\nhttps://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/\n\n267 points, 99 comments on Hacker News","published_at":"2026-10-22T11:50:36+00:00","relation":"discussion","confidence":null,"note":null},{"id":704,"url":"https://bsky.app/profile/doublepulsar.com/post/3myjwllyrt226","title":"@doublepulsar.com: PHP2Shell thread: cyberplace.social/@GossiTheDog...","kind":"post","source":"bluesky","text":"PHP2Shell thread: cyberplace.social/@GossiTheDog...\nhttps://cyberplace.social/@GossiTheDog/117474220875882526\n\nlikes 20 reposts 2","published_at":"2026-10-23T10:06:43+00:00","relation":"discussion","confidence":null,"note":"@doublepulsar.com"},{"id":684,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3myjwkqr4bc2q","title":"@campuscodi.risky.biz: -Supply chain attack lets ransomware group inside 40+ shipping companies\n-Pentag","kind":"post","source":"bluesky","text":"-Supply chain attack lets ransomware group inside 40+ shipping companies\n-Pentagon builds tech sabotage unit\n-PHP2Shell exploitation gets underway\n-GoDaddy revokes 400,000 certs\n-LiteLLM has another security incident\n\nP: risky.biz/RBNEWS624/\nN: news.risky.biz/risky-bullet...\nhttps://risky.biz/RBNEWS624/ https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/\n\nlikes 18 reposts 9","published_at":"2026-10-23T10:06:14+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":2387,"url":"https://x.com/Hacker0x01/status/2112955127283712456","title":"@Hacker0x01: 🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-20","kind":"post","source":"x","text":"🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).\n\nSecurity researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact.\n\nDetails: https://t.co/Z5DUmpGUNu\n\nlikes 277 reposts 21","published_at":"2026-10-21T17:12:13+00:00","relation":"discussion","confidence":null,"note":"@Hacker0x01"},{"id":2492,"url":"https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities","title":"OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI","kind":"advisory","source":"lab","text":"Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI\n\nOctober 21, 2026\n\n# Patch the Planet: global response coordination as agents uncover critical vulnerabilities\n\nOver the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet⁠(opens in a new window) initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure.\n\nFor organizations using PHP, the priority now is applying the fixes. We’re sharing a PHP version checker as a Codex skill⁠(opens in a new window) to help operators identify potentially vulnerable PHP versions and, alongside PHP’s and their providers’ guidance, determine which updates apply.\n\nGiven the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.\n\nTo our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.\n\nTo help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services.\n\nAs significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months. Drawing on our experience thus far, we’re sharing a proposed approach, appropriate for the AI era, to responding to critical vulnerabilities in widely used software, and we’re asking the security community to help improve this framework. It brings together our models, security expertise, and maintainers to help turn findings into protection and build a response that can scale as AI capabilities advance.\n\n## Coordinating a global response\n\nGetting a fix into use can mean adapting it for older releases, preparing provider mitigations, and updating systems across many organizations. A repeatable process helps those teams act quickly as more vulnerabilities are discovered.\n\nThrough Patch the Planet, we contributed security expertise and model access to support the PHP response, and worked with maintainers and research partners to test fixes and prepare guidance. We also helped coordinate with infrastructure providers on protections for affected systems and engaged government cyber agencies to help guidance reach critical organizations. This supported the maintainer-led response and helped other defenders prepare.\n\nFor some findings, researchers can work directly with the software’s maintainers to investigate the issue and develop a fix. Others need a wider response because they affect many products or because distributors and service providers need time (which may be in short supply if frontier capabilities are not too far ahead of those that are broadly available) to prepare updates and protections. In those cases, the proposed framework can help maintainers identify who needs to be involved and coordinate the work. The response can involve five stages:\n\n- Validate and fix the upstream vulnerability. The maintainer, researchers, and essential technical partners confirm the finding, assess its impact, and develop and test a fix. This process includes adversarial testing with frontier models to look for ways around the patch and related variants of the vulnerability. \n- Give affected organizations time to act. We propose a framework for considering which organizations need advance information to prepare protections, while maintainers decide whom to involve. We help with outreach, information-sharing agreements, and coordination between teams. A distributor might adapt a fix for an older release, a hosting provider might test a mitigation, and a security provider might prepare detection or prevention measures, including web application firewall (WAF) rules. \n- Coordinate with government partners to help protect critical systems. Government agencies play an essential role in coordinating a wider response and helping security guidance reach organizations responsible for critical infrastructure and other essential services. In the case of PHP, we worked, in collaboration with our partners, to engage with multiple parts of the U.S. government, including the White House’s Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners to support that effort.\n- Prepare updates across affected products. As the fix, guidance, and disclosure plans become stable, maintainers can involve additional distributors, hosting and service providers, response teams, and operators to prepare updates and address gaps in coverage.\n- Once a patch is available, publish guidance and support deployment. Public guidance helps people assess their exposure, find authoritative updates or interim mitigations, and check that a fix is running. The response continues as operators deploy updates and report where they need help.\n\nThe proposed framework considers an organization’s protective role, including protecting its own systems and customers, the time needed to act, and its ability to handle sensitive information. The same criteria would apply to comparable organizations, with maintainers deciding whom to involve ahead of disclosure.\n\nEach participant receives the information needed to carry out their protective work, from network logs with indicators of compromise to more sensitive working proof-of-concept exploits. Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.\n\nTeams following this framework would work with maintainers to give defenders time to prepare and reassess the timeline if there’s active exploitation in the wild, a leak, a revealing public patch, or increased risk to users from stalled remediation.\n\nThe Patch the Planet website⁠(opens in a new window) brings together public disclosures and guidance to help operators identify affected systems, find the right update, and verify that the updated software is running properly. For PHP, it points to the maintainers’ official patch and upgrade instructions and our partners’ technical research. The guidance also covers interim mitigations, when to involve a provider or expert, and backup and recovery. Interim protections can reduce risk, but we’ll make their limits and operational tradeoffs clear. \n\nOperators can use CISA’s guidance on prioritization and remediation⁠(opens in a new window) to assess how quickly to act based on exposure, exploitation, and potential impact. That may mean emergency patching, immediate mitigation, or a planned update, alongside forensic triage where warranted to assess whether systems have already been compromised. Priorities should be reassessed as conditions change, with a clear path to lasting remediation. \n\n## Giving maintainers the capacity and resources to respond\n\nGlobal coordination depends on the people who maintain the software. Many projects are run by small teams that review security reports alongside routine development. Those teams need help separating new issues from duplicates, assessing impact, and testing fixes across supported releases. We support that work with funding, access to capable models, and hands-on engineering help.\n\nPowerful AI capabilities are advancing across the industry, and we expect AI to play a growing role in helping defenders find vulnerabilities, monitor systems, and respond to threats. We’re investing in models, tools, and partnerships to help defenders put those capabilities to work.\n\nOur investments include subscriptions for all maintainers through Codex for OSS and direct sponsorship of projects such as the Rust Foundation⁠(opens in a new window) for maintainers and technical work. Each project sets its own priorities. Reusable tests and security workflows can reduce the effort needed to handle future findings. Open-source projects can apply to Patch the Planet⁠(opens in a new window) for hands-on support.\n\nWe’re also calibrating additional blocking classifiers for Daybreak to help reduce the potential for misuse. This involves difficult tradeoffs: safeguards intended to prevent abuse can also block legitimate security work. Broad access to capable models and effective protections against misuse are both critical. Our aim is to preserve the capabilities defenders need to find and fix vulnerabilities while limiting harmful use. We’ll continue refining that balance as capabilities advance and we learn from how these tools are used.\n\n## Building more secure software foundations\n\nAs models become more capable, the opportunity extends beyond finding and fixing individual vulnerabilities. We want to help engineers build more secure software from the start. Improvements to a widely used component can prevent bugs or limit their impact across many products and services.\n\nAI can help engineers understand existing code, prepare changes, and develop tests, while maintainers and security experts verify that those changes preserve the behavior users depend on. We see opportunities in several areas:\n\n- Secure code from the start. Coding models can help developers choose safer defaults, use security libraries correctly, and catch risky patterns as they write. Preventing vulnerabilities during development means fewer emergency fixes for maintainers and users.\n- Memory-safe software. Moving critical components to memory-safe languages can eliminate common classes of memory errors. AI can help with migrations, with tests and expert review to check behavior and compatibility.\n- Formal verification. Mathematical proofs can show that critical components satisfy specified security properties under stated assumptions. Applying these methods to widely used components could help rule out classes of vulnerabilities across the services and critical infrastructure that depend on them.\n- Stronger isolation. Systems need protection against vulnerabilities that have not yet been found or fixed. Running software that processes untrusted files, images, or media in tightly restricted sandboxes can limit the damage if it is compromised. AI can help engineers test and strengthen widely used sandboxing technologies, improving protections across many applications.\n\n## Help us improve this approach\n\nWe’re sharing our approach so maintainers, researchers, response teams, providers, and operators can help make it workable. We want to understand where it would help, where it could add delay or burden, and what we’ve missed. Examples from past disclosures would be especially useful.\n\nWe’re particularly interested in: \n\n- Disclosure windows. How much time do maintainers, operators, and defenders need to prepare and deploy reliable fixes? What evidence should trigger earlier disclosure, especially when some users can be protected sooner than others?\n- Emergency patching. When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access? What safeguards should apply? We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or patching the system.\n- Early notice. Who needs advance warning to take a useful protective action, including defenders we might miss? When do staged notifications work better than notifying a wider group at once, and how should we weigh coverage against leak risk?\n- Secure-by-default software packages. How can we help identify and fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes to older versions that no longer receive security updates? What testing and maintenance would make these packages reliable options when a timely upgrade isn’t feasible?\n\nWe also welcome recommendations for independent security experts who can review the approach, challenge its assumptions, and identify gaps. Your input will help us refine the response and prioritize support. Share your feedback here⁠(opens in a new window).","published_at":"2026-10-21T00:00:00+00:00","relation":"advisory","confidence":null,"note":"OpenAI disclosure page (matched by content)"},{"id":2646,"url":"https://github.com/saaudsdk/php2shell-cve-2026-109618-109619-fix","title":"saaudsdk/php2shell-cve-2026-109618-109619-fix","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-24T00:27:16+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2668,"url":"https://github.com/ytbsamsu007/CVE-2026-109618-109619-Docker-Lab-Tutorial","title":"ytbsamsu007/CVE-2026-109618-109619-Docker-Lab-Tutorial","kind":"poc","source":"github","text":"Lab pembelajaran lokal untuk mereproduksi CVE-2026-109618/109619 pada Docker.\n\nstars 0","published_at":"2026-10-24T02:05:38+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2704,"url":"https://github.com/vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","title":"vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-24T06:50:02+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2815,"url":"https://x.com/CFchangelog/status/2113714815885885868","title":"@CFchangelog: Emergency update to the Cloudflare Managed Ruleset on 2026-10-22 refines metadat","kind":"post","source":"x","text":"Emergency update to the Cloudflare Managed Ruleset on 2026-10-22 refines metadata for 7 rules targeting CVE-2026-109618 and CVE-2026-109619. Detection logic and block actions remain unchanged.\n\nhttps://t.co/GuwGtO7EVt\n\nlikes 315 reposts 51","published_at":"2026-10-23T19:30:57+00:00","relation":"discussion","confidence":null,"note":"@CFchangelog"},{"id":2838,"url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","title":"Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 22, 2026\n\n## WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset\n\nThis emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...c438d5dd | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...0a0c2f64 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...545d163c | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...212afcc9 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...1867b12e | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...9d9c073d | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...48143645 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n\nFor more information, refer to WAF Managed Rules.","published_at":"2026-10-22T17:17:46+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2839,"url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","title":"Cloudflare: WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 22, 2026\n\n## WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset\n\nThis emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Free Ruleset | ...b5ccf32f | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...bcd95984 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...82dab691 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...24b1a4c6 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...302ede46 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...7975ce1b | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...e8d613fa | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n\nFor more information, refer to WAF Managed Rules.","published_at":"2026-10-22T17:17:48+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2846,"url":"https://blog.cloudflare.com/full-transaction-waf/","title":"Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog","kind":"advisory","source":"lab","text":"Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog\n\nOctober 21, 2026\n\n# Introducing full transaction detection for Cloudflare WAF\n\nDaniele Molteni\n\nElie Roudninski\n\nNick Downie\n\nToday, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both \"Does this request look malicious?\" and \"What happened when the application handled it?\" Response rules can then block the origin’s response before it reaches the requester.\n\nThese are valuable protections because the latest frontier models are uncovering vulnerabilities buried deep in widely used software, giving defenders clarity on what to fix — and attackers new paths to exploit. The recent php2shell vulnerability shows the stakes: a flaw in a common software component can put applications across the Internet at risk. AI agents scanning for vulnerabilities can be extremely persistent, adapting payloads using feedback, and chaining vulnerabilities, credentials, and permissions. An application's response can reveal whether an attempt worked and give an attacker information that helps them go deeper.\n\nInspecting incoming requests remains essential for stopping recognizable attacks before they reach an application. But some threats become clear only when the request is considered alongside what the origin returns. A suspicious input followed by a response exposing sensitive information tells a different story from the same input followed by a rejection or an error.\n\nWith these new capabilities, customers can use Cloudflare-managed protections or build their own policies combining request and response properties. This extends our always-on application security framework, with detection results available in Security Analytics to support investigation. Our first managed protections using this capability address the recently disclosed php2shell vulnerability.\n\nAnd the best part? We are making these new capabilities generally available to all Cloudflare customers, including Free plans.\n\n## Copy link Request inspection is not enough\n\nCloudflare WAF protects websites and APIs with managed rules, custom rules, and rate limiting. Managed rules provide protection for known attack techniques and vulnerabilities while custom rules let teams create their own policies using parameters such as an IP address, URL path, headers, and request body. These controls operate at the request level to stop exploits or unwanted traffic from reaching the origin.\n\nFor many threats, this is the right place to act. However, treating every suspicious request as a confirmed exploit creates a difficult choice. Broad request signatures can catch more potential attacks, but they can also show “false positives”, such as matching legitimate traffic — which then breaks the applications. Deploying only rules that do not trigger false positives reduces that risk, but can leave more room for more ambiguous traffic to reach the server.\n\nThe response provides the missing evidence. Cloudflare can now correlate it with the request that produced it, so detections can account for the outcome of the entire HTTP transaction.\n\nAs an illustrative example, consider an application that lets users download files. An attacker manipulates the file parameter to request a private configuration file outside the permitted directory:\n\n```\nGET /download?file=../../config/database.ini\n```\n\nRequest inspection can recognize this path traversal attempt and block it before it reaches the application. The request alone, however, cannot establish whether the application would expose the file. It might reject the request, ignore the traversal, or return an error. If the request reaches the origin, a response like this provides additional evidence:\n\n```\n200 OK\nContent-Type: text/plain\n[database]\nusername=app_service\npassword=EXAMPLE_SECRET\n```\n\nFull transaction detection provides a missing piece: it can correlate the attempted file access with response content characteristic of a private configuration file. Configuration-like text can legitimately appear in documentation or example downloads; combining it with a traversal attempt provides stronger evidence of sensitive data exposure than either signal alone. A response rule can then replace the origin response with a Cloudflare WAF block page and HTTP 403 before it reaches the requester, effectively blocking the exploit by preventing sensitive information from reaching the attacker.\n\n## Copy link Detection and mitigation are separate by design\n\nFull transaction detection extends the always-on detection framework we introduced earlier this year. Detections analyze traffic and attach metadata to the request and response, rules then decide what to do with those results.\n\nThe structure of request and response in Cloudflare’s web application firewall (WAF).\n\nSeparating those jobs gives customers visibility before they design a policy. Security teams can inspect detections in their own traffic, understand which endpoints and signatures are involved, and choose the response that fits their application. Similar to the approach for the request-based Attack Signature Detection, the outcome of the detections are stored in fields that can be accessed in the response custom rules or used in managed detections to block traffic.\n\nMirroring the request detection fields, the following new fields are added to our platform:\n\nField\n\ncf.waf.signature.response.confidence\n\nConfidence values associated with matching signatures\n\ncf.waf.signature.response.categories\n\nCategories associated with matching signatures\n\ncf.waf.signature.response.ref\n\nSignature reference IDs, up to 10\n\nThe first full transaction detections focus on exploit confirmation for high profile vulnerability. It correlates suspicious input with response signals that indicate an exploit may have succeeded.\n\nWe will expand coverage over time by supporting other use cases, including detecting data exposure and exfiltration signals. This is important for the Internet beyond any one application: defenses can distinguish probing from evidence of impact, while detection of exposed data and services can reach customers that do not have a dedicated security team tuning every WAF rule.\n\n## Copy link Create rules on the response\n\nDetecting evidence of exploitation is most useful if you can act on it in real time. Response custom rules turn full transaction detections into inline protection by blocking a matching origin response before it reaches the requester, although it cannot undo actions already performed at the origin.\n\nSecurity teams can now combine request and response properties with detection results to decide which responses to block. When a blocking rule matches, Cloudflare replaces the origin response with a WAF block page or a custom response.\n\nResponse phase controls are available in the Cloudflare dashboard at the bottom of the Security > Security Rules page, with both managed protections and custom rules.\n\nWe have released both managed and custom rules to all plans, including Free plans. Over time, we will follow the same approach we use for request detections, where managed detections for free plans focus on high-profile vulnerabilities, while paying customers get a richer catalog of detections.\n\n## Copy link Managed detections\n\nAll customers get the protection of the full array of transaction detections through the Cloudflare Managed Response Firewall Default ruleset, which is designed for a simple one-click deploy and simplified configurability. When a signature matches, the managed detection will block the response and return a standard WAF block page.\n\nYou can edit the Cloudflare Managed Response Firewall Default scope to run detections only on a portion of their applications, for example by excluding or restricting the detection to a specific path. Paying customers can use detection fields in custom response rules to create more tailored policies.\n\nCloudflare Managed Response Firewall Default runs on every request by default. To reduce the risk of false positives, customers can restrict the scope of the mitigation to a portion of their application.\n\n## Copy link Custom rules\n\nCustom response rules are designed to give customers full control of the rule logic. A useful rule can stop an administration interface from being exposed when an authentication gateway has not marked the request as internal. For example:\n\n`http.request.uri.path starts_with \"/admin\" and not http.request.headers[\"x-internal-user\"][0] eq \"true\" and http.response.code eq 200 and http.response.headers[\"content-type\"][0] contains \"text/html\" `\n\nThis blocks only when an unauthenticated request targets `/admin` and the origin actually returns a successful HTML administration page. It does not block ordinary authentication failures, redirects, or non-administration traffic.\n\nAll customers can create response rules by combining both request and response fields.\n\nAll customers can create up to three custom response rules supporting Log and Block actions. The fields and functions available in response to custom rules mirrors what your plan gives you access to in request custom rules already. Creating rules on the response body is not yet available.\n\nFollowing the Attack Signature Detection approach, paying customers also have access to the outcome of attack detections through the `cf.waf.signature.response.*` fields listed above. These fields can be combined with other parameters (such as a hostname, URL path, source IP, request header) to enable protection on a single path, or limit the policy to application-specific context. We are currently rolling out the response fields to all our accounts. If you don’t have access to them yet, please contact your account team.\n\n## Copy link Investigating matching requests\n\nWhen a managed or custom response rule logs or blocks a transaction, the event is available in Security Events. This means responders can trace any detection back to the full context of the request and the specific rule that took action.\n\nAt the moment, both request-only rules and full-transaction rules are shown together in the same analytics page. In Security Events, the events generated by response rules are part of the Managed Rules or Custom Rules service. You can filter events belonging to a specific rule ID in the relative rule list section.\n\n## Copy link Get started today\n\nFull transaction detection is generally available for all zones proxying traffic through Cloudflare. To verify that you’re protected, go to Security > Security Rules in the Cloudflare dashboard. If you want to customize your policy, start by reviewing full transaction detections in Security Analytics, then create the response phase policy that fits your application.","published_at":"2026-10-21T14:10:42+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2847,"url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","title":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog","kind":"advisory","source":"lab","text":"Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog\n\nOctober 21, 2026\n\n# Cloudflare deploys protections against php2shell vulnerability\n\nDaniele Molteni\n\nDan Jones\n\n and \n\nKuber Nandwani\n\nUpdate - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP's next regular release.\n\nAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed `session.upload_progress.name` are not covered by the WAF rule.\n\nThe existing rules \"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\" protects against this vulnerability.\n\nMore information to follow.\n\nOctober 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.\n\nCloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.\n\nCloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.\n\nProtecting against php2shell required more than standard request-based rules. Request data alone does not always provide enough evidence to distinguish an exploit from legitimate traffic. The origin’s response adds context, helping identify whether an exploit succeeded while reducing the risk of false positives.\n\nTo deliver this protection, we developed full transaction detection, a new Cloudflare WAF capability that combines signals from the request and response within the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester. The php2shell protections are the first managed detections we have released using this capability.\n\nCustomers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation. Our security analysts continue monitoring attack activity and update the rules when and if new techniques and variations emerge in the hours and days ahead. You can track new rules in the changelog.\n\nThe protections are available and deployed automatically on all plans with WAF deployed, including Free users.\n\n## Copy link What we know about the vulnerabilities\n\nPHP is used by almost 70% of websites. The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the Internet.\n\nThe two vulnerabilities involve how PHP handles memory when something goes wrong while processing a HTTP request. Normally, PHP allocates memory to store the data it needs to process a request, then releases it when that work finishes. If processing stops unexpectedly, for example because it runs out of memory, PHP fails to clean up the memory safely. These vulnerabilities arise when PHP handles an error and then tries to use data that was not fully set up or memory that has already been released.\n\nAn attacker can send specially crafted HTTP requests to trigger these conditions. Large requests are one way to put memory under pressure, but the problem goes beyond consuming server resources. By manipulating the data PHP encounters in this invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker.\n\nThe two vulnerabilities differ in when the unsafe memory access happens:\n\nVulnerability\n\nWhat goes wrong\n\nCVE-2026-109618\n\nPHP runs out of memory and interrupts its work before some internal data has been properly initialized. During cleanup of that request, PHP may use this unfinished data as though it were valid.\n\nCVE-2026-109619\n\nA fatal error interrupts a request, leaving PHP holding references to memory that is released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access memory that is no longer valid and expose sensitive data.\n\nThese flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities. Administrators need to update the PHP software running their applications. If a hosting provider manages PHP, ask the provider to apply the security update.\n\nAdministrators can follow the PHP advisory for affected versions and remediation instructions. Keep Cloudflare WAF protections enabled while patching. Restricting unnecessary uploads and limiting upload sizes can also reduce exposure, but these measures do not replace the PHP fix.\n\n## Copy link New rules\n\nFor Free customers, new rules have been released under the Cloudflare Managed Free Ruleset (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba). Free customers don’t have to take any actions to enable the protection. To override the ruleset behavior, you can refer to our documentation.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | 4e315666e8e344cdb64119a3b5ccf32f |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | 00c10e6cc4da4bd08722adeebcd95984 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 48ddf592361e4fdb97a8a85982dab691 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 3556683d512a47f2937899c524b1a4c6 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | da07c85852e34625bb478496302ede46 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 19373a83abb840e18ab3ce5a7975ce1b |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 07f0b6ddaabf40b1b2042dade8d613fa |\n\nProtection for paid plans has been released as part of the Cloudflare Managed Ruleset (Ruleset ID efb7b8c949ac4650a09736fc376e9aee). If you are on a Professional, Business, or Enterprise plan, review your Managed Ruleset deployment to confirm it has deployed block mode.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | c1d409ad838f47f59446f21cc438d5dd |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | f9a45927414245e3a64bb12d0a0c2f64 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 771c654ae1154d4daa72f4e1545d163c |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 217005865f0145f392300bac212afcc9 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | 38efdb17ea594501bb55a1d71867b12e |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 4148ae686fdb4d01be673fab9d9c073d |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 1389aa259617437392ce149c48143645 |\n\nTo better identify exploit attempts, Cloudflare developed full transaction detection, a new WAF capability that analyzes both sides of the same HTTP transaction. While some malicious payloads can be identified using the request alone, the response contains useful signals that can be used to create rules with higher confidence, reducing false positives. A matching full transaction rule can block the origin response before it reaches the requester. Learn how it works in our full transaction detection blog post.\n\nThe new Cloudflare Managed Response Firewall Default has been automatically deployed for customers on all plans, including Free. To verify that the response rules are active, you can visit the Security > Security Rules page. Read the full transaction blog to learn how to customize its deployment.\n\nThe new Cloudflare Managed Response Firewall Default detection is protecting your traffic.\n\n## Copy link Review events and customize protection\n\nTo analyze blocked requests, visit Security > Security Analytics > Events. Filter by the rule IDs in the table above and inspect the matched request, action, and path. Events identify whether the action came from a managed or custom rule. Customers who need to tailor the protection can update the scope of the Managed Ruleset to the parts of an application where it is relevant.\n\n## Copy link Update PHP and keep the protection enabled\n\nCloudflare customers using our Managed Ruleset are protected by default. We recommend following the advisory recommendation and applying the vendor update to your PHP repos as soon as possible while keeping the WAF protection enabled as an additional protection. Our WAF analysts will continue to update protections as new techniques emerge.","published_at":"2026-10-21T13:56:45+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2857,"url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","title":"AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director","kind":"advisory","source":"lab","text":"AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director\n\nIntroducing a new console experience for AWS WAF\n\nYou can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. \n\n# AWS Managed Rules changelog\n\nThis section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.\n\n###### Note\n\nThis changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.\n\nFor the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at \n\nAWS Support Center\n\n. \n\n| Rule group and rules | Description | Date |\n| --- | --- | --- |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |\n| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |\n| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |\n| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |\n| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |\n| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |\n| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |\n| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | Released static version 5.0 of this rule group. Added 400+ new bots across multiple categories, including two new bot categories with their respective rules: Page Preview and Webhooks. Key Improvements Improved accuracy of bot detection signals and generic bot pattern matching, resulting in more precise traffic classification. This update changes how the managed rule group prioritizes bot detection. Specific unverified bot patterns are now evaluated before generic patterns and detection signals. This means that requests are more likely to be classified based on their most specific characteristics rather than generic indicators. What this means for your traffic: Generic bot pattern will now match less frequently. These patterns only apply when no more specific bot rule has already identified the traffic. This reduces over-classification and ensures that requests are labeled with the most accurate bot identification available. Detection signals such as indicators that a request originates from a cloud service provider, known bot data center, or uses a non-browser user agent, are now applied after bot identification rules. This ensures that specific bot classifications take precedence over generic traffic signals. Impact: You may see fewer labels for generic bot patterns in your traffic logs, as requests are now more accurately classified by specific bot rules. This provides clearer insight into the actual nature of your automated traffic and reduces noise from overly broad pattern matching. Unverified bot classifications will be more prominent and accurate, helping you better understand and manage automated requests to your applications. Note: This version includes the `awswaf:managed:aws:bot-control:bot:web_bot_auth` labels and rules updates from Version_4.0, but the `Web\n Bot Auth` functionality is still only available in CloudFront. | 2026-02-25 |\n| POSIX operating system managed rule group | Released static version 3.2 of this rule group. Improved detection signatures for all the rules. | 2026-01-15 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.25 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-08 |\n| POSIX operating system managed rule group | Released static version 3.1 of this rule group. Improved detection signatures for all the rules. | 2025-12-08 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.24 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-04 |\n| AWS WAF Bot Control rule group New labels: `awswaf:managed:aws:bot-control:bot:web_bot_auth ` `verified` – Successful verification `invalid` – Failed verification attempt `expired` –Expired key usage `unknown_bot` – Unrecognized key usage `awswaf:managed:aws:bot-control:bot:vendor<vendor_name>` – Bot vendor or operator `awswaf:managed:aws:bot-control:bot:name<rfc_name>` – Bot name (RFC token from WBA) `awswaf:managed:aws:bot-control:bot:account ` – AWS account identifier. (Amazon Bedrock Agent Core agents only) Scope: CloudFront | Deployed new static version `AWSManagedRulesBotControlRuleSet` Version_4.0 with Web Bot Authentication (WBA) support for cryptographic bot verification. This version must be explicitly selected and does not automatically update existing deployments using the default version. New capabilities: Web Bot Authentication (WBA) cryptographic verification for AI bots and agents Automatic allowlisting of verified WBA bots in Category AI rule Enhanced bot identification with vendor, name, and account labels Support for Amazon Bedrock Agent Core bot detection Rule updates: `Category AI `(Action: Block) Update to not match requests with `web_bot_auth:verified ` label. Verified WBA bots are automatically allowed `TGT_TokenAbsent` (Action: Count) Updated to not match requests with `web_bot_auth:verified` label Important Version_4.0 is a static version only – it does not change the default version behavior. To use WBA features, explicitly select Version _4.0 when configuring your web ACL. | 2025-11-20 |\n| AWS WAF Bot Control rule group New verified bot labels: Advertising: `awswaf:managed:aws:bot-control:bot:name:meta-externalads`– Meta advertising bot `awswaf:managed:aws:bot-control:bot:organization:facebook`– Meta organization AI: `awswaf:managed:aws:bot-control:bot:name:meta-webindexer`– Meta web indexer `awswaf:managed:aws:bot-control:bot:name:perplexity-user`– Perplexity user bot `awswaf:managed:aws:bot-control:bot:name:perplexitybot` – Perplexity bot `awswaf:managed:aws:bot-control:bot:name:bytespider` – Bytespider bot `awswaf:managed:aws:bot-control:bot:name:duckassistbot` – DuckDuckGo assistant bot `awswaf:managed:aws:bot-control:bot:organization:facebook` – Meta organization Content Fetcher: `awswaf:managed:aws:bot-control:bot:name:meta-externalfetcher` – Meta content fetcher `awswaf:managed:aws:bot-control:bot:organization:facebook-externalfetcher` – Meta organization Social Media: `awswaf:managed:aws:bot-control:bot:name:tiktok` – TikTok bot | Key improvements: Expanded verified bot detection across multiple categories (Advertising, AI, Content Fetcher and Social Media) Added organization-level labels for Meta, Facebook bots Enhanced AI bot detection including Perplexity, Bytespider, and DuckDuckGo bots Added TikTok social media bot detection Important Bot category rules in Bot Control trigger only on unverified bots, except for CategoryAI which also triggers on verified bots. Version_3.3 is a static version only – it doesn't change the default version behavior. | 2025-11-17 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.20 of this rule group. Improved detection signatures for the Server Side Request Forgery (SSRF) rules. | 2025-10-02 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.19 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-08-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.18 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-06-18 |\n| AWS WAF Bot Control rule group New labels: Search engine bots: `awswaf:managed:aws:bot-control:bot:name:evensi` `awswaf:managed:aws:bot-control:bot:name:yisouspider` AI bots: `awswaf:managed:aws:bot-control:bot:name:searchbot` `awswaf:managed:aws:bot-control:bot:name:nova_act` Organization labels for AI bots: `awswaf:managed:aws:bot-control:bot:organization:openai` `awswaf:managed:aws:bot-control:bot:organization:marfeel` `awswaf:managed:aws:bot-control:bot:organization:facebook` `awswaf:managed:aws:bot-control:bot:organization:metaexternalagent` `awswaf:managed:aws:bot-control:bot:organization:amazon` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:google_cloud_vertex_bot` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:alibaba` | Released static version 3.2 of this rule group. Added the listed new labels. | 2025-05-29 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.17 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-03-03 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` | Released static version 1.3 of this rule group. Added double `URL_DECODE_UNI` text transformation to the listed rules. | 2025-01-24 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.6 of this rule group. Added signatures to improve detection. | 2025-01-24 |\n| AWS WAF Bot Control rule group New bot name label in the Bot Control labels: `awswaf:managed:aws:bot-control:bot::name:nytimes` | Released static version 3.1 of this rule group. Added the New York Times label to the list of bot name labels. | 2024-11-07 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY``CrossSiteScripting_COOKIE``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_URIPATH` | Released static version 1.16 of this rule group. Improved detection signatures for the cross site scripting rules. | 2024-10-16 |\n| AWS WAF Bot Control rule group New rules: `TGT_TokenAbsent``TGT_VolumetricSessionMaximum``TGT_SignalBrowserAutomationExtension``TGT_ML_CoordinatedActivityLow`, `TGT_ML_CoordinatedActivityMedium`, and `TGT_ML_CoordinatedActivityHigh``TGT_TokenReuseIpLow`, `TGT_TokenReuseIpMedium`, and `TGT_TokenReuseIpHigh``TGT_TokenReuseAsnLow`, `TGT_TokenReuseAsnMedium`, and `TGT_TokenReuseAsnHigh``TGT_TokenReuseCountryLow`, `TGT_TokenReuseCountryMedium`, and `TGT_TokenReuseCountryHigh` Deleted rules: `TGT_TokenReuseIp`. Replaced with the corresponding new low, medium, and high rules. New labels: HTTP Library bots: `awswaf:managed:aws:bot-control:bot:name:fasthttp` AI bots: `awswaf:managed:aws:bot-control:bot:name:bedrockbot``awswaf:managed:aws:bot-control:bot:name:claudebot``awswaf:managed:aws:bot-control:bot:name:anthropic``awswaf:managed:aws:bot-control:bot:name:metaexternalagent``awswaf:managed:aws:bot-control:bot:name:bytespider``awswaf:managed:aws:bot-control:bot:name:omgili``awswaf:managed:aws:bot-control:bot:name:diffbot``awswaf:managed:aws:bot-control:bot:name:perplexitybot``awswaf:managed:aws:bot-control:bot:name:timpibot``awswaf:managed:aws:bot-control:bot:name:cohere` Search engine bots: `awswaf:managed:aws:bot-control:bot:name:naver` Advertising bots: `awswaf:managed:aws:bot-control:bot:name:naver_ads` Social media bots: `awswaf:managed:aws:bot-control:bot:name:snapchat` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:naver_preview``awswaf:managed:aws:bot-control:bot:name:censys``awswaf:managed:aws:bot-control:bot:name:imessage_preview``awswaf:managed:aws:bot-control:bot:name:imagesift` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:aws``awswaf:managed:aws:bot-control:signal:cloud_service_provider:azure``awswaf:managed:aws:bot-control:signal:cloud_service_provider:gcp``awswaf:managed:aws:bot-control:signal:cloud_service_provider:oracle``awswaf:managed:aws:bot-control:signal:cloud_service_provider:digital_ocean``awswaf:managed:aws:bot-control:signal:cloud_service_provider:akamai``awswaf:managed:aws:bot-control:signal:cloud_service_provider:cloudflare``awswaf:managed:aws:bot-control:signal:cloud_service_provider:ibm_cloud` Additional labeling in existing rules. | Released static versions 2.0 and 3.0 of this rule group. Version 2.0 is the same as version 3.0, but with rule actions for all new rules set to Count. This guide documents the latest version of each rule group. Added the listed new rules. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:bot-control: `. Added cloud service provider labels to the Bot Control signal labels. Added new bot name labels that are inspected for by bot category rules. | 2024-09-13 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:atp: `. | 2024-09-13 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:acfp: `. | 2024-09-13 |\n| Linux operating system managed rule group All rules | Released static version 2.5 of this rule group. Added signatures to improve detection. | 2024-09-02 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS``GenericLFI_URIPATH``GenericLFI_BODY` | Released static version 1.15 of this rule group. Improved detection signatures for the generic LFI rules. | 2024-08-30 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `WindowsShellCommands_COOKIE` | Released static version 2.3 of this rule group. Adjusted detection signatures in the listed rules to reduce false positives. | 2024-08-28 |\n| WordPress application managed rule group `WordPressExploitableCommands_QUERYSTRING` | Released static version 1.3 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-15 |\n| Linux operating system managed rule group `LFI_QUERYSTRING` | Released static version 2.4 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-12 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY``EC2MetaDataSSRF_QUERYARGUMENTS``GenericLFI_QUERYARGUMENTS``GenericLFI_BODY``RestrictedExtensions_QUERYARGUMENTS``GenericRFI_QUERYARGUMENTS``GenericRFI_BODY``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_BODY``CrossSiteScripting_COOKIE``CrossSiteScripting_URIPATH` | Released static version 1.14 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-09 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` | Released static version 2.1 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `PowerShellCommands_QUERYARGUMENTS` `PowerShellCommands_BODY` | Released static version 2.2 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Linux operating system managed rule group All rules | Released static version 2.3 of this rule group. Added signatures to improve detection. | 2024-06-06 |\n| AWS WAF Bot Control rule group AWS WAF Fraud Control account takeover prevention (ATP) rule group AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group | The bot and fraud rule groups are now versioned. If you're using any of these rule groups, this update doesn't change how they handle your web traffic. This update sets the current rule group version to static version 1.0 and sets the default version to point to it. For more information about versioned managed rules, see the following: Using versioned managed rule groups in AWS WAF Deployments for versioned AWS Managed Rules rule groups Getting notified of new versions and updates to a managed rule group | 2024-05-29 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` `UNIXShellCommandsVariables_QUERYSTRING` `UNIXShellCommandsVariables_HEADER` `UNIXShellCommandsVariables_BODY` | Released static version 3.0 of this rule group. Removed `UNIXShellCommandsVariables_QUERYARGUMENTS` and replaced it with `UNIXShellCommandsVariables_QUERYSTRING`. If you have rules that match on the label for `UNIXShellCommandsVariables_QUERYARGUMENTS`, when you use this version, switch them to match on the label for `UNIXShellCommandsVariables_QUERYSTRING`. The new label is `awswaf:managed:aws:posix-os:UNIXShellCommandsVariables_QueryString`. Added the rule `UNIXShellCommandsVariables_HEADER`, which matches on all headers. Updated all the rules in the managed rule group with improved detection logic. Corrected the documented capitalization of the label for `UNIXShellCommandsVariables_BODY`. | 2024-05-28 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.12 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2024-05-21 |\n| SQL database managed rule group `SQLi_BODY``SQLi_QUERYARGUMENTS``SQLiExtendedPatterns_QUERYARGUMENTS` | Released static version 1.2 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-14 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_QUERYSTRING` `Log4JRCE_QUERYSTRING` `Log4JRCE_BODY` `Log4JRCE_HEADER` | Released static version 1.22 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-08 |\n| POSIX operating system managed rule group | Released static version 2.2 of this rule group. Added the `JS_DECODE` text transformation to both rules. | 2024-05-08 |\n| Windows operating system managed rule group `PowerShellCommands_BODY` | Released static version 2.1 of this rule group. Added signatures to `PowerShellCommands_BODY` to improve detection. | 2024-05-03 |\n| Amazon IP reputation list managed rule group `AWSManagedIPReputationList` | Updated the sources of the IP reputation list, to improve identification of addresses that are actively engaging in malicious activities and to reduce false positives. This update doesn't involve a new version because this rule group isn't versioned. | 2024-03-13 |\n| Known bad inputs managed rule group | Released static version 1.21 of this rule group. Added signatures to improve detection and reduce false positives. | 2023-12-16 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Released static version 1.20 of this rule group. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests that match the Atlassian Confluence CVE-2023-22518 Improper Authorization vulnerability. This vulnerability affects all versions of Confluence Data Center and Server. For more information, see NIST: National Vulnerability Database: CVE-2023-22518 Detail. | 2023-12-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.11 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2023-12-06 |\n| AWS WAF Bot Control rule group New label: `awswaf:managed:aws:bot-control:targeted:aggregate:coordinated_activity:low` | Added the coordinated activity low label to the rule group's targeted protection level labels. This label isn't associated with any rule. This labeling is in addition to the medium and high level rules and labels. | 2023-12-05 |\n| Bot Control labels Label: `awswaf:managed:aws:bot-control:targeted:signal:browser_automation_extension` | Added a signal label to the rule group that indicates the detection of a browser extension that assists in automation. This label isn't specific to an individual rule. | 2023-11-14 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.10 of this rule group. Updated one rule to improve detection and reduce false positives. | 2023-11-02 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.9 of this rule group. Updated rules to improve detection and reduce false positives. | 2023-10-30 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` | Released static version 2.1 of this rule group. Updated the query arguments rule to improve detection. | 2023-10-12 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` | Released static version 1.8 of this rule group. Updated rules to improve detection. | 2023-10-11 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Exception deployment: released static version 1.19 of this rule group. Updated the default version to use version 1.19. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests matching the Atlassian Confluence CVE-2023-22515 Privilege Escalation Vulnerability. This vulnerability affects some versions of Atlassian Confluence. For more information, see NIST: National Vulnerability Database: CVE-2023-22515 Detail and Atlassian Support: FAQ for CVE-2023-22515. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| Known bad inputs managed rule group `Host_localhost_HEADER` `Log4J*` `JavaDeserialization*` | Exception deployment: released static version 1.18 of this rule group. This is a quick rollout of this static version to accommodate the creation and rollout of version 1.19. Updated the `Host_localhost_HEADER` rule and all Log4J and Java deserialization rules for improved detection. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| AWS WAF Bot Control rule group `TGT_TokenReuseIp` `TGT_ML_CoordinatedActivityMedium` `TGT_ML_CoordinatedActivityHigh` | Added rules to the rule group with Count action. The token reuse IP rule detects and counts token sharing across IP addresses. The coordinated activity rules use automated, machine-learning (ML) analysis of website traffic to detect bot-related activity. In your rule group configuration, you can opt out of the use of ML. With this release, customers who are currently using the targeted protection level are opted in to the use of ML. Opting out disables the coordinated activity rules. | 2023-09-06 |\n| AWS WAF Bot Control rule group `CategoryAI` | Added the rule `CategoryAI` to the rule group. | 2023-08-30 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_QUERYARGUMENTS` `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_URIPATH` | Released static version 1.7 of this rule group. Updated restricted extensions and EC2 metadata SSRF rules to improve detection and reduce false positives. | 2023-07-26 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesACFPRuleSet`. | 2023-06-13 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.2 of this rule group. Added signatures to improve detection. | 2023-05-22 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.6 of this rule group. Updated cross-site scripting (XSS) and restricted extension rules to improve detection and reduce false positives. | 2023-04-28 |\n| PHP application managed rule group Updated `PHPHighRiskMethodsVariables_BODY` Removed `PHPHighRiskMethodsVariables_QUERYARGUMENTS` Added `PHPHighRiskMethodsVariables_QUERYSTRING` Added `PHPHighRiskMethodsVariables_HEADER` | Released static version 2.0 of this rule group. Added signatures to improve detection in all rules. Replaced the rule `PHPHighRiskMethodsVariables_QUERYARGUMENTS` with `PHPHighRiskMethodsVariables_QUERYSTRING`, which inspects the entire query string instead of just the query arguments. Added the rule `PHPHighRiskMethodsVariables_HEADER`, to expand coverage to include all headers. Updated the following labels to align with standard AWS Managed Rules labeling: Old name: `PHPHighRiskMethodsVariables_BODY` New name: `PHPHighRiskMethodsVariables_Body` Old name: `PHPHighRiskMethodsVariables_QUERYARGUMENTS` New name: `PHPHighRiskMethodsVariables_QueryString` | 2023-02-27 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `VolumetricIpFailedLoginResponseHigh` `VolumetricSessionFailedLoginResponseHigh` | Added login response inspection rules for use with protected Amazon CloudFront distributions. These rules can block new login attempts from IP addresses and client sessions that have recently been the source of too many failed login attempts. | 2023-02-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.5 of this rule group. Updated Cross Site Scripting (XSS) filters to improve detection. | 2023-01-25 |\n| Linux operating system managed rule group `LFI_COOKIE` - removed `LFI_HEADER` - added `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.1 of this rule group. Removed the rule `LFI_COOKIE` and its label `awswaf:managed:aws:linux-os:LFI_Cookie`, and replaced them with the new rule `LFI_HEADER` and its label `awswaf:managed:aws:linux-os:LFI_Header`. This change expands inspection to multiple headers. Added text transformations and signatures to all rules to improve detection. | 2022-12-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.4 of this rule group. Added a text transformation to `NoUserAgent_HEADER` to remove all null bytes. Updated the filters in the cross-site scripting rules to improve detection. | 2022-12-05 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` | Released static version 1.17 of this rule group. Updated the Java deserialization rules to add detection for requests matching Apache CVE-2022-42889, a remote code execution (RCE) vulnerability in Apache Commons Text versions prior to 1.10.0. For more information, see NIST: National Vulnerability Database: CVE-2022-42889 Detail and CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults. Improved detection in `Host_localhost_HEADER`. | 2022-10-20 |\n| Known bad inputs managed rule group `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` | Released static version 1.16 of this rule group. Removed false positives that AWS identified in version 1.15. | 2022-10-05 |\n| POSIX operating system managed rule group PHP application managed rule group WordPress application managed rule group | Corrected the documented label names. | 2022-09-19 |\n| IP reputation rule groups `AWSManagedIPDDoSList` | This change doesn't alter how the rule group handles web traffic. Added a new rule with Count action to inspect for IP addresses that are actively engaging in DDoS activities, according to Amazon threat intelligence. | 2022-08-30 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` `PROPFIND_METHOD` | Released static version 1.15 of this rule group. Removed `Log4JRCE` and replaced it with `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for more granular monitoring and management of false positives. Added signatures for improved detection and blocking to `PROPFIND_METHOD` and to all `JavaDeserializationRCE*` and `Log4JRCE*` rules. Updated labels to correct capitalization in `Host_localhost_HEADER` and in all `JavaDeserializationRCE*` rules. Corrected the description of `JavaDeserializationRCE_HEADER`. | 2022-08-22 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `UnsupportedCognitoIDP` | Added a rule to prevent the use of the account takeover prevention managed rule group for Amazon Cognito user pool web traffic. | 2022-08-11 |\n| Core rule set (CRS) managed rule group | AWS has scheduled expiration for versions `Version_1.2` and `Version_2.0` of the rule group. The versions will expire on September 9, 2022. For information about version expiration, see Using versioned managed rule groups in AWS WAF. | 2022-06-09 |\n| Core rule set (CRS) managed rule group `GenericLFI_URIPATH` `GenericRFI_URIPATH` | Released version 1.3 of this rule group. This release updates the match signatures in the rules `GenericLFI_URIPATH` and `GenericRFI_URIPATH`, to improve detection. | 2022-05-24 |\n| AWS WAF Bot Control rule group `CategoryEmailClient` | Added the rule `CategoryEmailClient` to the rule group. | 2022-04-06 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URI` `JavaDeserializationRCE_QUERYSTRING` | Released version 1.14 of this rule group. The four `JavaDeserializtionRCE` rules are moved to Block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` | Released version 1.13 of this rule group. Updated the text transformation for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` `Log4JRCE` | Released version 1.12 of this rule group. Added signatures for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. Removed the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY` and replaced them with the rule `Log4JRCE`. | 2022-03-30 |\n| IP reputation rule groups `AWSManagedReconnaissanceList` | Updated the `AWSManagedReconnaissanceList` rule to change the action from count to block. | 2022-02-15 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesATPRuleSet`. | 2022-02-11 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` | Released version 1.9 of this rule group. Removed the rule `Log4JRCE` and replaced it with the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for flexibility in the use of this functionality. Added signatures to improve detection and blocking. | 2022-01-28 |\n| Core rule set (CRS) `CrossSiteScripting_URIPATH``CrossSiteScripting_BODY``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_COOKIE` | Released version 2.0 of this rule group. For these rules, tuned detection signatures to reduce false positives. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation. Added the `HTML_ENTITY_DECODE` text transformation. | 2022-01-10 |\n| Core rule set (CRS) `RestrictedExtensions_URIPATH``RestrictedExtensions_QUERYARGUMENTS` | As part of the release of version 2.0 of this rule group, added the `URL_DECODE_UNI` text transformation. Removed the `URL_DECODE` text transformation from `RestrictedExtensions_URIPATH`. | 2022-01-10 |\n| SQL database `SQLi_BODY``SQLi_QUERYARGUMENTS``SQLi_COOKIE``SQLi_URIPATH``SQLiExtendedPatterns_BODY``SQLiExtendedPatterns_QUERYARGUMENTS` | Released version 2.0 of this rule group. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation and added the `COMPRESS_WHITE_SPACE` text transformation. Added more detection signatures to `SQLiExtendedPatterns_QUERYARGUMENTS`. Added JSON inspection to `SQLi_BODY`. Added the rule `SQLiExtendedPatte","published_at":null,"relation":"advisory","confidence":null,"note":"AWS disclosure page"},{"id":2405,"url":"https://x.com/calif_io/status/2113578130543882697","title":"@calif_io: Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a ","kind":"post","source":"x","text":"Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a much needed feature, inspired by the php2shell hacker @lcfr_hax!\n\nWhat else there to hack? Wrong answers only. https://t.co/ktYFhrH7lC\n\nlikes 757 reposts 61","published_at":"2026-10-23T10:27:49+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2411,"url":"https://x.com/calif_io/status/2112919199437770878","title":"@calif_io: Do you know who illustrated the comic on https://t.co/KEUVez9rnN?\n\nHer name is S","kind":"post","source":"x","text":"Do you know who illustrated the comic on https://t.co/KEUVez9rnN?\n\nHer name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.\n\nThis artist-hacker couple has the best story, stay tuned!\n\nlikes 1164 reposts 140","published_at":"2026-10-21T14:49:27+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2412,"url":"https://x.com/calif_io/status/2112914613297668583","title":"@calif_io: Let’s set the record straight: @lcfr_hax was the first to discover php2shell and","kind":"post","source":"x","text":"Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/mE27XnmJlM\n\nHis work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review,\n\nlikes 3071 reposts 404","published_at":"2026-10-21T14:31:14+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2419,"url":"https://x.com/gdb/status/2112921529650688312","title":"@gdb: Over the past two months, we have been leading a coalition to mitigate one of th","kind":"post","source":"x","text":"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative. https://t.co/rBsz7lrlwo\n\nlikes 3611 reposts 332","published_at":"2026-10-21T14:58:43+00:00","relation":"discussion","confidence":null,"note":"@gdb"},{"id":2435,"url":"https://x.com/wiz_io/status/2112921894647156772","title":"@wiz_io: AI tools helped find one of the most severe online bugs ever #php2shell \n\nIn our","kind":"post","source":"x","text":"AI tools helped find one of the most severe online bugs ever #php2shell \n\nIn our latest episode of Crying Out Cloud, Amitai Cohen sits down with @sagitz_ (Wiz Research) and Thai Duong (@calif_io) to unpack the massive PHP2Shell vulnerability\n\nhttps://t.co/n4pfiXjDNC\n\nlikes 53 reposts 15","published_at":"2026-10-21T15:00:10+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2437,"url":"https://x.com/wiz_io/status/2112899825305780607","title":"@wiz_io: PHP2Shell marks an inflection point: AI changes the practical exploitability of ","kind":"post","source":"x","text":"PHP2Shell marks an inflection point: AI changes the practical exploitability of longstanding vulnerabilities. Frontier models (Wiz Atlas, GPT-5.6-Sol, and Gemini 4 Argon) were used to hunt down and chain these 10-year-old flaws in under a week, with Gemini 4 making a particularly\n\nlikes 14 reposts 4","published_at":"2026-10-21T13:32:28+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2441,"url":"https://x.com/wiz_io/status/2112899813264277528","title":"@wiz_io: 🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerab","kind":"post","source":"x","text":"🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. https://t.co/B7yEQuhnoS\n\nlikes 428 reposts 121","published_at":"2026-10-21T13:32:25+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2444,"url":"https://x.com/xbow/status/2113327462629220580","title":"@xbow: PHP2Shell just showed us how quickly defenders need to act. What should they be ","kind":"post","source":"x","text":"PHP2Shell just showed us how quickly defenders need to act. What should they be most worried about? 🫨\n\nlikes 5 reposts 0","published_at":"2026-10-22T17:51:45+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":2445,"url":"https://x.com/xbow/status/2113003403940929926","title":"@xbow: PHP2Shell: just another critical vulnerability but on a much faster clock...\n\nAI","kind":"post","source":"x","text":"PHP2Shell: just another critical vulnerability but on a much faster clock...\n\nAI didn’t make PHP vulnerable. It changed the economics of finding and exploiting the bugs already there.\n\n@fede_k breaks down what happened and the shrinking window for defenders:\n\nlikes 44 reposts 6","published_at":"2026-10-21T20:24:03+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":2760,"url":"https://x.com/CISAgov/status/2113984287481716741","title":"@CISAgov: Update to #PHP2Shell Alert:  SIGMA rule helps identify potentially suspicious ac","kind":"post","source":"x","text":"Update to #PHP2Shell Alert:  SIGMA rule helps identify potentially suspicious activity &amp; incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated. https://t.co/r1GlMILxXU\n\nlikes 0 reposts 1","published_at":"2026-10-24T13:21:44+00:00","relation":"discussion","confidence":null,"note":"@CISAgov"},{"id":2834,"url":"https://x.com/CloudflareDev/status/2113004792880693280","title":"@CloudflareDev: ⚠️ Vulnerability alert: php2shell\n\nUnpatched sites running PHP 5.4 or later are ","kind":"post","source":"x","text":"⚠️ Vulnerability alert: php2shell\n\nUnpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.\n\nIf your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post https://t.co/3xLjlkUX8u\n\nlikes 4203 reposts 485","published_at":"2026-10-21T20:29:35+00:00","relation":"discussion","confidence":null,"note":"@CloudflareDev"},{"id":2889,"url":"https://www.akamai.com/blog/security-research/2026/oct/beyond-day-zero-akamai-rapid-response-ai-threat-intelligence","title":"Akamai: Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence","kind":"advisory","source":"lab","text":"Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence \n\n# Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence \n\n October 22, 2026 by Akamai Security Intelligence Group \n\nWhen critical vulnerabilities emerge, protecting applications requires more than a fast response. It demands early intelligence, precision, continuous adaptation, and customer trust.\n\nOn October 21, 2026, two critical PHP remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — were publicly disclosed, creating an urgent need for organizations to protect their applications.\n\nAt Akamai, our response began before the disclosure and reflects a broader evolution in how we approach vulnerability intelligence and protection.\n\n## Prepared before the disclosure \n\nOur threat research team worked directly with the vulnerability reporter ahead of public disclosure to analyze exploit details and develop targeted protections while honoring the industry's coordinated disclosure embargo.\n\nBy 10:00 AM ET, when the vulnerabilities became public, Akamai had deployed Rapid Rule 3000991 across 100% of its network in Alert mode. Existing command injection protections also provided an additional layer of defense against identified attack payloads.\n\nBut deploying detection is only half the challenge. At global scale, accuracy matters just as much as speed.\n\nOur teams continuously evaluated rule triggers, identified false positives, and refined detection logic before transitioning to active enforcement.\n\n- 10:00 AM ET: Detection active globally\n- 12:40 PM ET: Updated detection logic deployed to improve accuracy\n- 1:36 PM ET: Akamai-managed action switched to deny, enabling active blocking\n- 5:45 PM ET: Additional accuracy refinements completed\n\nIn less than four hours, we moved from globally deployed detection to active enforcement, balancing rapid protection with application availability.\n\n## The engineering behind the speed: Real-time telemetry and rapid action switching \n\nMoving from initial detection to blocking across a global edge requires an architecture engineered for both velocity and zero platform disruption, including:\n\n- Closed-loop safety and monitoring\n- Near–real-time trigger telemetry\n- Switching managed actions in minutes\n\n### Closed-loop safety and monitoring \n\nWhen deploying rapid emergency protections, Akamai’s release engineering, QA, and web application firewall (WAF) threat research teams operate in continuous lockstep, running automated and human-in-the-loop checks across the massive global network to ensure platform stability never comes at the expense of speed. \n\nThis is powered by a three-phase deployment of these updated protections with gradually increasing network coverage and a baked-in monitoring period to observe continued platform stability and performance.\n\n### Near–real-time trigger telemetry \n\nAs Rapid Rule 3000991 deployed across our distributed network, our telemetry pipelines provided near–real-time visibility into global traffic triggers and rule matches. This feedback loop allowed our threat research teams to immediately observe payload interactions with live traffic patterns across all unique application and API implementations, identify edge cases, and deploy refined detection logic.\n\n### Switching managed actions in minutes \n\nBy employing our recently released rapid action change capability, our teams were able to flip the global default action to mitigate exploitation attempts within minutes once the moment confidence thresholds are met. All while customers continue to have the ability to define their own granular customizations per their business and application needs.\n\n## Beyond initial triage: Bringing agentic AI into vulnerability intelligence \n\nOne of the challenges facing security teams is that vulnerability intelligence is constantly evolving. New proof-of-concept (PoC) exploits can emerge days or weeks after a CVE is initially assessed.\n\nA vulnerability with no known exploit today may have one tomorrow.\n\nAt Akamai, we gather advanced vulnerability intelligence by deploying agentic AI to automate end-to-end CVE triage and continuously hunt threats.\n\nOur AI agents are always operating, ingesting and triaging CVE inquiries, gathering intelligence from disjointed sources, hunting down emerging attack variants, and automatically validating them against our existing protection rules (Figure).\n\n Zoom image \n\nContinuous agentic CVE intelligence, guided by human expertise\n\n Close popover \n\nCrucially, our security researchers remain in full control. By uniting autonomous AI execution with expert human oversight, we remove manual investigative drag and allow our research team to scale massively. Our experts focus their deep domain expertise on what matters most, enabling us to deliver faster, higher-quality, continuous protection to our customers before threats evolve.\n\n## Customer confidence is part of the response \n\nDuring a critical security event, customers need more than technical mitigations. They need transparency, timely guidance, and the confidence that their security partner is actively managing the situation.\n\nThroughout the PHP vulnerability response, our teams proactively communicated updates and mitigation guidance.\n\nA large financial services company specifically recognized the team's proactive communication and smooth execution, noting that they did not need to repeatedly request updates because we were already regularly sharing information with them.\n\nAnother security leader at a major global enterprise shared that they were championing the phrase “Thank goodness Akamai WAF is protecting us” across their leadership teams. Beyond the rapid mitigation, the security leader specifically appreciated our intuitive rule naming, noting that clearly citing the target CVEs directly in the rule description gave them immediate clarity by eliminating the confusion often caused by cryptic identifiers.\n\n## Building toward continuous, adaptive security \n\nThe PHP vulnerability response demonstrates what is possible when early threat intelligence, globally distributed protections, rapid enforcement, and proactive customer engagement work together.\n\nOur continued investment in AI-assisted vulnerability intelligence takes this approach further by helping researchers discover emerging exploit evidence, accelerate assessments, and continuously revisit potential risks.\n\nWAF protections are an important layer of defense while organizations apply vendor patches, which remain essential.\n\nFor customers, our direction is clear: faster access to protections, greater precision, reduced operational burden, and security intelligence that doesn't stop at disclosure.\n\nBecause effective security isn't just about responding to yesterday's threats. It's about continuously preparing for what comes next.\n\nFor additional technical details, read our security research advisory.\n\nAkamai SIG is a global team of world-class researchers, engineers, strategists, and data scientists with a broad range of expertise and security disciplines. Our data sources include the enormous Akamai Cloud, open sources, collaboration with third parties, and dark web intelligence. We have also developed our own algorithms and tools that help us deliver our research and keep Akamai security solutions up to date.","published_at":"2026-10-22T08:00:00+00:00","relation":"advisory","confidence":null,"note":"Akamai disclosure page"},{"id":2890,"url":"https://www.akamai.com/blog/security-research/2026/oct/critical-remote-code-execution-vulnerabilities-php-core","title":"Akamai: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai","kind":"advisory","source":"lab","text":"Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai\n\n# Critical Remote Code Execution Vulnerabilities in PHP Core \n\n October 21, 2026 by Akamai Security Intelligence Group \n\nOn October 21, 2026, PHP released a security advisory remedying two severe security flaws, each carrying a CVSS v4.0 rating of 9.2.\n\nThe patches are available immediately and users are urged to upgrade to fixed releases as soon as possible. \n\n## Mitigation with Akamai App & API Protector \n\nAkamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts. \n\n- Adaptive Security Engine: 3000991 v1 — PHP Remote Code Execution Attack Detected (CVE-2026-109618, CVE-2026-109619)\n\nBased on our investigation, Akamai App & API Protector is mitigating weaponized payloads with existing command injection rules. \n\nThe most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules is critical to block attack attempts.\n\n## Stay tuned \n\nThe Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.","published_at":"2026-10-21T13:00:00+00:00","relation":"advisory","confidence":null,"note":"Akamai disclosure page"},{"id":2900,"url":"https://github.com/devzyai/CVE-2026-109618-POC","title":"devzyai/CVE-2026-109618-POC","kind":"poc","source":"github","text":"A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.\n\nstars 0","published_at":"2026-10-24T18:44:44+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2934,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","title":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","kind":"advisory","source":"lab","text":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n### PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n| This is an ongoing issue. Information is subject to change. Please refer to this bulletin for the most updated patching information. |\n| --- |\n\nBulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT\n\nSummary:\n\nTwo critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.\n\nAWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.\n\nAffected versions:\n\n- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12\n- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27\n- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36\n- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35\n- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.\n\nImpact:\n\nThis issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.\n\nCurrent Mitigation Status:\n\n- Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring. \n- Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required. \n- AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2. \n- AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions. \n- Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. \n- Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.\n\nMitigation Guidance:\n\n- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. \n- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. \n- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches. \n- Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.\n\nReferences:\n\n- CVE-2026-109618\n- CVE-2026-109619\n- GHSA-w8hw-w9fx-j79w\n- GHSA-6wmf-4rv5-p3rp\n- https://www.php.net/archive/2026.php#2026-10-21-5\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":"AWS disclosure page"},{"id":2954,"url":"https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch","title":"akamor2800/php-5.4-cve-2026-php2shell-patch","kind":"poc","source":"github","text":"Patch for old php 5.4.23 version from CVE-2026-109618 и CVE-2026-109619 vulnerabilities\n\nstars 0","published_at":"2026-10-24T19:32:31+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3023,"url":"https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-","title":"mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-","kind":"poc","source":"github","text":"MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.\n\nstars 0","published_at":"2026-10-24T23:43:55+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3418,"url":"https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","title":"GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-25T03:51:20+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3462,"url":"https://github.com/mefulton/CVE-2026-109618-php56-public","title":"mefulton/CVE-2026-109618-php56-public","kind":"poc","source":"github","text":"Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619\n\nstars 0","published_at":"2026-10-25T09:51:35+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3475,"url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-","title":"delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-25T11:18:45+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3480,"url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","title":"delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-25T11:48:32+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3486,"url":"https://github.com/catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free","title":"catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free","kind":"poc","source":"github","text":"php:7.4-fpm-CVE-2026-109618-109619-free\n\nstars 0","published_at":"2026-10-25T12:38:45+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}