--- id: "CVE-2026-123039" page: "https://infrastack.ai/live/CVE-2026-123039" kind: "vulnerability" aliases: ["CVE-2026-123039"] title: "Check Point Gaia OS: DynamicCLI privilege escalation to root, used in attacks on Check Point gateways" severity: "high" cvss: 7.8 epss: null exploited: true status: "open" category: "infrastructure" products: [] ecosystems: [] tags: ["check-point", "exploited", "firewall", "gaia-os", "infrastructure", "linux", "mobile-access", "privilege-escalation", "security-gateway"] not_affected_if: ["no-local-untrusted-users", "non-gaia-platform"] published_at: "2026-11-12T14:17:24+00:00" first_seen_at: "2026-11-12T14:38:37+00:00" updated_at: "2026-11-12T14:44:56+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123039", "first_seen_at": "2026-11-12T14:38:37+00:00"}, {"source": "analyst", "url": "https://support.checkpoint.com/results/sk/sk1000302", "first_seen_at": "2026-11-12T14:41:28+00:00", "cites": ["https://support.checkpoint.com/results/sk/sk1000302", "https://access.redhat.com/security/vulnerabilities/RHSB-2026-013", "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/", "https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers", "https://previdian.com/php2shell-activity-across-previdian-network"]}] exploit_sources: [{"type": "poc", "url": "https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch"}, {"type": "poc", "url": "https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC"}, {"type": "poc", "url": "https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-"}, {"type": "poc", "url": "https://github.com/dev-maple/php2shell-CVE-2026-109619"}, {"type": "poc", "url": "https://github.com/devzyai/CVE-2026-109618-POC"}, {"type": "poc", "url": "https://github.com/emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC"}, {"type": "poc", "url": "https://github.com/emirwtz/CVE-2026-109618"}, {"type": "poc", "url": "https://github.com/fahise/cve-2026-109618-cve-2026-109619-poc"}, {"type": "poc", "url": "https://github.com/gagaltotal/CVE-2026-109618-109619-php2shell"}, {"type": "poc", "url": "https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619"}, {"type": "poc", "url": "https://github.com/hack-ita/php2shell-cve-2026-109618-109619"}, {"type": "poc", "url": "https://github.com/Hika-sec/php2shell-CVE-2026-109619"}, {"type": "poc", "url": "https://github.com/hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC"}, {"type": "poc", "url": "https://github.com/IamLucif3r/CVE-2026-109618-exploit"}, {"type": "poc", "url": "https://github.com/jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP"}, {"type": "poc", "url": "https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619"}, {"type": "poc", "url": "https://github.com/lflare/php2shell-cve-2026-109618"}, {"type": "poc", "url": "https://github.com/lflare/php2shell-cve-2026-109618-109619"}, {"type": "poc", "url": "https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-"}, {"type": "poc", "url": "https://github.com/Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560-"}] --- # PHP2Shell: Check Point Gaia OS DynamicCLI privilege escalation to root, used in attacks on Check Point gateways Link for people: https://infrastack.ai/live/CVE-2026-123039 (this .md is for agents) Check Point Research (12 Nov 2026) reports that from 30 Oct 2026 an attacker used PHP2Shell (CVE-2026-109618/109619) on Mobile Access portals of unpatched Check Point Security Gateways for initial access, then escalated from the portal service account to root through CVE-2026-123039, a local privilege escalation in the Gaia DynamicCLI IPC interface. After that they placed PHP webshells, the TSGA backdoor and TSProxy, and in the first wave (Israeli organizations) moved to a VMware ESXi host and ran a wiper. A second wave on 2 Nov targeted organizations in several countries, with no destructive activity seen. Check Point has not published its own advisory for this CVE that I could find; affected builds and a fixed build for CVE-2026-123039 are unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check Version range for CVE-2026-123039 is unknown (no Check Point advisory found). Treat gateways as exposed if they run Gaia and are not on the PHP2Shell hotfix in sk1000302. Hunt for compromise per Check Point Research: PHP session files containing upload_progress_pwn under /opt/CPcvpn-R81.20/tmp/; webshells named zz*.tpl and challenge_render.tpl in the Mobile Access templates directory; /tmp/.up.tpl; /tmp/CPconfigdaemon or slot_CPconfigdaemon; /lib/libcpfwcommon.so; TCP 11072 and /tmp/.p_sock; connections to 130.94.19.204 and 130.94.19.168; many Apache/PHP segfaults in the portal. ## Timeline - 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123039 - 2026-11-12T14:41:28+00:00 analyst https://support.checkpoint.com/results/sk/sk1000302 — Exploitation from Check Point Research post (vendor's own research, linked). No vendor advisory/sk for CVE-2026-123039, no NVD content retrievable, so fix, affected versions and mitigations left unknown and nothing marked verified. Immediate step is sk1000302 PHP hotfix to cut the initial access. Consider tier A: exploited and named, but local-only. X/social search not run. ## Documents - [advisory] PHP2Shell Exploitation on Check Point Gateway - Check Point Research https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/ - [advisory] Cloudflare: Introducing full transaction detection for Cloudflare WAF | Cloudflare Blog https://blog.cloudflare.com/full-transaction-waf/ - [advisory] Akamai: Inside Node2Shell: A Closer Look at CVE-2026-111497 | Akamai https://www.akamai.com/blog/security-research/2026/oct/inside-node2shell-closer-look-cve-2026-111497 - [advisory] Third-party advisory: php2shell.delftintellab.com https://php2shell.delftintellab.com - [advisory] AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html - [advisory] Cloudflare: Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities | Cloudflare Blog https://blog.cloudflare.com/zero-wire/ - [advisory] OpenAI: Cogent and OpenAI build cyber defense factories for enterprises | OpenAI https://openai.com/index/cogent-security - [advisory] Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ - [discussion] @rauchg: It was inspiring to watch the behind-the-scenes¹ of the industry coming together https://x.com/rauchg/status/2112989629536440400 - [discussion] @troyhunt: Have we seen any documented breaches / exploitation traced back to either PHP2Sh https://x.com/troyhunt/status/2113364817037975914 - [discussion] @vxunderground: Lots of arguments online surrounding who truly discovered PHP2Shell, who gets th https://x.com/vxunderground/status/2113540887380963480 - [discussion] @vxunderground: Today silly shenanigans: - PHP2shell, leak, bad stuff - Something about Railway? https://x.com/vxunderground/status/2113086117927178490 - [discussion] @craiu: A new IP seen trying to exploit #PHP2shell - 85.11.167[.]243 https://x.com/craiu/status/2113579352470479184 - [discussion] @craiu: Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status https://x.com/craiu/status/2112924512471953730 - [discussion] @rez0__: My non-hacking buddy asked me how much the person who found the php2shell made. https://x.com/rez0__/status/2113262565983973773 - [discussion] @sans_isc: (Reliable)? php2shell exploitability https://t.co/D8svpFnNqg https://t.co/cvK5zi https://x.com/sans_isc/status/2113723736214180323 - [discussion] @sans_isc: SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal https://x.com/sans_isc/status/2113577565160182077 - [discussion] @watchtowrcyber: Watch now: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts ar https://x.com/watchtowrcyber/status/2113585201880113451 - [discussion] @watchtowrcyber: Congratulations to the team at @calif_io (specifically @lcfr_hax) for the disco https://x.com/watchtowrcyber/status/2112923764270768398 - [discussion] A small audit script and config notes for the new PHP CVEs https://news.ycombinator.com/item?id=50210997 - [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50203437 - [discussion] Why governments pulled websites offline over the decades-old PHP language https://news.ycombinator.com/item?id=50199203 - [discussion] Re: Hours later – No, there is an easy way to exploit this vulnerability https://news.ycombinator.com/item?id=50195017 - [discussion] PHP2Shell: Critical PHP Vulnerabilities, What to Do About Them https://news.ycombinator.com/item?id=50194701 - [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50188558 - [discussion] Your Sites Are Protected Against the PHP2Shell Vulnerabilities https://news.ycombinator.com/item?id=50183570 - [discussion] PHP2Shell: Critical PHP RCE Vulnerabilities Explained https://news.ycombinator.com/item?id=50182037 - [discussion] Cloudflare deploys protections against php2shell vulnerability https://news.ycombinator.com/item?id=50181326 - [discussion] A tale of two PHP remote vulnerabilities https://news.ycombinator.com/item?id=50181037 - [discussion] Simple Proxy to secure your PHP from PHP2Shell vulnerability https://news.ycombinator.com/item?id=50180810 - [discussion] PHP2Shell: Critical Vulnerabilities in PHP https://news.ycombinator.com/item?id=50178312 - [discussion] PHP2Shell https://news.ycombinator.com/item?id=50175425 - [discussion] PHP2Shell (CVE-2026-109618) Exploit https://news.ycombinator.com/item?id=50204912 - [discussion] PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive https://news.ycombinator.com/item?id=50204453 - [discussion] Php2shell is not exploitable in real production enviroment https://news.ycombinator.com/item?id=50199595 - [discussion] Amazon says PHP2Shell exploitation began 4 days before patches https://news.ycombinator.com/item?id=50195054 - [discussion] Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://news.ycombinator.com/item?id=50194070 - [discussion] @doublepulsar.com: PHP2Shell thread: cyberplace.social/@GossiTheDog... https://bsky.app/profile/doublepulsar.com/post/3myjwllyrt226 - [discussion] @calif_io: Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a https://x.com/calif_io/status/2113578130543882697 - [discussion] @calif_io: Do you know who illustrated the comic on https://t.co/KEUVez9rnN? Her name is S https://x.com/calif_io/status/2112919199437770878 - [discussion] @calif_io: Let’s set the record straight: @lcfr_hax was the first to discover php2shell and https://x.com/calif_io/status/2112914613297668583 - [discussion] @gdb: Over the past two months, we have been leading a coalition to mitigate one of th https://x.com/gdb/status/2112921529650688312 - [discussion] @wiz_io: AI tools helped find one of the most severe online bugs ever #php2shell In our https://x.com/wiz_io/status/2112921894647156772 - [discussion] @wiz_io: PHP2Shell marks an inflection point: AI changes the practical exploitability of https://x.com/wiz_io/status/2112899825305780607 - [discussion] @wiz_io: 🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerab https://x.com/wiz_io/status/2112899813264277528 - [discussion] @xbow: PHP2Shell just showed us how quickly defenders need to act. What should they be https://x.com/xbow/status/2113327462629220580 - [discussion] @xbow: PHP2Shell: just another critical vulnerability but on a much faster clock... AI https://x.com/xbow/status/2113003403940929926 - [discussion] @campuscodi.risky.biz: -Supply chain attack lets ransomware group inside 40+ shipping companies -Pentag https://bsky.app/profile/campuscodi.risky.biz/post/3myjwkqr4bc2q - [discussion] @Cloudflare: Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Produc https://x.com/Cloudflare/status/2120100408722878918 - [discussion] @campuscodi.risky.biz: Check Point says hackers are exploiting PHP2Shell to take over its security gate https://bsky.app/profile/campuscodi.risky.biz/post/3n24ntnb5ys2t - [discussion] @AikidoSecurity: It's been a brutal few weeks, from the Binance breach to PHP2Shell. Attackers mo https://x.com/AikidoSecurity/status/2120527368699695466 - [discussion] @SocketSecurity: Good news, everyone! PHP2Shell exploits are a massive fail (so far) 🤞 https://t https://x.com/SocketSecurity/status/2113696934372245885 - [discussion] @TheHackersNews: The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on Oc https://x.com/TheHackersNews/status/2113602912530444768 - [discussion] @clintgibler: 📚tl;dr sec 351 😈 PHP2Shell, 🧑🏻‍💻 Autopatching Skills, 🤖 AWS Pathrunner https https://x.com/clintgibler/status/2113718227817881675 - [discussion] @eastdakota: Some stats on #php2shell. In the 10 hours before it was publicly announced, acro https://x.com/eastdakota/status/2113079352682570051 - [discussion] @trailofbits: Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpB https://x.com/trailofbits/status/2114839775173906751 - [discussion] The $2k php2shell Challenge Was Unexploitable [video] https://news.ycombinator.com/item?id=50252886 - [discussion] @TheHackersNews: 🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploi https://x.com/TheHackersNews/status/2114940324204474707 - [discussion] @MalwareTechBlog: This is by far the highest quality confirmation of in-the-wild php2shell exploit https://x.com/MalwareTechBlog/status/2114094868603797841 - [discussion] @MalwareTechBlog: Seeing some anecdotal reports of successful php2shell exploitation in the wild, https://x.com/MalwareTechBlog/status/2114077217261334609 - [discussion] @MalwareTechBlog: I want to caveat this since based on some comments, people are interpreting it i https://x.com/MalwareTechBlog/status/2113668971614593477 - [discussion] @BleepinComputer: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the P https://x.com/BleepinComputer/status/2114995847075168621 - [discussion] PHP2Shell on CISA KEV: patch by Oct 29, check for a break-in first https://news.ycombinator.com/item?id=50258183 - [discussion] @calif_io: Calif researchers are at Unprompted, presenting zero-click attacks and php2shell https://x.com/calif_io/status/2115066050899529810 - [discussion] Wiz: No successful PHP2Shell exploits seen so far; exposure down 67% https://news.ycombinator.com/item?id=50259343 - [discussion] Kevin Beaumont: Citrix finally released Netscaler patches for PHP2Shell. Netscaler notably has n https://cyberplace.social/@GossiTheDog/117513147042829138 - [discussion] @AikidoSecurity: So how to patch PHP2Shell with free Aikido Images? PHP shipped fixes on October https://x.com/AikidoSecurity/status/2115100204101935212 - [discussion] @ReversingLabs: When PHP2Shell drops, the million-dollar question is whether it’s already inside https://x.com/ReversingLabs/status/2115101009085161774 - [discussion] @clintgibler: My @OpenAI colleagues and I recently wrote about our experience with PHP2Shell a https://x.com/clintgibler/status/2115115573600514394 - [discussion] @xbow: With all the chaos around PHP2Shell, what can defenders do right now? A thread🧵 https://x.com/xbow/status/2115194599933448571 - [discussion] @xbow: 2/ XBOW has rolled PHP2Shell validation into new assessments, safely testing whe https://x.com/xbow/status/2115194602751689147 - [discussion] @troyhunt.com: Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra https://bsky.app/profile/troyhunt.com/post/3myvfmnlqsn2q - [discussion] Kevin Beaumont: Palo-Alto just sent out a customer alert about PHP2Shell: “We are aware of heigh https://cyberplace.social/@GossiTheDog/117515798886610105 - [discussion] @clintgibler: What does PHP2Shell mean for your security team - and what should you do next? https://x.com/clintgibler/status/2115136037181857897 - [discussion] @AikidoSecurity: Last week, PHP2Shell went from leak to active exploitation in a couple of hours. https://x.com/AikidoSecurity/status/2115413408598356455 - [discussion] @BleepinComputer: ⚠️ Exploiting PHP2Shell may give attackers access to more than a server. Stolen https://x.com/BleepinComputer/status/2115445983748509776 - [discussion] @ReversingLabs: PHP2Shell: What's Hiding in Your Third-Party Software? https://t.co/74GYZcHwPE https://x.com/ReversingLabs/status/2115473748132557282 - [discussion] @TheHackersNews: 🚨 PHP2Shell exploited in real-world attacks. An attacker chained PHP2Shell with https://x.com/TheHackersNews/status/2115475223931982303 - [discussion] @MsftSecIntel: Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers https://t.co/h6 https://x.com/MsftSecIntel/status/2116302850934362284 - [discussion] @GreyNoiseIO: GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-10961 https://x.com/GreyNoiseIO/status/2115516134946676921 - [discussion] @TheHackersNews: 🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in inter https://x.com/TheHackersNews/status/2115683831089144149 - [discussion] r/netsec: PHP2Shell Activity Across Previdian Network https://www.reddit.com/r/netsec/comments/1xigwsr/php2shell_activity_across_previdian_network/ - [discussion] Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers https://news.ycombinator.com/item?id=50286987 - [discussion] @_r_netsec: PHP2Shell Activity Across Previdian Network https://t.co/SpWZQYmqr7 https://x.com/_r_netsec/status/2115768949958979651 - [discussion] Kevin Beaumont: RE: https:// cyberplace.social/@GossiTheDog /117515798886610105 I’m aware of a r https://cyberplace.social/@GossiTheDog/117524203610758833 - [discussion] PHP2Shell Exposure Tracker https://news.ycombinator.com/item?id=50288326 - [discussion] @BleepinComputer: CISA ordered US federal agencies to patch a high-severity Linux kernel privilege https://x.com/BleepinComputer/status/2115805892213932089 - [discussion] @campuscodi.risky.biz: WordPress security firm Wordfence says it has not discovered any WordPress site https://bsky.app/profile/campuscodi.risky.biz/post/3mz2373ldk22k - [discussion] r/netsec: php2bitcoin x brotli2coin: live hacking stream https://www.reddit.com/r/netsec/comments/1xj4co1/php2bitcoin_x_brotli2coin_live_hacking_stream/ - [discussion] @calif_io: Our own @brucedang and @XorNinja went on the Bloomberg Odd Lots podcast to discu https://x.com/calif_io/status/2116250184531448164 - [discussion] @AikidoSecurity: It's been a tough week or so for security and dev teams. You're not alone. PHP2 https://x.com/AikidoSecurity/status/2116126851001430467 - [discussion] Kevin Beaumont: PHP2Shell activity from real world exploitation incidents: https:// hunt.io/blog https://cyberplace.social/@GossiTheDog/117531244098459428 - [discussion] @xbow: Hear from @_remot3 -- who led the building of the #php2shell exploit for XBOW -- https://x.com/xbow/status/2118087610455453819 - [discussion] @AikidoSecurity: From the Binance breach to PHP2Shell, this year has been a wild ride for cyberse https://x.com/AikidoSecurity/status/2118299133173723241 - [discussion] The PHP2Shell Vulnerability Heralds Cybersecurity Hell https://news.ycombinator.com/item?id=50351735 - [discussion] @ReversingLabs: Leaked details gave PHP2Shell attackers a head start while most defenders were s https://x.com/ReversingLabs/status/2117279013328556362 - [discussion] AI is forcing us to pay off 40 years of technical debt https://news.ycombinator.com/item?id=50364336 - [discussion] @MsftSecIntel: Amid conflicting reports about PHP2Shell, understanding exposure and conditions https://x.com/MsftSecIntel/status/2118461473068384633 - [discussion] @Cloudflare: Join Grant Bourzikas, Cloudflare’s CISO, and Daniele Molteni, Director of Produc https://x.com/Cloudflare/status/2118694645538460046 - [discussion] r/netsec: I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit. https://www.reddit.com/r/netsec/comments/1xqlw37/i_spent_countless_nights_digging_into_php2shell/ - [discussion] @CISAgov: Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious ac https://x.com/CISAgov/status/2113984287481716741 - [discussion] @CloudflareDev: ⚠️ Vulnerability alert: php2shell Unpatched sites running PHP 5.4 or later are https://x.com/CloudflareDev/status/2113004792880693280 - [discussion] An animated explainer of the PHP2SHell vulnerability [video] https://news.ycombinator.com/item?id=50226729 - [discussion] PHP2Shell exploitation observed: packet-to-process RCE evidence https://news.ycombinator.com/item?id=50226578 - [discussion] @cyb3rops: Interesting finding from my colleagues for anyone following #PHP2SHELL activity https://x.com/cyb3rops/status/2115163095182213529 - [discussion] @gdb: learn about php2shell and the general emerging security landscape: https://t.co/ https://x.com/gdb/status/2115270653452648605 - [discussion] @wiz_io: Wiz research has been monitoring PHP2Shell exploitation attempts, but none have https://x.com/wiz_io/status/2115383034484519005 - [discussion] Will Dormann: Dream Group on php2shell exploitation of a firewall vendor's management interfac https://infosec.exchange/@wdormann/117516475398490631 - [discussion] Show HN: Self-diagnosis of vulnerabilities such as PHP2Shell via IP/Domain https://news.ycombinator.com/item?id=50270348 - [discussion] @troyhunt: Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra https://x.com/troyhunt/status/2115225601506214122 - [discussion] @TalosSecurity: From discussing PHP2Shell to putting David Bianco, Pyramid of Pain creator, to w https://x.com/TalosSecurity/status/2115429627086733661 - [discussion] @TheHackersNews: 🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European gov https://x.com/TheHackersNews/status/2114407239578710111 - [discussion] Palo Alto retracts claim of PHP2Shell exploitation at European government agency https://news.ycombinator.com/item?id=50236839 - [discussion] @sans_isc: SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.j https://x.com/sans_isc/status/2114560289186476291 - [discussion] @TheHackersNews: UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking https://x.com/TheHackersNews/status/2114577372838305911 - [discussion] I've created a full-chain exploit for PHP2Shell https://news.ycombinator.com/item?id=50240988 - [discussion] @BleepinComputer: PHP2Shell security flaws now sucessfully exploited in the wild https://t.co/TBgG https://x.com/BleepinComputer/status/2114648291929387445 - [discussion] @TheHackersNews: ‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes. Thi https://x.com/TheHackersNews/status/2114776245418545473 - [discussion] @TheHackersNews: 🚨 UPDATE: PHP2Shell exploitation confirmed in the wild. Perplexity researcher A https://x.com/TheHackersNews/status/2114778998408618294 - [discussion] @_JohnHammond: i have joined the "got my robot to recreate php2shell exploit" cool kids club i https://x.com/_JohnHammond/status/2113527632784773300 - [discussion] @rapid7: Your team needs to make decisions about PHP2Shell. Conflicting advice makes that https://x.com/rapid7/status/2114714601569083531 - [discussion] @TalosSecurity: Talos engineer Brandon Stultz talks about how a SnortML model, deployed months e https://x.com/TalosSecurity/status/2113669996937105856 - [discussion] @Unit42_Intel: 2/2 This led us to believe that it was exploitation of those vulnerabilities. We https://x.com/Unit42_Intel/status/2114475577541378125 - [discussion] @Unit42_Intel: 1/2 Unit 42 reported earlier that we had observed post-compromise activity that https://x.com/Unit42_Intel/status/2114475543127056749 - [discussion] Kevin Beaumont: Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches avai https://cyberplace.social/@GossiTheDog/117506885261666389 - [mentions] sk1000302 - Check Point Response to CVE-2026-109618, CVE-2026-109619 (PHP2Shell) https://support.checkpoint.com/results/sk/sk1000302 - [mentions] ESET Research: PHP2Shell: What to know about two critical PHP flaws https://www.welivesecurity.com/en/videos/php2shell-what-know-two-critical-php-flaws/ - [mentions] Wiz Research: PHP2Shell: Exploitation Attempts and Remediation Trends https://www.wiz.io/blog/php2shell-exploitation-so-far - [mentions] Red Hat RHSB-2026-013 php2shell https://access.redhat.com/security/vulnerabilities/RHSB-2026-013 - [mentions] ReversingLabs: The Sky Is Falling (Again): What PHP2Shell Says About AI, The Disclosure Process, and Security https://www.reversinglabs.com/blog/the-sky-is-falling-again-what-php2shell-says-about-ai-the-disclosure-process-and-security - [mentions] Snyk: PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First. https://snyk.io/blog/php2shell-where-next-one-will-show-up-first/ - [mentions] BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ - [mentions] PHP2Shell: detection, analysis, remediation (Datadog Security Labs) https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/ - [mentions] BleepingComputer: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/ - [mentions] Aikido: The day after tomorrow: After PHP2Shell, it gets worse, then defenders win https://www.aikido.dev/blog/php2shell-day-after-tomorrow - [mentions] Google Cloud Security Bulletins: GCP-2026-072: Published: 2026-10-24 Description Description Severity Notes Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shel https://docs.cloud.google.com/support/bulletins/index#gcp-2026-072 - [mentions] Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers (Dream Research) https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers - [mentions] BleepingComputer: InfraTrust report warns of exploited flaws in critical network infrastructure https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/ - [mentions] BleepingComputer: Even after PHP2Shell, blast radius matters more than a CVSS score https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/ - [mentions] BleepingComputer: PHP2Shell security flaws now sucessfully exploited in the wild https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/ - [mentions] Aikido: What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained https://www.aikido.dev/blog/what-are-shell-vulnerabilities - [mentions] Aikido: Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster https://www.aikido.dev/blog/ghost-php2shell-coordinated-disclosure-faster - [mentions] Aikido: How to patch PHP2Shell with free Aikido Images https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images - [mentions] Aikido: Surviving cybersecurity until the end of 2026 https://www.aikido.dev/blog/cybersecurity-surviving-vulnerabilities-malware-best-practices - [mentions] PHP2Shell Activity Across Previdian Network (Previdian Research) https://previdian.com/php2shell-activity-across-previdian-network - [mentions] ESET Research: This month in security with Tony Anscombe – October 2026 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-october-2026/ - [poc] dev-maple/php2shell-CVE-2026-109619 https://github.com/dev-maple/php2shell-CVE-2026-109619 - [poc] fahise/cve-2026-109618-cve-2026-109619-poc https://github.com/fahise/cve-2026-109618-cve-2026-109619-poc - [poc] K2uci/PHP2ShellPOC-CVE-2026-109619 https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619 - [poc] hack-ita/php2shell-cve-2026-109618-109619 https://github.com/hack-ita/php2shell-cve-2026-109618-109619 - [poc] IamLucif3r/CVE-2026-109618-exploit https://github.com/IamLucif3r/CVE-2026-109618-exploit - [poc] Zaynux/TryHackMe-PHP2Shell-CVE-2026 https://github.com/Zaynux/TryHackMe-PHP2Shell-CVE-2026 - [poc] saaudsdk/php2shell-cve-2026-109618-109619-fix https://github.com/saaudsdk/php2shell-cve-2026-109618-109619-fix - [poc] devzyai/CVE-2026-109618-POC https://github.com/devzyai/CVE-2026-109618-POC - [poc] akamor2800/php-5.4-cve-2026-php2shell-patch https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch - [poc] emirwtz/CVE-2026-109618 https://github.com/emirwtz/CVE-2026-109618 - [poc] mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell- https://github.com/mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell- - [poc] Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560- https://github.com/Pr0fEs0r-X/PHP2SHELL-Checker-v-2.0-CVE-2026-115560- - [poc] hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC https://github.com/hosun-hwang/CVE-2026-109618-CVE-2026-109619_PoC - [poc] GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619 https://github.com/GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619 - [poc] sahmsec/CVE-2026-109618-PHP2SHELL https://github.com/sahmsec/CVE-2026-109618-PHP2SHELL - [poc] delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC- https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC- - [poc] delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC - [poc] lflare/php2shell-cve-2026-109618-109619 https://github.com/lflare/php2shell-cve-2026-109618-109619 - [poc] lflare/php2shell-cve-2026-109618 https://github.com/lflare/php2shell-cve-2026-109618 - [poc] Hika-sec/php2shell-CVE-2026-109619 https://github.com/Hika-sec/php2shell-CVE-2026-109619 - [poc] emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC https://github.com/emc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoC - [poc] gagaltotal/CVE-2026-109618-109619-php2shell https://github.com/gagaltotal/CVE-2026-109618-109619-php2shell - [poc] vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy https://github.com/vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy - [poc] jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP https://github.com/jackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTP ## From the sources The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_