thehackernews.com
Oct 22, 2026
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
AI-summarised brief · reviewed before publication
Amazon’s Threat Intelligence team detected a probe against its MadPot honeypot from an anonymized Australian IP, targeting the newly disclosed PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619). The flaws, rated 9.2 on CVSS, allow pre‑authentication remote code execution across all PHP 7.x and 8.x releases. Exploits surfaced immediately after the patches were released, with multiple threat actors attempting attacks within six hours. Security agencies urged rapid patching and monitoring for silent exploitation.
💡 Why It Matters
- · The PHP2Shell flaws expose every PHP‑enabled endpoint, enabling attackers to execute code without leaving obvious traces.
- · Prompt remediation is critical to prevent silent, widespread compromise of web services worldwide.
