[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

6 clusters · 201 sources · 4 days · First seen · Last updated

Escalation of PHP2Shell exploitation and new RCE discovery

Overview

The security crisis surrounding the PHP vulnerabilities known as ‘PHP2Shell’ has escalated significantly. Following the initial identification of CVE-2026-109618 and CVE-2026-109619, security telemetry has now recorded millions of exploitation attempts, including efforts to deploy Mirai botnet malware onto compromised hosts.

A confirmed breach of a European government agency has been reported, where attackers allegedly accessed password hashes and MFA secrets. Researchers noted that agentic AI tooling was utilized during post-exploitation activities. Furthermore, a new remote code execution (RCE) vulnerability, CVE-2026-115560, has been identified. This flaw affects applications where the ‘session.serialize_handler’ is set to ‘php_binary’ or ‘php_serialize’ and is modified via ‘ini_set()’ before ‘session_start()’ is called, provided ‘Session Upload Progress’ remains active.

As of late October 2026, over 34.4 million PHP services have been assessed as vulnerable. While the PHP project has released patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, experts warn that any internet-facing, unpatched systems should be treated as potentially compromised. Security professionals are recommending immediate credential rotation and thorough log reviews to mitigate ongoing risks.

In Italy, the Computer Emergency Response Team of the Agency for Digital Italy (CERT-AGID) has identified at least 650 URLs within the Index of Public Administrations (IPA) that are potentially vulnerable to the PHP2Shell exploit. A preliminary scan conducted on October 22, 2026, suggests approximately 3.2% of surveyed addresses may be running outdated PHP versions. CERT-AGID has notified affected administrations, noting that because detection relied on passive HTTP header analysis, the term “potentially vulnerable” is used as headers do not always confirm exact installed packages or backported fixes.

Entities

PHP · Amazon · PHP Foundation · Wiz · NSA

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 2 sources
    CERT-AGID identifies 650 potentially vulnerable Italian public administration URLs

    CERT-AGID has flagged 650 Italian public administration URLs as potentially vulnerable to the PHP2Shell exploit, urging immediate patching to prevent unauthenticated remote code execution.

  2. [TECHNOLOGY] 4 sources
    PHP security vulnerability threatens global websites

    A critical PHP vulnerability threatens nearly one-third of global websites, as many run on unsupported versions. South Korean authorities are coordinating with hosting providers to assist vulnerable SMEs.

  3. [TECHNOLOGY] 52 sources
    PHP2Shell vulnerabilities trigger global security alerts

    Critical PHP vulnerabilities known as ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution, prompting global emergency patching alerts.

  4. [TECHNOLOGY] 14 sources
    PHP security vulnerabilities trigger widespread warnings for web operators

    Critical PHP vulnerabilities have prompted experts to urge web operators to perform retroactive log audits and credential renewals beyond simple software patching to mitigate active exploitation risks.

  5. [TECHNOLOGY] 135 sources
    PHP vulnerabilities trigger global cybersecurity emergency

    Critical PHP vulnerabilities, discovered using AI, have triggered a global cybersecurity crisis, forcing governments and companies to patch servers or shut down websites to prevent remote code execution attacks

  6. [TECHNOLOGY] 4 sources
    Critical PHP vulnerabilities trigger global security responses

    Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allowing remote code execution have prompted global security measures and emergency patching.

Sources

aajtak.com · ad-hoc-news.de · adevarul.ro · adnKronos.com · afrikmag.com · albeu.com · all-about-security.de · allgaeuer-anzeigeblatt.de · allotech-dz.com · ameve.eu · android-mt.ouest-france.fr · ap-verlag.de · ascii.jp · australianmanufacturing.com.au · awardspace.com · bazaartimes.com · bedyna.cz · begeek.fr · berliner-sonntagsblatt.de · berlinstory-news.de · biometricupdate.com · biz.heraldcorp.com · blockchainseoul.kr · blockmedia.co.kr · blocktempo.com · blog-nouvelles-technologies.fr · blog.tedivm.com · borba.me · borncity.com · bug.hr · cachem.fr · cafef.vn · cafeglobe.com · canadanewsmedia.ca · canaltech.com.br · centrist.nz · cert.ug · channelobserver.de · chuokai-kanagawa.or.jp · cleaningforareason.org · cloudways.com · cmjornal.pt · cnbcindonesia.com · columnadigital.com · compsmag.com · cotidianul.ro · cryptobriefing.com · cryptopolitan.com

This summary has been updated 31 times: see revision history