October 27, 2026
- Unit 42 walks back one PHP2Shell attribution and confirms another vector. The firm retracted its earlier assessment that the European government agency compromise involved PHP2Shell exploitation — the attack happened "in the context of a vulnerable PHP application" (The Hacker News). Separately it observed in-the-wild exploitation of CVE-2026-102785 against a vulnerable YOOtheme Pro install two days after patch, with JPEG/PHP polyglot webshells dropped into uploads followed by an ALFA webshell (@Unit42_Intel). @HashItOut_ makes the practical point that the polyglot step only works if the server executes PHP from the uploads directory — "one deny rule on the uploads dir kills this step even before patching." · Vulnerabilities & Exploits