October 24, 2026
PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug
PHP2Shell exploitation attempts are running at internet scale but failing most of the time due to ASLR protections, with a third unpatched RCE (CVE-2026-115560) disclosed after emergency patches. Huntress documented a ten-week Microsoft 365 token spray-and-replay campaign harvesting 497 successful sign-ins across 79 organizations, leading to business email compromise. Imperva demonstrated code execution on Node.js 24.22.0 via a Brotli decoder bug (CVE-2026-111497) affecting curl and Git as well, and Pillow has a critical filename-based RCE (CVE-2026-112900) passed to Ghostscript. LiteLLM's poisoned release traced to a master key exposed in May that enabled attackers to steal maintainer credentials and publish a backdoored v1.107.0, and an unreleased Anthropic model reportedly performs better against agentic AI attacks than Mythos 5.1.