October 22, 2026
- PHP2Shell is now an active-exploitation story. KrebsOnSecurity reports working exploits and in-the-wild activity against CVE-2026-109618 and CVE-2026-109619. Ellio logged the first exploit requests 5.5 hours before fixes shipped and found Mirai-style loaders in some scanning traffic. The flaws affect web-facing PHP 5.4+, and CISA lists fixed supported builds as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. No source establishes how many sites were compromised. This moves yesterday’s disclosure-and-patch story into incident response. (discussion) · Vulnerabilities & Exploits
- Frontier models materially lowered the work needed to discover and port PHP2Shell exploits. OpenAI says GPT-5.6 Sol found one of the PHP flaws through Patch the Planet. Wiz says Gemini 4 Argon and GPT-5.6 Sol assisted exploit development, detection and patch validation, including adaptation across versions, configurations and memory layouts. That lowers the cost of scaling exploitation but does not show every observed request was autonomous. · AI & Model Security
- Two public PHP2Shell labs now demonstrate constrained full-RCE chains. Dinosn’s lab runs two chains against stock PHP 8.5.11 and uses fixed 8.5.12 as a negative control. 9bie’s ASLR-bypass lab reports 3 of 3 successes against an official PHP 8.4.26 Apache setup with a single worker and
display_errors=1. They are useful for validation, but neither is a universal exploit. · New Tools & Releases - Assetnote’s php2shell-scanner and Nextron’s process-watcher profile cover exposure and post-exploitation hunting. The scanner aims for high-fidelity validation; process-watcher uses eBPF to record every child process and full command line spawned by PHP, providing a focused hunt signal rather than proof of compromise. · New Tools & Releases