PHP2Shell Bugs Patched After Global Internet Scare — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP Foundation released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after coordinated disclosure, allowing major web hosts early access to mitigate risks.
- Calif researchers discovered the PHP2Shell bugs during a security audit and used AI as an assistive tool, though emphasized that deep code expertise—not automated models—was central to the discovery.
- Amazon detected exploitation attempts of the PHP2Shell vulnerability as early as October 17, a week before public patch release, indicating possible prior knowledge or leak during the embargo period.
- Banks, retailers, hospitals, and government agencies took systems offline globally to patch servers, reflecting the severity of the unauthenticated remote code execution risk in widely used legacy infrastructure.
- Palo Alto Networks and Trail of Bits confirmed post-exploit activity by late Friday, showing the bugs are now actively being used to compromise systems despite patch availability.
- Cloudflare observed an exponential spike in exploitation attempts after disclosure, underscoring how quickly malicious actors moved to target unpatched systems worldwide.
Why it matters: The PHP2Shell flaws exposed millions of internet-facing systems to full remote takeover without credentials, and with confirmed attacks already underway, the window for patching is closing fast—especially for smaller organizations and legacy systems that lack resources, increasing long-term breach risks.
Ask SkimNews
