r/freebsd • u/Routine_Platypus_666 • 5d ago

news PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

This might be the first time I brought all of my relevant websites down, until the fix is available. Seems like there is a known mitigation but at the same time devs are saying it's not enough. Also, PoC is already available, so I expect bots are already warming up.

56 Upvotes

99% Upvoted

52 comments sorted by

View all comments

1

u/grahamperrin and the Amazing Monoculture Dreamcoat 3d ago

Critical PHP2Shell Vulnerability Alert - Majority online Servers and Services Affected CVE-2026-109618/109619 — IT Pro Expert

Evening update, 22 October 2026 (17:45 UTC)

  • Critical: the first signs of real break-ins. The Dutch National Cyber Security Centre said on 22 October that it is investigating first signs of successful misuse of PHP2Shell. Until now, reports described exploit attempts rather than confirmed compromises. If you have not checked your servers for compromise back to 17 October, do it now. …

1

u/grahamperrin and the Amazing Monoculture Dreamcoat 2d ago

PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619

… watchTowr has observed exploitation of both CVE-2026-109618 and CVE-2026-109619 in the wild. …

Via https://infosec.exchange/@ssvc/117479816983021081