New CRITICAL PHP vulnerability
- Thread starter bigredfish
- Start date
IPCT is safe! We are above 8.1
Way over my head but I'm seeing guys talking about patching above 8.1 - FYI
You are not safe from these new vulnerabilities. You must updateIPCT is safe! We are above 8.1
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure.
Not known who was doing it. "It remains unclear how the actor acquired exploit information prior to disclosure."
aws.amazon.com
Not known who was doing it. "It remains unclear how the actor acquired exploit information prior to disclosure."
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network...
aws.amazon.com
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure.
Not known who was doing it. "It remains unclear how the actor acquired exploit information prior to disclosure."
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network...
Could be the original team that discovered this did some anonymous in the wild testing... or they sold the info to bad actors
You are not safe from these new vulnerabilities. You must update
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
^^^^^
@Mike
This makes sense.
It also raises questions some don't want answered
It also raises questions some don't want answered
Matthew Craig
Getting the hang of it
Hey guys, I mentioned this in another thread today, we are golden, we haven't been on 8.1 since it went EOL. New server who dis?
Matthew Craig
Getting the hang of it
Running a version past 8.1 doesn't protect the server against the mentioned vulns. The PHP2Shell exploit (CVE-2026-109618 / 109619) affects all versions from 5.4 all the way up to 8.5. Even if you installed a new version of PHP a few days ago, it's vulnerable unless you've explicitly updated to the emergency security releases pushed out yesterday (8.2.35, 8.3.36, 8.4.27, or 8.5.12) and recycled the PHP-FPM / web server processesHey guys, I mentioned this in another thread today, we are golden, we haven't been on 8.1 since it went EOL. New server who dis?
mat200
IPCT Contributor
- Jan 17, 2017
- 19,759
- 32,956
Matthew Craig
Getting the hang of it
Thank you for adding this, @mat200 . This deserves all of the caution people are throwing out on socials for the last few days.
Matthew Craig
Getting the hang of it
There's going to be a lot more CVEs for PHP soon (as if there wasn't a lot already). Agentic security research seems to find these in waves once an area of the codebase is under scrutiny.
Yeah just read that. They are expecting many more over next 1-2 months
I'm hearing lost of sys admins have no clue and many, many systems have not been patched.
I actually alerted the company that provides IT security for the company my wife works for remotely part time yesterday.
Response: "Oh, well its always something"
I actually alerted the company that provides IT security for the company my wife works for remotely part time yesterday.
Response: "Oh, well its always something"
Matthew Craig
Getting the hang of it
Think of the embedded systems that may never be patched. Companies from SMBs to Fortune 500 or non-profits that don't have 100% visibility of their services. John from IT installed a WordPress server years ago and no one knows that it can get lateral access to a DB server in the company. MANY possibilities! This is obviously not the first RCE vuln that is widespread, and it does not mean that a random hack will just occur when running an unpatched server, but it's a ticking time bomb... Scanning bots are honestly the biggest risk right now. I can just search wordpress sites on Shodan right now that would be vulnerable.