Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations running PHP-based web applications
Incident: Critical remote code execution and memory disclosure vulnerabilities discovered in the PHP runtime.
Impact: Full server compromise via unauthenticated RCE or the theft of sensitive authentication tokens and API keys.
Attacker: Unidentified threat actors
Analysis: The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reside within the PHP runtime engine, bypassing application-level security. Servers using Apache’s mod_php are particularly vulnerable to immediate RCE, while others face potential memory disclosure of sensitive credentials. The discovery highlights how AI is being used to accelerate the exploitation of legacy code bugs.
Recommendations: Update PHP runtime to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately.; Restart Apache, PHP-FPM, and all long-running PHP worker processes.; Verify PHP versions within container images and server packages, as application-level updates are insufficient.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-10-21 15:48 UTC
Mass exploitation of critical PHP vulnerabilities leading to server takeover and outages. Full system compromise, data exposure, and widespread service disruption across millions of websites. Critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow for remote code execution and full server takeover. These long-standing flaws were recently made exploitable through the assistance of frontier AI models, significantly lowering the barrier for attackers. Exploitation is already occurring in the wild, targeting government and commercial sites to install web shells.
Corroborating source: krebsonsecurity.com
Update — 2026-10-21 19:59 UTC
Executive Summary Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Potential security impact depending on exposure. The key concern for Organisations using the affected technology is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: unit42.paloaltonetworks.com
Update — 2026-10-22 09:16 UTC
Active exploitation of pre-authentication RCE vulnerabilities in the PHP core. Complete system compromise via remote code execution with minimal detectable forensic footprints. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enable pre-authentication remote code execution across PHP 7.x and 8.x series. The attacks are exceptionally stealthy, bypassing standard application logs and leaving only minimal traces in web server error logs. Amazon’s telemetry suggests that AI-assisted analysis is rapidly shrinking the window between patch release and active exploitation.
Corroborating source: thehackernews.com
Update — 2026-10-22 17:26 UTC
Broad exploitation of critical RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619. Potential for remote code execution and full server compromise across millions of internet-facing hosts. Two critical RCE vulnerabilities, known as PHP2Shell, were targeted in the wild starting days before official disclosure. While many initial PoCs were unstable or caused crashes, the sheer volume of attempts—reaching millions—indicates a massive effort to compromise PHP servers. The incident underscores the risks associated with vulnerability leaks during embargo periods.
Corroborating source: securityweek.com
Update — 2026-10-23 08:04 UTC
Active attempts to deploy the Potassium botnet using PHP2Shell RCE vulnerabilities. Potential for massive botnet growth enabling large-scale volumetric DDoS attacks. Threat actors are attempting to leverage CVE-2026-109618 and CVE-2026-109619 to deploy the Potassium botnet, a sophisticated Mirai fork. The malware employs ChaCha20 encryption for configuration and supports a wide array of volumetric DDoS flood commands. While successful exploitation has been limited thus far, the presence of over 34 million vulnerable PHP services creates a high risk for wide-scale network disruption.
Corroborating source: thehackernews.com