Leaked PHP2Shell RCEs (CVSS 9.2) Draw Scans 20 Minutes After Patch, No Confirmed Exploits Yet
cyb3rops · x · 2026-10-23
Hunt.io published tracking research on the leaked PHP remote code execution flaws (PHP2Shell, CVE-2026-109618 / CVE-2026-109619, both CVSS v4.0 9.2):
- The bugs leaked before the scheduled Oct 21 patch (14:00 UTC); php2shell scanning hit honeypots 20 minutes after the patch shipped, driven by an existing Mirai-style botnet
- One day of scans found 683,922 IPs exposing PHP version headers, mostly end-of-life builds
- About a dozen attacker open directories staged php2shell tooling, but zero victims or landed shells were found
- One mass operator sprayed up to 123 servers via a 97-proxy farm with no successful shells
- No public PoC yet achieves code execution on x86-64 (OOM corruption vs ASLR)
Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
Related event: Critical PHP RCE Flaws Exploited in the Wild as Scans Surge(2 posts)→
More from Safety
- Bad AI agents can take down unpatched PHP sites in minutes, developer warns — saibharadwaj · 2026-10-23
- AI agents fuel real-world intrusions: 2,250 M365 tenants hit, 100+ firms compromised — cyb3rops · 2026-10-23
- eMudhra exits SSL business amid botched CA key generation and looming Chrome distrust — saibharadwaj · 2026-10-23
- Security lead warns AI vulnerability tsunami is months away; basics buy only ~18 months — EthanJPerez · 2026-10-23
- Asa Cooper-Stickwell joins METR's embedded monitoring assessment team — idavidrein · 2026-10-23
- Zach Weiner: cybersecurity's future is endless swarms of AI hacker bots vs defender bots — birchlse · 2026-10-23