PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service
cyb3rops · x · 2026-10-23
ProjectDiscovery (the team behind Nuclei) launched Secure the Web, an automated internet-wide notification system, with its first event covering PHP2Shell: two critical PHP flaws (CVE-2026-109618/109619) enabling unauthenticated remote code execution. Every app on an affected PHP runtime—WordPress, Laravel, Drupal, Magento and more—is exposed, and updating the app doesn't fix it.
- Operators must upgrade PHP, restart PHP-FPM/Apache/LiteSpeed workers, and verify the live site's PHP version (not just CLI)
- With modphp, exploitation may happen before app code runs; config changes don't fully mitigate
- The new free service scans exposed services (including odd ports, sub-paths, appliances, containers) and emails their security contacts with the fix; they also published commands and prompts for auditing your own PHP services with a coding agent
More from coding & agent
- Supabase adds one-command MCP servers so ChatGPT and Claude can drive your app — dshukertjr · 2026-10-23
- Grok Bot ships with its own cloud computer: browser, terminal and filesystem to finish tasks — nima_owji · 2026-10-23
- Neon ships official AI Gateway adapter for TanStack AI with single-credential multi-model access — matei_zaharia · 2026-10-23
- Reflection AI's Beam agent auto-builds a Gemma-4 fine-tuning notebook, boosting accuracy 66.5% — danielhanchen · 2026-10-23
- Cua Spaces SDK lets Hermes and other agents run in sandboxes on your own hardware — Teknium · 2026-10-23
- Modal open-sources Spindle, a Tinker-compatible training server that charges GPU time instead of tokens — josh_wills · 2026-10-23