Replicating PHP2Shell: how two unauth PHP RCE bugs hit CISA's exploited catalog in five days
thatroblennon · x · 2026-10-28
Rob Lennon publishes a replication writeup of PHP2Shell:
- On Oct 21 PHP shipped emergency releases closing two bugs allowing unauthenticated remote code execution (CVE-2026-109618 / CVE-2026-109619), found by Ryan Austin with Wiz Research and OpenAI
- Four version floors at once: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (4:00 UTC)
- Working exploits appeared within a day; CISA cataloged both as actively exploited within five days; scanning firm Mallory estimated exposed host counts
- One unpatched memory leak remains, but exploitation is impractical in most cases
More from Safety
- 325K experiments show AI agents steer wealthier users toward pricier options — niloofar_mire · 2026-10-28
- Nathan Young Asks Why AI Cyber-Risk Demos Are Obviously Unacceptable — NathanpmYoung · 2026-10-28
- 76% of Production AI Agents Sat Idle for 60 Days—But Kept Their Access Keys — krishnan · 2026-10-28
- OpenAI president: AI security should dwarf software — three camps are already cashing in — FinanceYF5 · 2026-10-28
- ChatGPT adds PIN-locked private chats — but forgetting the PIN may erase them for good — ThereWas · 2026-10-28
- Abliterated LLMs surge as open-source community strips refusal mechanisms — mishig25 · 2026-10-28