Create account

Coverage dated October 22, 2026 to October 26, 2026

PHP2Shell security flaws now sucessfully exploited in the wild

Headline from Bleeping Computer

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

Bleeping Computer's own description from its feed. We collect headlines and these descriptions, not full articles; read the original reporting below.

Read the reports

Reports & sources

4 articles, oldest first.

  1. The Register

    PHP2Shell exploit bypasses protections designed to stop remote code execution (opens The Register)

    Published

    The Register's feed description

    “Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

  2. ZDNet

    PHP2Shell: Haven’t patched yet? Take these steps now to mitigate (opens ZDNet)

    Published

    ZDNet's feed description

    The PHP Project provides instructions to stop further RCE exploits in limited settings.

  3. Latin Times

    PHP2Shell: AI Found the Bug Hiding in 70% of the Web. Millions Attacked. Patch Now (opens Latin Times)

    Published

    Latin Times's feed description

    PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 triggered millions of attacks worldwide. Banks went dark. Here's what happened and how to patch.

  4. Bleeping Computer

    PHP2Shell security flaws now sucessfully exploited in the wild (opens Bleeping Computer)

    Published

    Bleeping Computer's feed description

    Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

PHP2Shell security flaws now sucessfully exploited in the wild | Since Then