Dream researchers uncovered a Chinese-nexus PHP2Shell exploit Fragnesia chain that rooted 25 firewalls and breached a US government Active Directory.
Related Posts:
GMO Internet Ransom Demand Slashed After Cloud Breach
UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison
The post Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems appeared first on Daily Cy
CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.
Related Posts:
Apple iOS 27.2 Update Fixes 160 Security Flaws
Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones
HashiCorp Patches Critical 9.9 CVSS Consul-k8s Authorization Bypass Vulnerability (CVE-2026-110720)
The post CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface appeared
Palo Alto confirms PAN-OS PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 affect the firewall management interface. Restrict access and patch.
Related Posts:
PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates
The post Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama appeared first on Daily Cyb
PHP warns of CVE-2026-115560, a PHP session vulnerability that follows PHP2Shell. Disable session.upload_progress until the next bugfix release.
Related Posts:
Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates
The post PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation appeared first on Daily Cyber
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately.
On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP req
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately.
On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP requests.
Cloudflare researchers observed tens of thousands of exploit attempts within 45 minutes of public disclosure, hundreds of thousands within two hours, and millions by October 22.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
As of October 23, Censys counts over 34.4 million PHP services still running vulnerable versions. Governments, hospitals, and schools across Asia, Europe, and North America have preemptively taken services offline rather than wait.
Below is an image showing the hosts potentially vulnerable to CVE-2026-109618 and/or CVE-2026-109619.
Security firms using honeypots report the same pattern: attackers are scanning many servers and trying to exploit the PHP flaws, but no successful remote code execution has been confirmed in real-world attacks. Sophos says this suggests that attackers are also struggling to exploit the vulnerabilities. Even its own security team needed more effort than expected, despite using AI, to develop a working exploit.
However, the risk is growing. VulnCheck researchers have developed an exploit that bypasses ASLR, a security feature that randomizes where code is stored in memory. By combining both vulnerabilities, they can use a memory leak to bypass this protection and run code on the target system. The exploit works, even though there is no evidence of widespread use yet.
The attempts that have been caught so far are mostly scanning, fingerprinting, and botnet delivery attempts. Cowrai’s analysis of PHP2Shell traffic in the wild found connections to a Mirai variant called Potassium, which contacts a C2 server, checks for an HTTP 200 response, then downloads a Linux executable as a follow-on payload.
“The payload, a likely Mirai botnet variant known as Potassium, was not delivered since the exploitation attempt was unsuccessful due to being blocked by Sophos countermeasures.” states the report published by Sophos. “However, analysis of the sample revealed that is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026.”
The malware can download additional files and disrupt networks. It contacts a hard-coded command-and-control server, checks that the server responds successfully, and downloads a file designed to run on Linux. If normal address lookup fails, it can use public DNS servers such as Google DNS and Cloudflare DNS. Like other Mirai malware, it can also launch distributed denial-of-service (DDoS) attacks.
Arctic Wolf found that both malware samples had Ethereum Name Service (ENS) resolution disabled, meaning the feature was available but not active.
“ENS resolution was disabled in both samples, indicating that the capability was present but inactive.” states Arctic Wolf. “If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses.”
The botnet’s developers have already added the ability to use ENS to find command-and-control (C2) servers. This could help them keep their infrastructure online and make it harder for authorities to take down their domains, but the feature has not yet been enabled.
Sophos blocked the attempted Potassium delivery before it succeeded. But analysis of the sample itself showed it’s a significantly expanded version of the Mirai variant spotted earlier in 2026, with added DDoS capabilities and fallback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup.
PHP2Shell is being compared to Log4Shell because it affects a huge number of systems. The flaw is in PHP itself, so it can affect websites, content management systems and shared hosting services. Even a basic WordPress site with no extra plugins is at risk if it uses a vulnerable PHP version.
Fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions, including 7.4, 8.0 and 8.1, need fixes provided by their software distributors or an upgrade to a supported version.
Cisco Talos notes that scanning for flaws and using public exploit code is easier than building attacks into custom tools. Advanced attackers may still be developing those tools, so administrators should use this time to patch vulnerable systems.
“The true impact of this vulnerability will take time to evaluate.” concludes Talos. “These types of vulnerabilities that impact core technologies tend to cascade into other platforms and applications as they evaluate impact and provide associated patching, harkening back to the waves of exploitation that we saw after Log4J.”
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive.
Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence.
“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive.
Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence.
“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.” reads the report published by Amazon team.”The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”
The activity began on October 17, 2026, and appeared in telemetry from MadPot, AWS’s network of honeypots designed to attract and study malicious activity. The company said the first attempt targeted a honeypot from an IP address linked to a commercial anonymization network. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were still under embargo at the time.
AWS believes the use of anonymized infrastructure suggests a threat actor was behind the activity. However, the company hasn’t established how the attacker obtained information about the vulnerabilities before their public disclosure, nor has it confirmed that the early attempts would have succeeded against real-world systems.
The first attempt wasn’t an isolated event. AWS detected multiple proof-of-concept exploits on October 21, with the earliest appearing at around 02:00 UTC, roughly 12 hours before the scheduled public release and patch at 14:00 UTC.
Between 02:00 and 08:00 UTC that day, AWS observed further attempts against MadPot from additional anonymized infrastructure. The payloads and anonymization services varied, leading the company to suspect that multiple actors were involved.
After the embargo ended and PHP released the fixes, more proof-of-concept exploits appeared within hours. AWS reported that attackers used them against its sensors almost immediately, describing PHP2Shell as being broadly exploited in the wild.
The findings show why the date of a public security advisory can’t always serve as the starting point for an incident investigation. In this case, defenders had to account for activity that began before they could publicly identify the vulnerabilities.
“The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.” continues the report. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.”
PHP2Shell refers to two critical flaws in the PHP runtime that can allow unauthenticated remote code execution. An attacker may be able to send a specially crafted web request and run commands on a vulnerable server without first logging in.
PHP published fixes on October 21. The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the official PHP security notice.
The vulnerabilities affect PHP itself, rather than a specific website application. As a result, updating WordPress, Drupal or another application won’t fix the underlying problem if the server continues to run a vulnerable PHP runtime.
AWS says there is no configuration-only workaround that fully addresses both flaws. Organizations should install the fixed PHP version as soon as possible and check whether their hosting provider, operating system vendor or container image has supplied the necessary update.
For systems that can’t be patched immediately, AWS suggests considering whether blocking multipart file uploads is practical. Administrators should assess the impact on their applications before applying that restriction, and they shouldn’t treat it as a replacement for installing the fixes.
AWS recommends reviewing web server logs for suspicious requests, particularly POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string in multipart form data. Security teams should also look for unexpected processes launched by PHP and unexplained changes to files on web application servers.
These checks matter because an attack may leave evidence beyond the original HTTP request. Unexpected command interpreters, newly created files or unusual process activity can help investigators determine whether an attacker progressed beyond probing a vulnerable endpoint.
AWS also published six IP addresses associated with observed activity:
103.216.220.92, observed on October 17
31.223.184.166, observed on October 21
37.19.200.5, observed on October 21
134.209.159.64, observed on October 21
103.114.163.188, observed on October 21
95.217.98.37, observed on October 21
These addresses require careful handling. AWS warns that some belong to shared anonymization infrastructure and aren’t exclusive to PHP2Shell activity, so organizations should investigate matching events rather than automatically blocking every address.
The Cloudflare analysis of PHP2Shell provides additional context. Cloudflare said it had deployed web application firewall protections before public disclosure and had already observed attack traffic targeting its customers, including attempts to change payloads to evade those protections.
A web application firewall can help reduce exposure, but it doesn’t replace patching. Defenders should combine updated software with log analysis, process monitoring and checks for suspicious file changes.
AWS draws a broader lesson from the incident: organizations shouldn’t assume that exploitation begins only after a vulnerability becomes public. The October 17 activity shows that attackers may obtain or develop exploit information while a flaw is still under coordinated disclosure.
Attackers are using AI to develop exploits faster, sometimes within hours of a patch being released. Security teams need to patch critical systems quickly and investigate attacks from the earliest known date. For PHP2Shell, AWS recommends checking logs and activity from October 17 onward, including suspicious behavior that detection tools may not yet recognize.
A cPanel PHP update fixes PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, while WP Toolkit 6.11.5 patches CVE-2026-107663.
Related Posts:
QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer
The post cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers appeared
QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.
Related Posts:
cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer
The post QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Of
PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.
Related Posts:
cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
The post PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public appeared first on
Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.
The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.
Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon.
Several agencies told organizations unable to patch in time to consider pulling their sites. Finland temporarily shut its government’s public web services. In the Netherlands, the cyber-security age
Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon.
Several agencies told organizations unable to patch in time to consider pulling their sites. Finland temporarily shut its government’s public web services. In the Netherlands, the cyber-security agency, the National Institute for Public Health and the Environment, and the Tweede Kamer, parliament’s lower house, all went offline.
The US National Security Agency echoed this on X: “These vulnerabilities often provide a direct path to the server’s file system or database.” The White House said federal agencies were working with leading AI labs to speed up a fix, while Japan’s Prime Minister Sanae Takaichi urged people on X to check whether their public websites ran on PHP.
“We have taken down a number of other systems as a precautionary measure until they can be safely patched,” the Wikimedia Foundation said, leaving parts of Wikipedia unreachable on Wednesday. Edinburgh council’s website and pages for BBC programmes, including Doctor Who and The Traitors, also went dark, though neither has confirmed a PHP link. DeviantArt said only that it was “temporarily down for maintenance.”
How AI found CVE-2026-109618 and CVE-2026-109619
Researchers at Calif and Wiz uncovered the flaws. Calif and the PHP Foundation were part of OpenAI’s Patch the Planet program, which offered AI tools to find and fix PHP flaws. Wiz called them the “most severe vulnerabilities ever discovered” by AI. OpenAI described them as “one of the most impactful security issues in recent memory,” adding that its own researcher spotted the issue around the same time.
The bugs sat undetected for over a decade before surfacing August, after a few weeks of AI-assisted work. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz said. It estimates “roughly 70%” of the internet is affected; a figure not independently verified.
The PHP Foundation planned to disclose PHP2Shell later this month with a full patch, but details leaked on social media on Tuesday, forcing a rushed announcement.
Early PHP2Shell Attacks Emerging
The UK’s National Cyber Security Centre (NCSC) and its EU and Australian counterparts urged PHP users to apply the fixes. “Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated,” the NCSC said. Japan’s national cyber-security office and EU officials issued similar warnings.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” said security firm Huntress.
Affected versions remain unclear, though CERT-EU said CVE-2026-109618 and CVE-2026-109619 could reach back to PHP 5, launched in 2004. The update covers only the latest versions; users on PHP 8.1 or older should upgrade. Built for web development, PHP runs server-side on a large share, though not all, of the internet.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content. Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
Cloudflare reports early attacks on two critical PHP flaws ahead of the PHP security release fixing remote code execution bugs CVE-2026-109618.
Related Posts:
Atlassian Patches 176 Flaws in Jira, Confluence and Other Data Center Products
Oracle E-Business Suite Flaw CVE-2026-101809 Scores CVSS 10.0
Apache CouchDB 3.5.3 Fixes Six Flaws as Retired Apache Cocoon Gets Four Unpatched Bugs
The post PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws appeared first on Da
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems.
PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, after details of the flaws leaked online ahead of their planned disclosure.
I have successfully recreated & lab/field tested CVE-2026-
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems.
PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, after details of the flaws leaked online ahead of their planned disclosure.
I have successfully recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619
The PHP security team confirmed both vulnerabilities carry a CVSS v4.0 score of 9.2. It hasn’t yet published their technical details, confirmed the affected versions, or identified the releases that will fix them. The official PHP announcement says the full information will accompany the security updates.
“The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.” states the announcement.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release.”
Researchers dubbed the vulnerabilities as php2shell, using the identifiers CVE-2026-109618 and CVE-2026-109619. The identifiers and the claim that the flaws allow remote code execution come from reports outside PHP’s initial advisory, rather than from a published technical analysis by the project.
According to the Hacker News, the two critical PHP vulnerabilities would be disclosed on October 22. The post described them as remote code execution flaws with CVSS scores of 10.0 and said they affected versions dating back to PHP 5.
Researchers at watchTowr subsequently confirmed that the vulnerabilities were real and said the information had leaked before the agreed disclosure date. The company also reported that it had reproduced one of the flaws, CVE-2026-109618, but withheld technical details while patches remained unavailable.
PHP published its advance security notice later that day, setting the release for Wednesday, October 21, one day before the date reported in the leak. The team also reserved the right to release the fixes earlier if technical details became public or it found evidence of active exploitation.
The difference between the reported severity scores matters. The leaked information cited CVSS 10.0, while PHP officially rated both vulnerabilities 9.2 under CVSS version 4.0. Until the vendor publishes its technical advisory, the official score is the one administrators should use when describing PHP’s assessment.
The main concern is the possibility that the flaws affect a wide range of PHP installations. Reports have suggested that versions from PHP 5 onward could be vulnerable, but watchTowr’s FAQ explicitly notes that the scope hasn’t been confirmed by an official vendor advisory.
“The report claims the vulnerability affects every PHP version from PHP 5 onward, though this scope has not been confirmed by an official vendor advisory. No specific configuration or feature requirement has been described in the available report.” states watchTowr.
“Until PHP publishes an official advisory, security teams cannot determine which specific deployments face the greatest exposure; every organization running PHP in production should prepare to act quickly once a fix is confirmed.”
Administrators also don’t yet know which PHP components are involved or whether exploitation depends on a particular configuration or deployment mode. Those details will determine how attackers could reach the vulnerable code and which systems need the most urgent attention.
PHP’s supported versions policy adds another complication. The project currently supports four release branches, PHP 8.2 through 8.5, while older branches no longer receive security updates from the PHP project.
The anticipated fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to tracking by Mallory. These version numbers were predictions ahead of the release, not confirmed package versions in PHP’s advance notice.
If the vulnerabilities affect older releases, organizations running PHP 8.1, 8.0, 7.x or 5.x may not receive an upstream fix. They may need to upgrade to a supported branch, apply any security updates provided by their operating system vendor, or restrict access to affected systems until they can remediate them.
Research by Mallory highlights the scale of the potential problem. Using Shodan data collected on October 20, the company identified about 884,000 internet-facing hosts reporting PHP 8.1 or an older version, representing roughly 59% of the 1.5 million hosts that disclosed a PHP version in their HTTP banners.
These figures don’t establish that every host is vulnerable. The count identifies systems running older PHP versions that may not receive a direct fix from the PHP project if the reported scope is confirmed. Another 740,000 hosts reported PHP without revealing a version, making it harder to assess the full exposure.
The numbers also count hosts, not individual websites or organizations. Shared hosting can place many websites on the same server, while software vendors and hosting providers may bundle PHP into products that administrators don’t recognize as PHP installations.
That makes asset discovery an important first step. Security teams should check web servers, Windows systems, vendor appliances, hosting control panels such as cPanel and Plesk, and applications that include their own PHP runtime.
PHP hasn’t published a workaround in its advance notice. Until the fixes become available, organizations should identify their PHP installations and prepare to install the correct update as soon as the vendor publishes it.
Internet-facing systems should take priority, particularly servers running business-critical applications or processing sensitive information. Administrators should also check with their Linux distribution and hosting provider, since vendors sometimes backport security fixes without changing the upstream version number in the way expected.
For installations running end-of-life PHP, the options are less comfortable. Organizations should plan an upgrade or reduce exposure by taking vulnerable services offline, restricting access through a VPN or IP allowlist, or placing them behind a web application firewall while a longer-term fix is prepared.
CERT-EU’s security advisory recommends considering the isolation of internet-facing applications from public networks when immediate patching isn’t possible.
“CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available.”states CERT-EU. “Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.”
This is a precautionary measure, not a confirmed workaround for either PHP vulnerability.
Monitoring process activity can also help identify suspicious behavior. On Linux, security teams should investigate PHP-related processes such as php-fpm, php-cgi, httpd or apache2 launching unexpected shells, interpreters or download utilities, including sh, bash, python, curl and wget.
Florian Roth’s open-source process-watcher can log programs launched by PHP processes and record their command lines. It provides visibility into process activity, but it doesn’t block an exploit or prevent a malicious command from running.
If an investigation uncovers suspicious activity, teams should isolate the affected server, preserve PHP and web server logs, and check for newly created files in web roots, web shells, unexpected scheduled tasks, cron jobs and user accounts. Those steps can help determine whether an attacker has already gained access, rather than simply whether a server was exposed.
As of October 21, Huntress said it hadn’t observed exploitation in attacks against its partner environments and hadn’t developed or reproduced a proof of concept. watchTowr’s FAQ also listed no reported exploitation and no vendor patch at the time of its update.
That doesn’t mean administrators can safely wait to assess their exposure. Once technical details and fixes become public, attackers may be able to develop working exploits more quickly, particularly if the vulnerabilities affect widely deployed versions of PHP.
A previous PHP flaw illustrates how quickly the situation can change. When CVE-2024-4577, which affected PHP running in CGI mode on Windows, became public in June 2024, Akamai reported exploit attempts against its honeypot servers within 24 hours.
The scheduled release should answer the questions administrators still face: which versions are affected, which components contain the flaws, whether exploitation requires a particular configuration, and which updates fix each issue. Until then, the priority is straightforward: know where PHP runs, prepare the updates, and avoid leaving internet-facing systems on unsupported versions without additional protection.
Entrar
(@eastdakota) 
