Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

China Linked Group Roots Palo Alto Firewalls Using PHP2Shell

Part of the CVE-2026-109618 story · since 21 Oct

Developinglatest 1 hour ago55 articles18 outlets
21 Oct · SecurityOnline first27 Oct29 OctNowThis article55th of 55
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Japanese Property Sites Hit in Extortion Campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:55 UTC. Cloudflare, its first report on the story. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 17:00 UTC. The Hacker News. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 18:00 UTC. SecurityOnline. OffSec launches PHP2Shell lab after critical PHP flaws emerge. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline. Researchers link PHP2Shell and Fragnesia flaws to 25 firewall compromises. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 07:30 UTC. The Hacker News. Attackers exploit PHP flaws on exposed Palo Alto interfaces. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 15:30 UTC. SecurityWeek. Adobe, Veeam and Juniper patch critical product flaws. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 12:30 UTC. Infosecurity. Chinese Actor Roots 25 Palo Alto Networks Servers in Campaign. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 16:00 UTC. SecurityWeek. China Linked Group Roots Palo Alto Firewalls Using PHP2Shell. Cites a CVE in CISA KEV. This article, 55th of 55.

Security researchers say threat actors have been aggressively probing exposed PHP2Shell flaws for more than a week, but confirmed compromises remain rare. Palo Alto Networks (PAN) reports that a China-linked group chained PHP2Shell exploits with the Fragnesia kernel privilege escalation to root PAN-OS devices, in attacks that targeted the management interface exposed to the internet. The exploits infected Palo Alto Networks PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series).

The two PHP2Shell flaws are CVE-2026-109618 and CVE-2026-109619. PAN notes that no special configuration is required for exploitation beyond access to the management interface, and customers were urged to restrict internet exposure and apply patches.

PAN says telemetry identifies more than 22.6 million exposed PHP instances potentially vulnerable to PHP2Shell as of 29 October. While WordPress remains largely unaffected to date, researchers emphasise that the mass attempt is broad and opportunistic, with testing indicating exploitation success hinges on server specifics such as ASLR, PHP build, extensions, memory limits and request handling.

Independent validation from Unit 42 corroborates the use of the same attacker tooling and the reported results, while Defiant (Wordfence) notes over 77,000 related requests from more than 2,000 IP addresses but no confirmed WordPress compromises as of 28 October.

Industry trackers outline a small set of IPs driving the activity. Cato Networks reports that around 96% of attacks focused on CVE-2026-109618, with roughly 41% attempting remote code execution, and that healthcare, technology and security services were frequently targeted. WatchTowr observed exploitation from a single German IP address that simply executes a curl command to prove access, with no further post-exploitation activity detected.

How the story developed

All 55 articles
Developinglatest 1 hour ago55 articles18 outlets

55 articles from 18 outlets since 21 Oct. Still developing; the latest report was 1 hour ago. This was the 55th report, 10 days after the first.

Now21 Oct23242526272829First reportSecurityOnline · 21 Oct, 00:58This article55th of 55 · day 9NCSC alert21 Oct, 10:52 · official
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Japanese Property Sites Hit in Extortion Campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:55 UTC. Cloudflare, its first report on the story. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 17:00 UTC. The Hacker News. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 18:00 UTC. SecurityOnline. OffSec launches PHP2Shell lab after critical PHP flaws emerge. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 03:30 UTC. SecurityOnline. Researchers link PHP2Shell and Fragnesia flaws to 25 firewall compromises. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 07:30 UTC. The Hacker News. Attackers exploit PHP flaws on exposed Palo Alto interfaces. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 15:30 UTC. SecurityWeek. Adobe, Veeam and Juniper patch critical product flaws. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 12:30 UTC. Infosecurity. Chinese Actor Roots 25 Palo Alto Networks Servers in Campaign. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 16:00 UTC. SecurityWeek. China Linked Group Roots Palo Alto Firewalls Using PHP2Shell. Cites a CVE in CISA KEV. This article, 55th of 55.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 55 articles as a list
  1. Wed 21 OctDay 017
    1. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm00:58 · SecurityOnline · First report · Known exploited CVE
    2. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts02:31 · Ars Technica · Known exploited CVE
    3. NCSC urges PHP users to patch flaws that could enable server takeover10:52 · NCSC · official · NCSC alert · Known exploited CVE
    Show 14 more from 21 Oct
    1. PHP Prepares Emergency Fixes for Two Critical RCE Flaws06:00 · The Hacker News · Known exploited CVE
    2. Critical PHP2Shell flaws could expose servers to remote code execution07:15 · SecurityWeek · Known exploited CVE
    3. PHP2Shell flaws threaten remote code execution across PHP websites11:00 · Infosecurity · Known exploited CVE
    4. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution11:00 · SOCRadar · Known exploited CVE
    5. Critical PHP Flaws Enable Remote Code Execution Across Web Servers14:06 · Unit 42 · Known exploited CVE
    6. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers15:23 · The Hacker News · Known exploited CVE
    7. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 815:23 · Securelist · Known exploited CVE
    8. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover16:00 · Krebs on Security · Known exploited CVE
    9. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers17:08 · SecurityWeek · Known exploited CVE
    10. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin17:11 · Malwarebytes · Known exploited CVE
    11. Critical PHP flaws enable remote code execution as exploit PoCs emerge17:54 · SANS ISC · Known exploited CVE
    12. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs18:01 · SecurityOnline · Known exploited CVE
    13. Critical PHP Flaws Enable Remote Code Execution Without Login18:01 · Rapid7 · Known exploited CVE
    14. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers19:59 · Dark Reading · Known exploited CVE
  2. Thu 22 OctDay 18
    1. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot09:24 · The Hacker News · Known exploited CVE
    2. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public10:14 · SecurityWeek · Known exploited CVE
    3. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable11:38 · SecurityOnline · Known exploited CVE
    Show 5 more from 22 Oct
    1. Attackers Target Critical PHP Flaws Before Patches Were Released12:52 · SecurityWeek · Known exploited CVE
    2. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting13:29 · SecurityOnline · Known exploited CVE
    3. Gcore Offers Free Web Protection to Governments After PHP Attacks15:23 · SecurityOnline · Known exploited CVE
    4. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed16:01 · Security Affairs · Known exploited CVE
    5. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable16:01 · SOCRadar · Known exploited CVE
  3. Fri 23 OctDay 27
    1. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches00:23 · Darktrace · Known exploited CVE
    2. Okta fixes critical Access Gateway flaws enabling remote code execution04:30 · SecurityOnline · Known exploited CVE
    3. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet08:36 · The Hacker News · Known exploited CVE
    Show 4 more from 23 Oct
    1. PHP Warns of Unpatched RCE Risk in Rare Session Configurations12:00 · The Hacker News · Known exploited CVE
    2. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days12:35 · Security Affairs · Known exploited CVE
    3. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In13:13 · SecurityWeek · Known exploited CVE
    4. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It20:59 · Dark Reading · Known exploited CVE

  4. Quiet for 2 days

    Sun 25 OctDay 41
    1. PHP2Shell attackers target a European government entity19:00 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. PHP2Shell flaws put products running PHP at risk of remote code execution01:30 · SecurityOnline · Known exploited CVE
    2. Weekly report flags PHP and FortiSIEM flaws under attack03:20 · SecurityOnline · Known exploited CVE
    3. PHP warns of rare RCE flaw and advises disabling upload progress10:01 · Infosecurity · Known exploited CVE
    Show 5 more from 26 Oct
    1. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs · Known exploited CVE
    2. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers14:00 · SecurityWeek · Known exploited CVE
    3. Industrial Vendors Assess Products Affected by PHP2Shell Flaws15:31 · SecurityWeek · Known exploited CVE
    4. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    5. CISA adds actively exploited PHP flaw enabling remote code execution to KEV23:30 · CISA · official · Known exploited CVE
  6. Tue 27 OctDay 65
    1. CISA adds PHP2Shell flaws to KEV after confirmed attacks04:30 · SecurityOnline · Known exploited CVE
    2. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws06:30 · The Hacker News · Known exploited CVE
    3. CISA adds exploited PHP flaws to its KEV catalogue11:55 · Security Affairs · Known exploited CVE
    Show 2 more from 27 Oct
    1. Japanese Property Sites Hit in Extortion Campaign13:40 · SOCRadar · Known exploited CVE
    2. Cloudflare launches PHP hacking challenge after php2shell flaws13:55 · Cloudflare · Known exploited CVE
  7. Wed 28 OctDay 73
    1. China Linked Hackers Exploit PHP Flaws to Root Firewalls13:00 · SecurityWeek · Known exploited CVE
    2. Dream links PHP2Shell attacks to 25 rooted servers17:00 · The Hacker News · Known exploited CVE
    3. OffSec launches PHP2Shell lab after critical PHP flaws emerge18:00 · SecurityOnline · Known exploited CVE
  8. Thu 29 OctDay 84
    1. CISA flags Linux and VMware flaws as actively exploited00:00 · SecurityOnline · Known exploited CVE
    2. Researchers link PHP2Shell and Fragnesia flaws to 25 firewall compromises03:30 · SecurityOnline · Known exploited CVE
    3. Attackers exploit PHP flaws on exposed Palo Alto interfaces07:30 · The Hacker News · Known exploited CVE
    4. Adobe, Veeam and Juniper patch critical product flaws15:30 · SecurityWeek · Known exploited CVE
  9. Fri 30 OctDay 92
    1. Chinese Actor Roots 25 Palo Alto Networks Servers in Campaign12:30 · Infosecurity · Known exploited CVE
    2. China Linked Group Roots Palo Alto Firewalls Using PHP2Shell16:00 · SecurityWeek · Known exploited CVE · This article, 55th of 55

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in