Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

China Linked Hackers Exploit PHP Flaws to Root Firewalls

Part of the CVE-2026-109618 story · since 21 Oct

Developinglatest 2 hours ago47 articles18 outlets
21 Oct · SecurityOnline first25 Oct26 Oct27 OctNowThis article47th of 47
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Japanese Property Sites Hit in Extortion Campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:55 UTC. Cloudflare, its first report on the story. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV. This article, 47th of 47.

A China-linked threat group has been exploiting PHP2Shell vulnerabilities to gain root access to firewalls and drop webshells for persistent access, according to Dream. The attackers chained exploits for PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619 with a Linux kernel privilege escalation flaw, CVE-2026-46300 (Fragnesia).

Using FOFA, the Chinese internet asset search engine, they identified about 19,000 internet-facing firewalls from a specific vendor and exploited 25 of them on 23–24 October, with 24 devices receiving a PHP root webshell via an automated chain. Dream notes that 22 firewalls showed no post-exploitation activity.

After initial access, the attackers filtered to US, Japan, Taiwan and South Korea, then narrowed to firewalls running newer PHP releases, yielding a pool of around 240 targets. On two servers belonging to a US government-affiliated environment, the operation progressed: the first rooted host crashed shortly after exploitation on 23 October, while a second wave on 24 October succeeded.

The intruders maintained access via a reverse SSH tunnel and used it to reach an internal firewall management server, obtaining configurations, credentials and settings for every firewall managed by the organisation. From there, they decrypted an LDAP service account password, enumerated domain users and groups, performed password spraying attempts and sought to create Active Directory backdoor accounts.

Dream has not attributed the activity to a specific actor, but regards it as part of a Chinese-nexus operation given the targeting of US, Japan, Taiwan and South Korea.

How the story developed

All 47 articles
Developinglatest 2 hours ago47 articles18 outlets

47 articles from 18 outlets since 21 Oct. Still developing; the latest report was 2 hours ago. This was the 47th report, 8 days after the first.

Now21 Oct22232425262728First reportSecurityOnline · 21 Oct, 00:58This article47th of 47 · day 7NCSC alert21 Oct, 10:52 · official
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Japanese Property Sites Hit in Extortion Campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:55 UTC. Cloudflare, its first report on the story. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV. This article, 47th of 47.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 47 articles as a list
  1. Wed 21 OctDay 017
    1. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm00:58 · SecurityOnline · First report · Known exploited CVE
    2. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts02:31 · Ars Technica · Known exploited CVE
    3. NCSC urges PHP users to patch flaws that could enable server takeover10:52 · NCSC · official · NCSC alert · Known exploited CVE
    Show 14 more from 21 Oct
    1. PHP Prepares Emergency Fixes for Two Critical RCE Flaws06:00 · The Hacker News · Known exploited CVE
    2. Critical PHP2Shell flaws could expose servers to remote code execution07:15 · SecurityWeek · Known exploited CVE
    3. PHP2Shell flaws threaten remote code execution across PHP websites11:00 · Infosecurity · Known exploited CVE
    4. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution11:00 · SOCRadar · Known exploited CVE
    5. Critical PHP Flaws Enable Remote Code Execution Across Web Servers14:06 · Unit 42 · Known exploited CVE
    6. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers15:23 · The Hacker News · Known exploited CVE
    7. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 815:23 · Securelist · Known exploited CVE
    8. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover16:00 · Krebs on Security · Known exploited CVE
    9. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers17:08 · SecurityWeek · Known exploited CVE
    10. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin17:11 · Malwarebytes · Known exploited CVE
    11. Critical PHP flaws enable remote code execution as exploit PoCs emerge17:54 · SANS ISC · Known exploited CVE
    12. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs18:01 · SecurityOnline · Known exploited CVE
    13. Critical PHP Flaws Enable Remote Code Execution Without Login18:01 · Rapid7 · Known exploited CVE
    14. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers19:59 · Dark Reading · Known exploited CVE
  2. Thu 22 OctDay 18
    1. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot09:24 · The Hacker News · Known exploited CVE
    2. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public10:14 · SecurityWeek · Known exploited CVE
    3. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable11:38 · SecurityOnline · Known exploited CVE
    Show 5 more from 22 Oct
    1. Attackers Target Critical PHP Flaws Before Patches Were Released12:52 · SecurityWeek · Known exploited CVE
    2. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting13:29 · SecurityOnline · Known exploited CVE
    3. Gcore Offers Free Web Protection to Governments After PHP Attacks15:23 · SecurityOnline · Known exploited CVE
    4. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed16:01 · Security Affairs · Known exploited CVE
    5. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable16:01 · SOCRadar · Known exploited CVE
  3. Fri 23 OctDay 27
    1. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches00:23 · Darktrace · Known exploited CVE
    2. Okta fixes critical Access Gateway flaws enabling remote code execution04:30 · SecurityOnline · Known exploited CVE
    3. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet08:36 · The Hacker News · Known exploited CVE
    Show 4 more from 23 Oct
    1. PHP Warns of Unpatched RCE Risk in Rare Session Configurations12:00 · The Hacker News · Known exploited CVE
    2. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days12:35 · Security Affairs · Known exploited CVE
    3. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In13:13 · SecurityWeek · Known exploited CVE
    4. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It20:59 · Dark Reading · Known exploited CVE

  4. Quiet for 2 days

    Sun 25 OctDay 41
    1. PHP2Shell attackers target a European government entity19:00 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. PHP2Shell flaws put products running PHP at risk of remote code execution01:30 · SecurityOnline · Known exploited CVE
    2. Weekly report flags PHP and FortiSIEM flaws under attack03:20 · SecurityOnline · Known exploited CVE
    3. PHP warns of rare RCE flaw and advises disabling upload progress10:01 · Infosecurity · Known exploited CVE
    Show 5 more from 26 Oct
    1. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs · Known exploited CVE
    2. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers14:00 · SecurityWeek · Known exploited CVE
    3. Industrial Vendors Assess Products Affected by PHP2Shell Flaws15:31 · SecurityWeek · Known exploited CVE
    4. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    5. CISA adds actively exploited PHP flaw enabling remote code execution to KEV23:30 · CISA · official · Known exploited CVE
  6. Tue 27 OctDay 65
    1. CISA adds PHP2Shell flaws to KEV after confirmed attacks04:30 · SecurityOnline · Known exploited CVE
    2. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws06:30 · The Hacker News · Known exploited CVE
    3. CISA adds exploited PHP flaws to its KEV catalogue11:55 · Security Affairs · Known exploited CVE
    Show 2 more from 27 Oct
    1. Japanese Property Sites Hit in Extortion Campaign13:40 · SOCRadar · Known exploited CVE
    2. Cloudflare launches PHP hacking challenge after php2shell flaws13:55 · Cloudflare · Known exploited CVE
  7. Wed 28 OctDay 71
    1. China Linked Hackers Exploit PHP Flaws to Root Firewalls13:00 · SecurityWeek · Known exploited CVE · This article, 47th of 47

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in