PHP2Shell

Exploitation

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Snoops 'likely still' have access to US government-affiliated network

Exploitation

CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]

Exploitation

Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces

Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as

Exploitation

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

Analysis

Even after PHP2Shell, blast radius matters more than a CVSS score

PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]

UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest

Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours

Disclosure

There's a third PHP2Shell bug, but it won't get an emergency fix

Bad things (and software bugs?) come in threes

Remediation

Exposed to PHP2Shell? Cyber Experts Weigh in With Advice

Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.

Disclosure

URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

Disclosure

PHP2Shell exploit bypasses protections designed to stop remote code execution

“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

Significant event · Impact

PHP2Shell puts dozens of UK government services out of service

Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise

Exploitation

Amazon says PHP2Shell exploitation began 4 days before patches

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

Significant event · Exploitation

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed

Exploitation

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses,

Disclosure

'PHP2Shell' Bugs Signal Red Alert for Security Industry

Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.

Significant event · Remediation

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own. Until you can install it, what lowers your