vulnerability
Limited reports of PHP bug exploitation emerge
CriticalCVSS 9.8KEVEPSS 100%
Summary
A cybersecurity firm, Dream, has uncovered a campaign by a Chinese threat actor targeting U.S. government-affiliated servers using the PHP2Shell exploit, chained with another vulnerability. The campaign involved a targeted approach, focusing on specific servers within a U.S. government environment, and demonstrated a high level of sophistication.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 47 other source(s)
- Multiples vulnérabilités dans PHP (21 octobre 2026)
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- PHP2Shell : deux failles critiques menacent les serveurs web
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Two critical RCEs in PHP core
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- PHP2Shell Exploitation Started Days Before Patches
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- New Serious PHP Vulnerabilities Released and Patched
- PHP2Shell puts dozens of UK government services out of service
- Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)
- Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- There's a third PHP2Shell bug, but it won't get an emergency fix
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
- Multiples vulnérabilités dans les produits Tenable (26 octobre 2026)
- PHP2Shell: No login, no app code, no warning. What next?
- We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue
- PHP2Shell: What to know about two critical PHP flaws
- PHP2Shell Exploitation Moves From Probes to Working Shells
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
- Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (27 octobre 2026)
- This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
- CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
- CISA confirms PHP2Shell under attack as researchers clock successful exploits
- Multiples vulnérabilités dans les produits Veeam (28 octobre 2026)
- Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
- Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers