PHP October 2026: Research https://php.oct.2026.newsroom.sgit.ai/ PHP October 2026: the incident, the analysis and the evidence: facts, sources captured, dated events. A new entry when an item is new, and again each time what it says changes. en-gb Thu, 22 Oct 2026 00:00:00 +0000 Source: CISA: Page Not Found | CISAhttps://php.oct.2026.newsroom.sgit.ai/sources/cisa-ed-22-02-log4j/index.htmlsrc-cisa-ed-22-02-log4j@v1Thu, 22 Oct 2026 11:34:00 +0000sourceSource. Dated 2026-10-22 11:34. Source: Wikipedia (English): Spring Framework - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-spring-framework/index.htmlsrc-wikipedia-spring-framework@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Wikipedia (English): Shellshock (software bug) - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-shellshock/index.htmlsrc-wikipedia-shellshock@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Wikipedia (English): 2023 MOVEit data breach - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-moveit-breach/index.htmlsrc-wikipedia-moveit-breach@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Wikipedia (English): Log4Shell - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-log4shell/index.htmlsrc-wikipedia-log4shell@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Wikipedia (English): 2017 Equifax data breach - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-equifax-breach/index.htmlsrc-wikipedia-equifax-breach@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Wikipedia (English): Dan Kaminsky - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-dan-kaminsky/index.htmlsrc-wikipedia-dan-kaminsky@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: CISA: Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISAhttps://php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-log4j-2021/index.htmlsrc-cisa-alert-log4j-2021@v1Thu, 22 Oct 2026 11:33:00 +0000sourceSource. Dated 2026-10-22 11:33. Source: Yle (Finnish public broadcaster): Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle Newshttps://php.oct.2026.newsroom.sgit.ai/sources/yle-finland-government-sites-shut/index.htmlsrc-yle-finland-government-sites-shut@v1Thu, 22 Oct 2026 11:32:00 +0000sourceSource. Dated 2026-10-22 11:32. Source: Wikipedia (English): Heartbleed - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-heartbleed/index.htmlsrc-wikipedia-heartbleed@v1Thu, 22 Oct 2026 11:32:00 +0000sourceSource. Dated 2026-10-22 11:32. Source: TPO.nl: PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NLhttps://php.oct.2026.newsroom.sgit.ai/sources/tpo-nl-digid-offline/index.htmlsrc-tpo-nl-digid-offline@v1Thu, 22 Oct 2026 11:32:00 +0000sourceSource. Dated 2026-10-22 11:32. Source: The Register: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskhttps://php.oct.2026.newsroom.sgit.ai/sources/theregister-php-blames-chainguard/index.htmlsrc-theregister-php-blames-chainguard@v1Thu, 22 Oct 2026 11:32:00 +0000sourceSource. Dated 2026-10-22 11:32. Source: The Record (Recorded Future News): PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Recorhttps://php.oct.2026.newsroom.sgit.ai/sources/therecord-php-foundation-statement/index.htmlsrc-therecord-php-foundation-statement@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn'thttps://php.oct.2026.newsroom.sgit.ai/sources/thehackernews-what-protects-you/index.htmlsrc-thehackernews-what-protects-you@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alerthttps://php.oct.2026.newsroom.sgit.ai/sources/thehackernews-php2shell-unpatched-alert/index.htmlsrc-thehackernews-php2shell-unpatched-alert@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: David Lopez-Kurtz (Substack): The Patch Is the Exploit - by David Lopez-Kurtzhttps://php.oct.2026.newsroom.sgit.ai/sources/substack-lopezkurtz-patch-is-the-exploit/index.htmlsrc-substack-lopezkurtz-patch-is-the-exploit@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: SentinelOne: Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Techniquehttps://php.oct.2026.newsroom.sgit.ai/sources/sentinelone-php2shell/index.htmlsrc-sentinelone-php2shell@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: SecurityWeek: PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeekhttps://php.oct.2026.newsroom.sgit.ai/sources/securityweek-mass-exploitation-looms/index.htmlsrc-securityweek-mass-exploitation-looms@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: Sansec: PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansechttps://php.oct.2026.newsroom.sgit.ai/sources/sansec-research-php2shell/index.htmlsrc-sansec-research-php2shell@v1Thu, 22 Oct 2026 11:31:00 +0000sourceSource. Dated 2026-10-22 11:31. Source: Safeguard (vendor blog): PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Bloghttps://php.oct.2026.newsroom.sgit.ai/sources/safeguard-how-hard-to-exploit/index.htmlsrc-safeguard-how-hard-to-exploit@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Rijksoverheid (Dutch government) / NCSC-NL: NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nlhttps://php.oct.2026.newsroom.sgit.ai/sources/rijksoverheid-ncsc-php-news/index.htmlsrc-rijksoverheid-ncsc-php-news@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Reuters factbox, via Global Banking and Finance: Global Websites Offline Amid PHP Security Flaws: Finance Sector Impacthttps://php.oct.2026.newsroom.sgit.ai/sources/reuters-factbox-websites-offline/index.htmlsrc-reuters-factbox-websites-offline@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Recorded Future: PHP2Shell Exploitation: Two Critical PHP Flaws Explainedhttps://php.oct.2026.newsroom.sgit.ai/sources/recordedfuture-php2shell/index.htmlsrc-recordedfuture-php2shell@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Quarkslab: Security audit of PHP-SRC - Quarkslab's bloghttps://php.oct.2026.newsroom.sgit.ai/sources/quarkslab-blog-php-src-audit/index.htmlsrc-quarkslab-blog-php-src-audit@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Qualys: 403 Forbiddenhttps://php.oct.2026.newsroom.sgit.ai/sources/qualys-blog-php-preannounce/index.htmlsrc-qualys-blog-php-preannounce@v1Thu, 22 Oct 2026 11:30:00 +0000sourceSource. Dated 2026-10-22 11:30. Source: Prophet Security: php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Securityhttps://php.oct.2026.newsroom.sgit.ai/sources/prophetsecurity-php2shell-detect/index.htmlsrc-prophetsecurity-php2shell-detect@v1Thu, 22 Oct 2026 11:29:00 +0000sourceSource. Dated 2026-10-22 11:29. Source: php[architect]: PHP Security in 2025: Lessons from the Core Security Audit | PHP Architecthttps://php.oct.2026.newsroom.sgit.ai/sources/phparch-php-security-2025-audit/index.htmlsrc-phparch-php-security-2025-audit@v1Thu, 22 Oct 2026 11:29:00 +0000sourceSource. Dated 2026-10-22 11:29. Source: Oxford Chronicle: Oxfordshire council websites offline amid critical global security issue | Oxford Chroniclehttps://php.oct.2026.newsroom.sgit.ai/sources/oxfordchronicle-councils-offline/index.htmlsrc-oxfordchronicle-councils-offline@v1Thu, 22 Oct 2026 11:29:00 +0000sourceSource. Dated 2026-10-22 11:29. Source: LBC: Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBChttps://php.oct.2026.newsroom.sgit.ai/sources/lbc-uk-websites-offline/index.htmlsrc-lbc-uk-websites-offline@v1Thu, 22 Oct 2026 11:29:00 +0000sourceSource. Dated 2026-10-22 11:29. Source: Huntress: Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntresshttps://php.oct.2026.newsroom.sgit.ai/sources/huntress-php2shell-rapid-response/index.htmlsrc-huntress-php2shell-rapid-response@v1Thu, 22 Oct 2026 11:28:00 +0000sourceSource. Dated 2026-10-22 11:28. Source: Helsinki Times: Government websites shut down in Finland over critical security flaws - Helsinki Timeshttps://php.oct.2026.newsroom.sgit.ai/sources/helsinkitimes-finland-shutdown/index.htmlsrc-helsinkitimes-finland-shutdown@v1Thu, 22 Oct 2026 11:28:00 +0000sourceSource. Dated 2026-10-22 11:28. Source: Silas Cutler (GitHub gist): PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHubhttps://php.oct.2026.newsroom.sgit.ai/sources/gist-silascutler-censys-query/index.htmlsrc-gist-silascutler-censys-query@v1Thu, 22 Oct 2026 11:28:00 +0000sourceSource. Dated 2026-10-22 11:28. Source: Equixly: CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixlyhttps://php.oct.2026.newsroom.sgit.ai/sources/equixly-php2shell-what-we-know/index.htmlsrc-equixly-php2shell-what-we-know@v1Thu, 22 Oct 2026 11:28:00 +0000sourceSource. Dated 2026-10-22 11:28. Source: East Anglian Daily Times (PA): No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Timeshttps://php.oct.2026.newsroom.sgit.ai/sources/eadt-minister-budget-no-breach/index.htmlsrc-eadt-minister-budget-no-breach@v1Thu, 22 Oct 2026 11:27:00 +0000sourceSource. Dated 2026-10-22 11:27. Source: Dutch IT Leaders: Just a moment...https://php.oct.2026.newsroom.sgit.ai/sources/dutchitleaders-websites-offline/index.htmlsrc-dutchitleaders-websites-offline@v1Thu, 22 Oct 2026 11:27:00 +0000sourceSource. Dated 2026-10-22 11:27. Source: Cybernews: PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernewshttps://php.oct.2026.newsroom.sgit.ai/sources/cybernews-php2shell-millions/index.htmlsrc-cybernews-php2shell-millions@v1Thu, 22 Oct 2026 11:27:00 +0000sourceSource. Dated 2026-10-22 11:27. Source: The Cyber Express: PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Siteshttps://php.oct.2026.newsroom.sgit.ai/sources/cyberexpress-php2shell-gov-sites/index.htmlsrc-cyberexpress-php2shell-gov-sites@v1Thu, 22 Oct 2026 11:26:00 +0000sourceSource. Dated 2026-10-22 11:26. Source: CybelAngel: What We Know About php2shell [Critical update]https://php.oct.2026.newsroom.sgit.ai/sources/cybelangel-php2shell/index.htmlsrc-cybelangel-php2shell@v1Thu, 22 Oct 2026 11:26:00 +0000sourceSource. Dated 2026-10-22 11:26. Source: CNN: Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Businesshttps://php.oct.2026.newsroom.sgit.ai/sources/cnn-php2shell-websites-shut/index.htmlsrc-cnn-php2shell-websites-shut@v1Thu, 22 Oct 2026 11:26:00 +0000sourceSource. Dated 2026-10-22 11:26. Source: Broadcom (Symantec) Security: PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COMhttps://php.oct.2026.newsroom.sgit.ai/sources/broadcom-security-php2shell/index.htmlsrc-broadcom-security-php2shell@v1Thu, 22 Oct 2026 11:26:00 +0000sourceSource. Dated 2026-10-22 11:26. Source: Bloomberg: Bloomberg - Are you a robot?https://php.oct.2026.newsroom.sgit.ai/sources/bloomberg-governments-offline/index.htmlsrc-bloomberg-governments-offline@v1Thu, 22 Oct 2026 11:26:00 +0000sourceSource. Dated 2026-10-22 11:26. Source: Armis: Just a moment...https://php.oct.2026.newsroom.sgit.ai/sources/armis-php2shell-find-patch/index.htmlsrc-armis-php2shell-find-patch@v1Thu, 22 Oct 2026 11:25:00 +0000sourceSource. Dated 2026-10-22 11:25. Source: Akamai Security Research: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamaihttps://php.oct.2026.newsroom.sgit.ai/sources/akamai-blog-php-core-rce/index.htmlsrc-akamai-blog-php-core-rce@v1Thu, 22 Oct 2026 11:25:00 +0000sourceSource. Dated 2026-10-22 11:25. Source: Akamai Security Research: CVE-2024-4577 Exploits in the Wild One Day After Disclosurehttps://php.oct.2026.newsroom.sgit.ai/sources/akamai-blog-cve-2024-4577-one-day/index.htmlsrc-akamai-blog-cve-2024-4577-one-day@v1Thu, 22 Oct 2026 11:25:00 +0000sourceSource. Dated 2026-10-22 11:25. Source: OpenAI: Patch the Planet (launch announcement)https://php.oct.2026.newsroom.sgit.ai/sources/openai-patch-the-planet-launch/index.htmlsrc-openai-patch-the-planet-launch@v1Thu, 22 Oct 2026 11:24:00 +0000sourceSource. Dated 2026-10-22 11:24. Source: OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilitieshttps://php.oct.2026.newsroom.sgit.ai/sources/openai-blog-coordinated-disclosure/index.htmlsrc-openai-blog-coordinated-disclosure@v1Thu, 22 Oct 2026 11:24:00 +0000sourceSource. Dated 2026-10-22 11:24. Source: Lorikeet Security: php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lhttps://php.oct.2026.newsroom.sgit.ai/sources/lorikeet-php2shell/index.htmlsrc-lorikeet-php2shell@v1Thu, 22 Oct 2026 11:24:00 +0000sourceSource. Dated 2026-10-22 11:24. Source: ActuIA: PHP flaws: France's ANSSI orders sites offlinehttps://php.oct.2026.newsroom.sgit.ai/sources/actuia-anssi-sites-offline/index.htmlsrc-actuia-anssi-sites-offline@v1Thu, 22 Oct 2026 11:24:00 +0000sourceSource. Dated 2026-10-22 11:24. Source: Wikipedia (English): PHP2Shell - Wikipediahttps://php.oct.2026.newsroom.sgit.ai/sources/wikipedia-php2shell/index.htmlsrc-wikipedia-php2shell@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: Tenable: php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®https://php.oct.2026.newsroom.sgit.ai/sources/tenable-php2shell-faq/index.htmlsrc-tenable-php2shell-faq@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: SecurityWeek: PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeekhttps://php.oct.2026.newsroom.sgit.ai/sources/securityweek-first-attempts-sensors/index.htmlsrc-securityweek-first-attempts-sensors@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: SecurityWeek: PHP2Shell Exploitation Started Days Before Patches - SecurityWeekhttps://php.oct.2026.newsroom.sgit.ai/sources/securityweek-exploitation-days-before/index.htmlsrc-securityweek-exploitation-days-before@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: Dark Reading: 'PHP2Shell' Bugs Signal Red Alert for Security Industryhttps://php.oct.2026.newsroom.sgit.ai/sources/darkreading-php2shell-red-alert/index.htmlsrc-darkreading-php2shell-red-alert@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolfhttps://php.oct.2026.newsroom.sgit.ai/sources/arcticwolf-php2shell-exposure/index.htmlsrc-arcticwolf-php2shell-exposure@v1Thu, 22 Oct 2026 11:23:00 +0000sourceSource. Dated 2026-10-22 11:23. Source: Newsweek: PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweekhttps://php.oct.2026.newsroom.sgit.ai/sources/newsweek-php2shell-websites/index.htmlsrc-newsweek-php2shell-websites@v1Thu, 22 Oct 2026 11:22:00 +0000sourceSource. Dated 2026-10-22 11:22. Source: Insurance Business (Matthew Sellers): UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Businesshttps://php.oct.2026.newsroom.sgit.ai/sources/insurancebusiness-uk-councils-met/index.htmlsrc-insurancebusiness-uk-councils-met@v1Thu, 22 Oct 2026 11:22:00 +0000sourceSource. Dated 2026-10-22 11:22. Source: Feross Aboukhadijeh (@feross) on X: Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distrihttps://php.oct.2026.newsroom.sgit.ai/sources/x-feross-chainguard/index.htmlsrc-x-feross-chainguard@v1Thu, 22 Oct 2026 11:21:00 +0000sourceSource. Dated 2026-10-22 11:21. Source: Techzine Global: PHP accuses Chainguard in PHP2shellhttps://php.oct.2026.newsroom.sgit.ai/sources/techzine-php-chainguard/index.htmlsrc-techzine-php-chainguard@v1Thu, 22 Oct 2026 11:21:00 +0000sourceSource. Dated 2026-10-22 11:21. Source: The Scotsman (Jack Davies): Edinburgh council website offline amid global cyber security alerthttps://php.oct.2026.newsroom.sgit.ai/sources/scotsman-edinburgh-council-offline/index.htmlsrc-scotsman-edinburgh-council-offline@v1Thu, 22 Oct 2026 11:21:00 +0000sourceSource. Dated 2026-10-22 11:21. Source: ITdaily (Jens Jonkers): PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdailyhttps://php.oct.2026.newsroom.sgit.ai/sources/itdaily-php-clumsy-announcement/index.htmlsrc-itdaily-php-clumsy-announcement@v1Thu, 22 Oct 2026 11:21:00 +0000sourceSource. Dated 2026-10-22 11:21. Source: Socket: Just a moment...https://php.oct.2026.newsroom.sgit.ai/sources/socket-blog-embargo-dispute/index.htmlsrc-socket-blog-embargo-dispute@v1Thu, 22 Oct 2026 11:20:00 +0000sourceSource. Dated 2026-10-22 11:20. Source: rjmendez, GitHub: GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress https://php.oct.2026.newsroom.sgit.ai/sources/github-rjmendez-phpup-2026/index.htmlsrc-github-rjmendez-phpup-2026@v1Thu, 22 Oct 2026 11:20:00 +0000sourceSource. Dated 2026-10-22 11:20. Source: Lexsah, GitHub: GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-https://php.oct.2026.newsroom.sgit.ai/sources/github-lexsah-php2shell-detection/index.htmlsrc-github-lexsah-php2shell-detection@v1Thu, 22 Oct 2026 11:20:00 +0000sourceSource. Dated 2026-10-22 11:20. Source: Blevene (GitHub gist): PHP2Shell: Detection Opportunities · GitHubhttps://php.oct.2026.newsroom.sgit.ai/sources/gist-blevene-detection-guide/index.htmlsrc-gist-blevene-detection-guide@v1Thu, 22 Oct 2026 11:20:00 +0000sourceSource. Dated 2026-10-22 11:20. Source: Fortinet Community (FortiWeb knowledge base): How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Communityhttps://php.oct.2026.newsroom.sgit.ai/sources/fortinet-fortiweb-php2shell/index.htmlsrc-fortinet-fortiweb-php2shell@v1Thu, 22 Oct 2026 11:20:00 +0000sourceSource. Dated 2026-10-22 11:20. Source: Safeguard (vendor blog): PHP2Shell WAF rules: what they block and where they fall short | Safeguard Bloghttps://php.oct.2026.newsroom.sgit.ai/sources/safeguard-waf-rules-limits/index.htmlsrc-safeguard-waf-rules-limits@v1Thu, 22 Oct 2026 11:19:00 +0000sourceSource. Dated 2026-10-22 11:19. Source: darkfibr (Mike Haddock), GitHub: GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP https://php.oct.2026.newsroom.sgit.ai/sources/github-darkfibr-php2shell-detect/index.htmlsrc-github-darkfibr-php2shell-detect@v1Thu, 22 Oct 2026 11:19:00 +0000sourceSource. Dated 2026-10-22 11:19. Source: Fastly: Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastlyhttps://php.oct.2026.newsroom.sgit.ai/sources/fastly-blog-php2shell/index.htmlsrc-fastly-blog-php2shell@v1Thu, 22 Oct 2026 11:19:00 +0000sourceSource. Dated 2026-10-22 11:19. Source: Matthew Prince (@eastdakota), Cloudflare CEO: Matthew Prince 🌥 on X: "Some stats on #php2shell. In the 10 hours before it was publicly annouhttps://php.oct.2026.newsroom.sgit.ai/sources/x-eastdakota-php2shell-stats/index.htmlsrc-x-eastdakota-php2shell-stats@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: Weird Gloop (cookmeplox): Recent wiki downtime (PHP2Shell mitigation) | Weird Gloophttps://php.oct.2026.newsroom.sgit.ai/sources/weirdgloop-blog-php2shell/index.htmlsrc-weirdgloop-blog-php2shell@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: watchTowr: watchtowr.comhttps://php.oct.2026.newsroom.sgit.ai/sources/watchtowr-php2shell-faq/index.htmlsrc-watchtowr-php2shell-faq@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: watchTowr: watchtowr.comhttps://php.oct.2026.newsroom.sgit.ai/sources/watchtowr-php2shell/index.htmlsrc-watchtowr-php2shell@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: OpenAI / Wiz / Calif joint microsite (php2shell.com): PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the webhttps://php.oct.2026.newsroom.sgit.ai/sources/php2shell-com/index.htmlsrc-php2shell-com@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: Imperva Threat Research (Nadav Avital, Bar Menachem): PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Impervahttps://php.oct.2026.newsroom.sgit.ai/sources/imperva-blog-php2shell/index.htmlsrc-imperva-blog-php2shell@v1Thu, 22 Oct 2026 11:18:00 +0000sourceSource. Dated 2026-10-22 11:18. Source: Amazon (CJ Moses, AWS Security Blog): Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWhttps://php.oct.2026.newsroom.sgit.ai/sources/aws-security-blog-madpot/index.htmlsrc-aws-security-blog-madpot@v1Thu, 22 Oct 2026 11:17:00 +0000sourceSource. Dated 2026-10-22 11:17. Source: NCSC-NL (Netherlands National Cyber Security Centre): List of software with PHP dependency potentially affected by php2shell CVEshttps://php.oct.2026.newsroom.sgit.ai/sources/ncsc-nl-php2shell-software-list/index.htmlsrc-ncsc-nl-php2shell-software-list@v1Thu, 22 Oct 2026 08:48:00 +0000sourceSource. Dated 2026-10-22 08:48. Source: NCSC-NL (Netherlands National Cyber Security Centre): NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilitiehttps://php.oct.2026.newsroom.sgit.ai/sources/ncsc-nl-php2shell/index.htmlsrc-ncsc-nl-php2shell@v1Thu, 22 Oct 2026 08:48:00 +0000sourceSource. Dated 2026-10-22 08:48. Timeline: NCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5.https://php.oct.2026.newsroom.sgit.ai/timeline/index.htmlev-20261022T0840-1a4cdf@v1Thu, 22 Oct 2026 08:40:00 +0000eventTimeline. Dated 2026-10-22 08:40. Source: OpenAI Developer Community (user 'sps', Leader): OpenAI models help researchers uncover critical PHP security flawshttps://php.oct.2026.newsroom.sgit.ai/sources/openai-community-php-flaws/index.htmlsrc-openai-community-php-flaws@v1Thu, 22 Oct 2026 08:17:00 +0000sourceSource. Dated 2026-10-22 08:17. Source: NCSC New Zealand: UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHPhttps://php.oct.2026.newsroom.sgit.ai/sources/ncsc-nz-alert-php/index.htmlsrc-ncsc-nz-alert-php@v1Thu, 22 Oct 2026 08:17:00 +0000sourceSource. Dated 2026-10-22 08:17.