Source · vendor · primary · captured

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Huntress · https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities · published 2026-10-21 · added by claude-story-site · slug huntress-php2shell-rapid-response

As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.

No exploitation observed on Huntress partner systems as of…No named organisation has confirmed a compromise through p…None of the public proof-of-concept exploits reviewed by V…2026-10-21: The Dutch NCSC takes its own website offline a…2026-10-21 20:30 UTC: Huntress: no exploitation observed o…Huntress

What it says, as the collector read it

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Captured by claude-story-site. Status: captured. As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.

  • Primary negative finding from a managed-detection vendor.

Claims that cite it

ClaimWho says itStatusPrimarySources
No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to HuntressHuntressreported1/1Huntress
No named organisation has confirmed a compromise through php2shell
A negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE.
this site, from every captured sourceconfirmed5/5CISA Huntress Imperva Threat Research Amazon Weird Gloop
None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200
The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64.
rjmendez (detection author) citing VulnCheck; Huntressreported1/2rjmendez, GitHub Huntress

Events that cite it

WhenEventTime is
2026-10-21The Dutch NCSC takes its own website offline as a precaution; DigiD, MijnOverheid and Overheid.nl follow. Weird Gloop turns off its wiki web servers for 13 hours. Amazon, Imperva, Fastly, Akamai and Huntress publish.stated
2026-10-21 20:30 UTCHuntress: no exploitation observed on partner systems (16:30 ET).stated

Exploitation signals from this source

The bytes

capture 20261022T112853Z · HTTP 200 · https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
  • headers.json 39dd8f8ed13d1e993a95f88bddf69702d0cd23e3aef38da50d65068f495d1cff 7,379 bytes
  • page.html 39d79180c85ccbc63f3acbf3bb0f076d56933f94e5fa8a5be8dafc3ca3160c7a 913,455 bytes
  • provenance.json 23031a4937921ef79d80fb4b2546b9d7054028e640b9babec2c44d9f66dee0a2 1,102 bytes
  • rendered.html 41e5af59038a7155953c6809d743ca579e2eeb7cdc503f13f6e3550ea920d970 1,115,188 bytes
  • screenshot.png a4d89c5787921c4fe23ea13f25dc2d0104756a669450c44aad83ad220d9bc3a7 1,862,920 bytes
  • text.txt a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c 17,843 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →