PHP2Shell: Security vendors race to contain a critical vulnerability as exploitation attempts spread
Two critical vulnerabilities in the PHP runtime have put security teams on alert, prompting cybersecurity vendors to issue threat advisories, update protective measures and urge organisations to patch affected systems without delay.
Known collectively as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 are remote code execution vulnerabilities rated 9.2 under CVSS 4.0. They affect PHP itself rather than a particular website platform or plug-in, potentially exposing a broad range of applications running on vulnerable servers.
The response from major cybersecurity vendors highlights three parallel concerns: the scale of internet-facing exposure, the speed at which attackers are attempting to exploit the flaws, and the ability of security products to provide protection while organisations work through remediation.
Palo Alto Networks reports AI-assisted attack activity
Palo Alto Networks’ Unit 42 threat intelligence team has observed proof-of-concept exploits and reported post-exploitation activity involving an agentic AI attack platform.
In its October 23 threat brief, Unit 42 described...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
