Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Tech vendors, cybersecurity companies and government agencies have published advisories, detections and mitigations for the PHP2Shell vulnerabilities, while many software makers are still checking whether their own products are exposed.
The two critical bugs, CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers execute code remotely. Wiz, OpenAI and Calif identified them in August, and PHP addressed them on October 21 with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
PHP pushed out the release one day ahead of the planned disclosure, after the CVE identifiers started circulating online on October 20.
Amazon says the first exploitation attempt came on October 17, before the embargo lifted. Hadrian, Patchstack and Cloudflare all detected attack attempts in the hours leading up to the patches. WatchTowr saw mass exploitation soon after the fixes were published, although the PoC exploits in circulation did not achieve code execution.
With PHP built into a wide range of commercial software,...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
