Search — “CVE-2026-109619”

CISA added the Linux kernel XFRM ESP-in-TCP privilege-escalation flaw CVE-2026-46300 (Fragnesia) to KEV and warned it can be chained with PHP2Shell (CVE-2026-109618/CVE-2026-109619) to implant PHP webshells and run commands as root. Dream Security reported a campaign that rooted 25 servers across the US, Japan, Taiwan and South Korea and then targeted three servers in a US government-affiliated environment, though CISA itself did not share details of the attacks. Hunters should look for PHP webshells on web servers and unexpected root-level command execution from PHP processes.

Palo Alto Networks updated its advisory to say active exploitation has been observed against PAN-OS management web UI and XML API exposed to the internet, tied to PHP2Shell PHP RCE flaws. Dream reported a suspected China-nexus actor used the flaws alongside Fragnesia (CVE-2026-46300) to root 25 servers, with credential extraction and Active Directory enumeration confirmed in recovered artifacts. Hunters should check PAN-OS management interface exposure and logs for web shell and command execution activity, and remove public management access.

Dream reports a suspected China-nexus, AI-assisted operation (Oct 23–25, 2026) that used a custom PHP2Shell exploit (CVE-2026-109618/109619) against PHP session.upload_progress on an undisclosed vendor's firewall appweb management server, chained with the Fragnesia Linux kernel LPE (CVE-2026-46300) to root 25 devices across the US, Japan, Taiwan and South Korea. The attacker planted PHP web shells in publicly accessible directories, built a reverse SSH tunnel into a US government-affiliated network, compromised an internal firewall management server, decrypted an LDAP service account password, enumerated AD users, password-sprayed and attempted to create backdoor AD accounts; success of credential theft and account creation is unconfirmed. Hunt for new PHP files in firewall web roots, outbound SSH from firewall appliances, AD password spraying from firewall/management IPs, and new AD account creation.

An Eclypsium InfraTrust Pulse report (covering September 18 to October 14) lists actively exploited vulnerabilities across network appliances and warns that PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP embedded in appliance management interfaces. Because vendors compile PHP into firmware, customers must wait for vendor firmware updates. InfraTrust recommends keeping PHP-backed management interfaces off the Internet until patches arrive; the sources do not describe confirmed PHP2Shell exploitation in the wild.

Palo Alto Networks said in an advisory update that threat actors are exploiting the recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against publicly accessible PAN-OS management interfaces. The flaws allow unauthenticated remote code execution in affected PHP versions, and the vendor says the issue affects the HTTPS web UI and XML API service and the dataplane only if a management profile is attached. Defenders should check whether management access is reachable from the internet and apply the listed PAN-OS fixes, but the sources do not describe specific post-exploitation commands or log patterns from the Palo Alto cases.

CISA added CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws tracked as PHP2Shell that allow unauthenticated remote code execution in high-complexity attacks, to its Known Exploited Vulnerabilities catalog. PHP patched them on October 21, and Amazon reports attackers began targeting them four days before patches shipped, though several firms tagged the earlier attempts as unsuccessful. A separate RCE flaw, CVE-2026-115560, has only a mitigation and no patch; the source reports an honeypot-observed RCE against Apache mod_php running PHP 8.4.26, but no source describes specific huntable artifacts.

Siemens, Schneider Electric, ABB, Johnson Controls, Belden, HMS, Wibu-Systems and others published advisories listing PHP-based OT/ICS products affected by two critical unauthenticated RCE flaws in the PHP engine, patched by PHP on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The first exploitation attempt was seen October 17 before fixes, Cloudflare reported millions of attempts, and the first confirmed attacks were against honeypots. Belden NetModule NRSW has no patch yet and the vendor recommends disabling its web interface; hunters should look for web-server processes spawning shells against PHP-hosted applications.

Researchers at Perplexity's detection team recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26 in honeypots, after earlier reports had been scanning and non-working exploits only. The sources say the response contained an 800 KiB decoded cookie dump used for memory disclosure, followed by a shell command run about 1.6 ms after the response. Patches shipped October 21, so hunters should check PHP versions and look for shell processes spawned by PHP/Apache workers.

PHP2Shell refers to two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution; PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Amazon reported the first exploitation attempt on October 17, and WatchTowr observed mass exploitation soon after the fixes, though public PoCs did not achieve code execution. CrowdStrike reported that one unauthenticated POST request can make an Apache mod_php worker start a shell and run an attacker-chosen command, so hunters should look for shell children of web server PHP processes.

Unauthenticated RCE flaws in the PHP engine (session upload-progress and fatal-error use-after-frees) are being mass-probed, with Cloudflare seeing millions of attempts, and some attempts try to deploy the Mirai-derived Potassium botnet via a loader from 92.118.112[.]100. No confirmed successful compromises have been reported. Observed exploitation recycles PHP workers, leaks memory through PHPSESSID cookies and abuses session upload progress handling to run shell commands. Hunt for unusual multipart requests followed by memory-limit errors or HTTP 500 bursts, oversized or malformed PHPSESSID response cookies, PHP worker churn, and web server processes spawning shells or downloaders.

CISA urges immediate patching of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed "php2shell," which allow unauthenticated remote code execution in PHP installations serving web requests. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The brief reports Cloudflare has seen in-the-wild exploitation, but CISA's alert states it had not observed exploitation at the time of its publication. Hunters should prioritize internet-facing PHP and watch for PHP worker processes launching shells or downloading tools.

Details of two critical PHP core RCE flaws (CVSS v4 9.2) leaked before coordinated disclosure on Oct 20, 2026; PHP scheduled an emergency release for Oct 21 14:00 UTC. watchTowr reproduced CVE-2026-109618; sources state no in-the-wild exploitation was seen at publication, though the brief reports later exploitation for miners and a Linux proxy backdoor. Hunt for PHP worker processes (php-fpm, php-cgi, httpd, apache2) spawning shells, interpreters, download tools, reverse-shell patterns and recon commands, plus new webshells, cron jobs and accounts.