[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-php2shell-exploit-attempts-predate-the-leak-and-the-patches":10,"sections":42},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":30,"persona_id":30,"persona_name":30,"section":31,"tags":32,"sources":37,"feedback":41,"feedback_at":30,"cost_usd":41,"total_tokens":41},12141,"php2shell-exploit-attempts-predate-the-leak-and-the-patches","PHP2Shell Exploit Attempts Predate the Leak and the Patches","Two PHP memory flaws rated 9.2 out of 10 drew an exploit attempt on October 17, before the leak, the embargoed announcement, or any fix.","The PHP2Shell vulnerabilities were under attack before anyone outside the disclosure process was supposed to know they existed.\n\nPHP2Shell is the nickname for two memory-related flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. Exploited successfully, they could let an attacker run code remotely on a server, including planting web shells (small backdoor programs) to take control of it, according to Sergey Lozhkin, a Kaspersky researcher.\n\nThe timeline is the unusual part. Someone leaked details of the flaws on the Hacker News forum before the embargoed announcement. Amazon Threat Intelligence then reported an exploitation attempt as early as October 17, before the leak, and said it \"remains unclear how the actor acquired exploit information prior to disclosure.\" Dane Knecht, Cloudflare's chief technology officer, also reported early attacks before the PHP team released patches. Amazon's current assessment is that PHP2Shell is \"now being broadly exploited in the wild.\"\n\nThe reach comes from PHP's footprint. Wikipedia estimates the language runs almost 70% of websites, including those built on WordPress, Drupal and Joomla.\n\nFor ordinary browser users, the danger is indirect. These flaws target servers, not your browser. But a hijacked site can be altered to steal data, redirect visitors to phishing pages, or install malware directly. So the internet is not broken, though a compromised site is a worse bet than usual.\n\nEmbargoes assume defenders get a head start. An attempt dated October 17 suggests that at least one attacker had the details first, and how remains an open question.","[\"php2shell\",\"php\",\"vulnerability\",\"web-security\"]","2026-10-22T12:26:03.000Z","2026-10-22T13:37:31.577Z","2026-11-08T00:19:48.158Z","published","Duplicate of \"PHP2Shell Bugs Were Under Attack Days Before Patches Landed\"",[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the line 'The source does not say how many are actually unpatched', because it points readers to a source they can't see; say plainly that the number of unpatched sites is unknown, or cut it. The 'patch now' advice also needs to say what to patch (the fixed PHP versions, or the CMS updates) and give the leak and patch dates, and if those details aren't available, drop the claim rather than leave the advice vague.","resolved",null,"security",[33,34,35,36],"php2shell","php","vulnerability","web-security",[38],{"name":39,"url":40},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fcomputing\u002Finternet\u002Fno-the-internet-isnt-dying-due-to-one-of-the-most-significant-vulnerabilities-of-2026-but-this-is-what-you-need-to-know",0,{"sections":43},[44,49,53,58,63,68,73,78,83,88,93,98,103,108],{"name":45,"slug":46,"count":47,"latest_published_at":48},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":50,"slug":31,"count":51,"latest_published_at":52},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":57},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":67},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":69,"slug":70,"count":71,"latest_published_at":72},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":104,"slug":105,"count":106,"latest_published_at":107},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":109,"slug":110,"count":111,"latest_published_at":112},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]