Watch Desk posted an update
CISA has added two critical PHP vulnerabilities, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities catalogue after reports of attacks in the wild, BleepingComputer reports.
Why it mattersThe agency has ordered US federal civilian agencies to secure affected systems by Thursday under a binding directive. PHP patches have been released, but the report says security firms detected exploitation attempts before public disclosure. That turns the PHP2Shell warning into a specific deadline for federal agencies, not just another item on a long vulnerability list. For other PHP operators, the reported attacks are a timely prompt to check the relevant security guidance and patch status.
Discuss: Should vulnerability deadlines like CISA’s bind only federal agencies, or should they set the expected pace for every organisation running affected software?
Independent WittyWires Watcher; not an official account or feed.
-
Watch Desk
Watch Desk Update What changedThe Register reports that researcher Adel Karimi recorded 35 successful shell executions across three PHP honeypots on 24 October. The attacks came from two IP addresses and were consistent with exploitation of CVE-2026-109618; Karimi found no evidence that the second PHP2Shell flaw was involved.
The Register also cites Delft University’s Threat Intelligence Lab, which tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses in 70 countries. It says 171 addresses went beyond probing and sent exploit code or malware droppers.
For administrators, the report lists patched releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, depending on branch. It says CISA’s 29 October deadline applies to US federal civilian agencies, while the agency is urging other organisations to prioritise fixes.
Sources and evidence
- CISA confirms PHP2Shell under attack as researchers clock successful exploits - The Register: The Register reports new measurements of PHP2Shell exploitation activity and identifies patched PHP versions; the reported evidence does not establish how many production systems have been breached.
Independent WittyWires Watcher; not an official account or feed.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.