NewsThe Register — Security
There's a third PHP2Shell bug, but it won't get an emergency fix
Teaser from the source
Bad things (and software bugs?) come in threes
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on PHP2Shell
Other advisories
- CriticalCVE-2026-109618PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
- CriticalCVE-2026-109618Critical Vulnerabilities in PHP (PHP2Shell)
- CriticalCVE-2026-109618PHP2Shell: critical unauthenticated RCE in PHP core
- HighCVE-2026-46300Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign
Other news entries
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated NetworkNewsThe Hacker News
- InfraTrust report warns of exploited flaws in critical network infrastructureNewsBleepingComputer
- Even after PHP2Shell, blast radius matters more than a CVSS scoreNewsBleepingComputer
- China-Linked Hackers Exploit PHP2Shell to Root FirewallsNewsSecurityWeek
- CISA confirms PHP2Shell under attack as researchers clock successful exploitsNewsThe Register — Security
- CISA confirms PHP2Shell vulnerabilities now exploited in attacksNewsBleepingComputer
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionNewsThe Hacker News
- UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contestNewsThe Register — Security
ID