pwn.watch: PHP incident updates https://pwn.watch/s/php Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.php.net/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Cloudflare deploys free default WAF rules (request + response signals) for all customers. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Cloudflare deploys free default WAF rules (request + response signals) for all customers. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21/22:PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-20:Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, partial [high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). https://pwn.watch/i/wordpress-core-cve-2026-87902 wordpress-core-cve-2026-87902:2026-09-25:CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability : CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362 adobe-commerce-and-magento-cve-2026-71362:2026-09-24:CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). Thu, 24 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability: CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650 adobe-commerce-and-magento-cve-2026-75650:2026-09-08:CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] WordPress Core: WordPress Core SQL Injection Vulnerability: CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). https://pwn.watch/i/wordpress-core-cve-2026-60137 wordpress-core-cve-2026-60137:2026-07-21:CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). Tue, 21 Jul 2026 00:00:00 GMT high Status: closed, patched [high] Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability: CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10). https://pwn.watch/i/joomlack-page-builder-cve-2026-56290 joomlack-page-builder-cve-2026-56290:2026-07-07:CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10). Tue, 07 Jul 2026 00:00:00 GMT high Status: closed, patched [high] Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability: CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19). https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907 widget-factory-joomla-content-editor-cve-2026-48907:2026-06-16:CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19). Tue, 16 Jun 2026 00:00:00 GMT high Status: closed, patched [high] Drupal Core: Drupal Core SQL Injection Vulnerability: CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27). https://pwn.watch/i/drupal-core-cve-2026-9082 drupal-core-cve-2026-9082:2026-05-22:CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27). Fri, 22 May 2026 00:00:00 GMT high Status: closed, patched