⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Summary: The PHP Foundation released patches for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, codenamed PHP2Shell, that could lead to unauthenticated remote code execution. Cloudflare said it detected millions of exploitation attempts after public disclosure, though no successful exploitation has been observed to date, and several websites went offline as a precaution.
Key Takeaway: Millions of exploitation attempts hit a flaw in PHP, software that runs on most of the web, and attackers only need one working path through a single unpatched door.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104085CVE-2026-108263CVE-2026-109437CVE-2026-109440CVE-2026-109442CVE-2026-109443CVE-2026-109444CVE-2026-109618CVE-2026-109619CVE-2026-110264CVE-2026-111497CVE-2026-112393CVE-2026-112403CVE-2026-112900CVE-2026-113072CVE-2026-113271CVE-2026-113279CVE-2026-113280CVE-2026-113303CVE-2026-113341CVE-2026-113380CVE-2026-114625CVE-2026-115560CVE-2026-20043CVE-2026-20236CVE-2026-20291CVE-2026-20356CVE-2026-28328CVE-2026-49950CVE-2026-58062CVE-2026-65182CVE-2026-65637CVE-2026-65905CVE-2026-68525CVE-2026-75128CVE-2026-75595CVE-2026-75754CVE-2026-76299CVE-2026-76302CVE-2026-76407CVE-2026-76466CVE-2026-76473CVE-2026-76474CVE-2026-76475CVE-2026-76476CVE-2026-76477CVE-2026-76478CVE-2026-76479CVE-2026-76481CVE-2026-76531CVE-2026-77185CVE-2026-77521CVE-2026-77926CVE-2026-77930CVE-2026-77932CVE-2026-77933CVE-2026-77934CVE-2026-77936CVE-2026-77937CVE-2026-79844CVE-2026-79895CVE-2026-79955CVE-2026-79956CVE-2026-82814CVE-2026-89078CVE-2026-91403CVE-2026-93577CVE-2026-95704CVE-2026-95721CVE-2026-97229CVE-2026-97406CVE-2026-97693
- Related
- Critical Git Lab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Cyber Risks ·