Security Industry Sources

The RecordMalware & threatsWednesday at 12:30 PM

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it scrambled to post information earlier than planned.

Read at The Record

SecurityWeekMalware & threatsWednesday at 11:50 AM

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications. The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.

Read at SecurityWeek

MalwarebytesMalware & threatsWednesday at 11:14 AM

PHP2Shell: Why websites are going offline for emergency security updates

Websites are temporarily going offline as admins address two critical PHP flaws that could let attackers run malicious code on their servers.

Read at Malwarebytes

Krebs on Security

Krebs on SecurityMalware & threatsWednesday at 10:26 AM

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.

Read at Krebs on Security

SecurelistSecurity updatesWednesday at 10:18 AM

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.

Read at Securelist

Cisco TalosMalware & threatsWednesday at 10:10 AM

Two critical RCEs in PHP core

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial

Read at Cisco Talos

The Register SecurityMalware & threatsWednesday at 10:08 AM

PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

Websites down as precaution as exploits have already been published

Read at The Register Security

SecurityWeekMalware & threatsWednesday at 9:45 AM

High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.

Read at SecurityWeek

Wired SecuritySecurity updatesWednesday at 9:26 AM

‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.

Read at Wired Security

The RecordMalware & threatsWednesday at 9:17 AM

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.

Read at The Record

BleepingComputerSecurity updatesWednesday at 9:07 AM

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

Read at BleepingComputer

Unit 42Malware & threatsWednesday at 9:00 AM

“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.

Read at Unit 42

BleepingComputerMalware & threatsWednesday at 9:00 AM

ClickFix has never been bigger, and AI tools are its most convincing lure yet

ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. [...]

Read at BleepingComputer

The Hacker News

The Hacker NewsMalware & threatsWednesday at 9:00 AM

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own

Read at The Hacker News

Help Net SecuritySecurity updatesWednesday at 8:51 AM

PHP2Shell: Critical PHP vulnerabilities patched, update now!

The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. Who is affected? Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups … More → The post PHP2Shell: Critical PHP vulnerabilities patched, update now! appeared first on Help Net Security.

Read at Help Net Security

Unit 42Security updatesWednesday at 8:40 AM

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.

Read at Unit 42

CyberScoopSecurity updatesWednesday at 8:40 AM

Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. The post Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities appeared first on CyberScoop.

Read at CyberScoop

Dark ReadingMalware & threatsWednesday at 8:00 AM

Decades-Old Windows Utility Powers Modern ClickFix Attack

The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.

Read at Dark Reading

SecurityWeekMalware & threatsWednesday at 7:57 AM

Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities. The post Memory Bugs Account for Most of Chrome’s 353 New Security Fixes appeared first on SecurityWeek.

Read at SecurityWeek

SANS ISC

SANS ISCSecurity updatesWednesday at 7:44 AM

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. 

Read at SANS ISC

Your community, one tap away.

Installation instructions

Forum layout

More industry reporting

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP2Shell: Why websites are going offline for emergency security updates

Widespread PHP Flaw May Cause Many Site Outages Today

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Two critical RCEs in PHP core

PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

PHP ships emergency patches for critical PHP2Shell flaws

“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

ClickFix has never been bigger, and AI tools are its most convincing lure yet

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP2Shell: Critical PHP vulnerabilities patched, update now!

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities

Decades-Old Windows Utility Powers Modern ClickFix Attack

Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)