watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.
https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
#eitw #php #php2shell #CVE
ssvc
npub1dv…jfshx
2026-10-21 16:22:26 UTC
in reply to nevent1q…rsqd
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-10-21 16:22:26 UTCEvent JSON
{
"id": "9b8d06611f0ae8feaf567e13a1830300b9bd09b4f6e39f7929f2a3cb54aff1f8",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1792599746,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@ssvc/117479816983021081",
"web"
],
[
"t",
"eitw"
],
[
"e",
"d8e67bc0560381e0e6f6c8bd46e1976ac6ea37585a0eca4a84af40a28d093677",
"",
"reply",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"e",
"4f145a627ea416188f85979ebea2f8ac4d0a2524df81ce65912e41aaab4f96d3",
"",
"root",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"cve"
],
[
"t",
"php"
],
[
"p",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"php2shell"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117479816983021081",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117479816983021081",
"pink.momostr"
],
[
"-"
]
],
"content": "watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.\n\nhttps://watchtowr.com/intelligence/php-remote-code-execution-php2shell/\n\n#eitw #php #php2shell #CVE",
"sig": "6a167e3669062d524acc98489cdb34b684fd83518268dc02afb85f2a020d66dc2a238336b605edeb507929967b99a01aceca7fb12bb18e6998f4d38b9efd8076"
}