> We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.
https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619
#php2shell #php #CVE #eitw
ssvc
npub1dv…jfshx
2026-10-21 16:57:33 UTC
in reply to nevent1q…2cxm
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-10-21 16:57:33 UTCEvent JSON
{
"id": "88d1c1d9e38bc7bec337ea00bc95243739271bad91fbf85e9a69df81ac9068bd",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1792601853,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@ssvc/117479955081578128",
"web"
],
[
"t",
"eitw"
],
[
"e",
"4f145a627ea416188f85979ebea2f8ac4d0a2524df81ce65912e41aaab4f96d3",
"",
"root",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"cve"
],
[
"t",
"php"
],
[
"p",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"t",
"php2shell"
],
[
"e",
"9b8d06611f0ae8feaf567e13a1830300b9bd09b4f6e39f7929f2a3cb54aff1f8",
"",
"reply",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117479955081578128",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117479955081578128",
"pink.momostr"
],
[
"-"
]
],
"content": "\u003e We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.\n\nhttps://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619\n\n#php2shell #php #CVE #eitw",
"sig": "7e56e2114cad6875df34d0a72260d43fa703eb59529606b2a246aa8f4dab4edaa54506e9f4066d89cc254672d694e3ed376986f354bc838d3f7464da1e669f93"
}