Latest updates for Php2Shell

Fresh curated links around PHP2Shell are collected here so marketers can spot useful updates and turn timely ideas into posts faster.

Recent items include:

  • PHP2Shell: How to Find Vulnerable PHP Versions on Your Devices
  • PHP2Shell (CVE-2026-109618/19): Broadcom & VMware Impact & Mitigation
  • PHP2Shell: Turning a Session Upload-Progress UAF into Unauthenticated RCE (CVE-2026-109618 / CVE-2026-109619)

Post angles to try

Share the most useful takeaway for your audience.
Turn one article into a quick practical checklist.
Ask your audience how this shift affects their work.
Turn angles into scheduled posts

Fresh articles and ideas

Recent curated links from global sources. Generate one free draft from any story, then use SocialBu to schedule and refine your content calendar.

blog.invgate.com /2 days ago

PHP2Shell: How to Find Vulnerable PHP Versions on Your Devices

Last updated: October 21, 2026. We'll update this article as PHP and Linux distributions publish new information. PHP2Shell is the nickname of two critical vulnerabilities in PHP...

Read source
pkguild.com /2 days ago

PHP2Shell (CVE-2026-109618/19): Broadcom & VMware Impact & Mitigation

💥 The Situation <p>On October 21, 2026, the PHP project released emergency patches to address two critical remote code execution</p>

Read source
dev.to /3 days ago

PHP2Shell: Turning a Session Upload-Progress UAF into Unauthenticated RCE (CVE-2026-109618 / CVE-2026-109619)

I published PHP2Shell, a proof-of-concept for two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that enable a heap use-after-free in session.upload_progress...

Read source
theregister.com /1 day ago

PHP2Shell exploit bypasses protections designed to stop remote code execution

“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

Read source
wetcom.com /23 hours ago

PHP2Shell: cómo frenar las vulnerabilidades críticas de PHP sin apagar tus aplicaciones

<p class="wp-block-paragraph">El 22 de octubre se publicaron dos vulnerabilidades críticas en PHP, conocidas en conjunto como <strong>PHP2Shell</strong>...

Read source
jscrambler.com /2 days ago

Security Notice: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP interpreter, known together as “PHP2Shell.” Both are rated 9.2 (...

Read source
ksugle.com /1 day ago

PHP2Shell açıkları: PHP güncellemesi ve Azure WAF

<p>PHP2Shell (CVE-2026-109618, CVE-2026-109619) RCE açıkları için yamalı PHP sürümleri ve Azure Front Door, Application Gateway WAF geçici önlemleri.</p> <p...

Read source
smartermsp.com /1 day ago

Cybersecurity Threat Advisory: Critical PHP2Shell RCE vulnerabilities

PHP recently shipped an out-of-cycle emergency release fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. Both are...

Read source
ubuntu.com /3 days ago

php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available

Introduction Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. The vulner...

Read source
thehackernews.com /1 day ago

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Pota...

Read source
cybersecuritynews.com /1 day ago

Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware

Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware. Known together as PHP2Shell,...

Read source
thehackernews.com /3 days ago

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the...

Read source
thehackernews.com /3 days ago

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12,...

Read source
kodekloud.com /2 days ago

How to Check If Your PHP Website Is Vulnerable to PHP2Shell and Fix It

Check whether your PHP website is vulnerable to PHP2Shell, find patched versions, update your hosting environment, and verify the fix.

Read source
forrester.com /1 day ago

PHP2Shell Leak Sends Security Teams Scrambling

At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory er...

Read source
thehackernews.com /1 month ago

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on Sept...

Read source
bleepingcomputer.com /3 days ago

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as...

Read source
blogs.vmware.com /1 day ago

VCF Helping You Respond to PHP2Shell

<div><img width="300" height="150" src="https://blogs.vmware.com/wp-content/uploads/2026/10/cybersecurity-awareness-banner-1200x600-1.png" cl...

Read source
cybersecuritynews.com /3 days ago

PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers

PHP has released emergency security updates for two critical vulnerabilities that could let unauthenticated attackers run code on vulnerable web servers. Tracked as CVE-2026-109618...

Read source
arstechnica.com /3 days ago

PHP warns it plans to release 2 emergency patches imminently

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

Read source
habr.com /2 days ago

Выживаем при PHP2Shell (CVE-2026-109618 / CVE-2026-109619) на легаси‑стеке: Varnish + Docker + Apache mod_php (PHP 5.6)

21 октября 2026 года мир PHP вздрогнул от анонса двух критических RCE-уязвимостей (CVSS 9.2), получивших общее имя PHP2Shell (CVE-2026-109618 и CVE-2026-109619). Опасность этих бре...

Read source
sourcetrail.com /1 day ago

Critical PHP php2shell flaws force urgent patching and WAF rollouts

PHP 5.4+ carries critical php2shell memory flaws, enabling unauthenticated RCE and data exposure. Patch PHP now and keep WAF rules active. The post Critical PHP php2shell flaws for...

Read source
thehackernews.com /3 days ago

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the securit...

Read source
itmedia.co.jp /1 day ago

PHP2Shell、公表4日前に悪用の試み 「公表日より前にさかのぼって調査を」とAmazon

Amazonの脅威調査チームは、PHPの緊急脆弱性「PHP2Shell」を悪用する試みを公表4日前にハニーポットで検知したと発表した。公開後は悪用が急拡大。AIによる攻撃コード作成の加速を指摘し、対応...

Read source

Turn fresh research into a full content calendar

Use SocialBu to discover ideas, generate post drafts, and schedule them across your social channels.

Sources covering Php2Shell

feeds.arstechnica.com

Recent coverage from public sources
Public source

smartermsp.com

Recent coverage from public sources
Public source

blog.invgate.com

Recent coverage from public sources
Public source

blogs.vmware.com

Recent coverage from public sources
Public source

cybersecuritynews.com

Recent coverage from public sources
Public source

dev.to

Recent coverage from public sources
Public source