The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.
PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs.
Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
You may still encounter offline websites while administrators install the updates and check their systems.
CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks.
The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates.
PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version.
Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix.
For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates.
However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates.
Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said:
“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”
If you’re a website visitor:
If you’re a website owner:
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.
PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs.
Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
You may still encounter offline websites while administrators install the updates and check their systems.
CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks.
The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates.
PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version.
Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix.
For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates.
However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates.
Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said:
“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”
If you’re a website visitor:
If you’re a website owner:
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.
Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).
At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.
While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.
Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.
“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.
Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.
Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.
“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.
Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software.
Login