PHP2Shell Live — verified updatesIndependent, source-linked tracking of the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619: what is confirmed, what is reported, what is still unknown.https://php2shell.live/enIndependent publication; source links remain the property of their publishers.23 October: attack reports and a separate session-upload advisoryhttps://php2shell.live/news/attack-scale-and-session-flaw/https://php2shell.live/news/attack-scale-and-session-flaw/Security Affairs, citing Censys, reported an estimated 34.4 million vulnerable PHP services; the reports reviewed do not confirm a real-world RCE. PHP also issued a separate session-upload advisory.Fri, 23 Oct 2026 15:45:00 GMTPHP2ShellCVE-2026-115560ExploitationExposureEarly assessment: patches, attempts and unresolved questionshttps://php2shell.live/news/first-48-hours-assessment/https://php2shell.live/news/first-48-hours-assessment/What the first day of PHP2Shell reporting established: the fixes are confirmed, attempts are documented, exposure estimates disagree, and no confirmed mass compromise has been publicly established.Thu, 22 Oct 2026 16:45:00 GMTAssessmentPHP2ShellEvidenceCloudflare reports millions of PHP2Shell attempts after disclosurehttps://php2shell.live/news/cloudflare-exploit-attempts/https://php2shell.live/news/cloudflare-exploit-attempts/The WAF provider deployed protections about nine hours before disclosure and then tracked a steep rise in attack traffic. It still says customers must patch.Thu, 22 Oct 2026 16:45:00 GMTCloudflareWAFExploitationAmazon saw a PHP2Shell exploitation attempt four days before patcheshttps://php2shell.live/news/exploitation-before-patches/https://php2shell.live/news/exploitation-before-patches/A honeypot attempt on 17 October predates the leak and the public advisory. SecurityWeek reports that PoCs circulated hours before disclosure, but attempts are not confirmed compromises.Thu, 22 Oct 2026 16:45:00 GMTExploitationPHP2ShellEvidenceFake PoCs, prank repositories and one failed webshell attempthttps://php2shell.live/news/fake-pocs-and-failed-attempts/https://php2shell.live/news/fake-pocs-and-failed-attempts/Researchers describe a messy exploit ecosystem: some public PoCs do not work, some crash targets, and at least one repository was a prank. That does not make the underlying flaw less serious.Thu, 22 Oct 2026 16:45:00 GMTPoCExploitationResearchCERT-EU, NCSC and CISA issue alerts as some sites go offlinehttps://php2shell.live/news/government-alerts-sites-offline/https://php2shell.live/news/government-alerts-sites-offline/The official advice is consistent: patch immediately, restart workers, and isolate if that is not possible. Some organisations chose to take services offline rather than wait.Thu, 22 Oct 2026 16:45:00 GMTCERT-EUNCSCCISAAdvisoryNode.js fixes a Brotli decoder RCE in a same-day releasehttps://php2shell.live/news/nodejs-brotli-security-release/https://php2shell.live/news/nodejs-brotli-security-release/CVE-2026-111497 is a Node.js core flaw, not PHP2Shell and not an npm package issue. It is a useful reminder to keep runtime and package inventories separate.Thu, 22 Oct 2026 16:45:00 GMTNode.jsBrotliRCEPatchPHP Foundation calls the two-year delay a 'structural failure'https://php2shell.live/news/php-foundation-structural-failure/https://php2shell.live/news/php-foundation-structural-failure/The Foundation says signs appeared in a 2024 audit, competing fixes stalled, and AI-assisted review plus external reports forced the issue back to the top in August 2026.Thu, 22 Oct 2026 16:45:00 GMTPHP FoundationDisclosureProcessPHP ships emergency fixes for two critical pre-auth RCE flawshttps://php2shell.live/news/php-releases-php2shell-fixes/https://php2shell.live/news/php-releases-php2shell-fixes/PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix CVE-2026-109618 and CVE-2026-109619. The flaws sit in the runtime, so updating a CMS or plugin is not enough.Thu, 22 Oct 2026 16:45:00 GMTPHP2ShellPHPRCEPatch