Deutsch

Beiträge mit #HTTP2Shell

#HTTP2Shell

Öffentliche Beiträge auf X, die #HTTP2Shell verwenden.

Verwandte Hashtags

  2. Aikido✓@AikidoSecurity
    Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
    Herunterladen
    1188533.4K816K
  3. caveeroo@caveeroo
    HTTP2Shell (CVE-2026-111497) is exploitable outside Node. Unauth RCE against a pinned vulnerable Docker Official Image for WordPress via /xmlrpc.php. One inbound ASLR on, no leak or cross-request grooming. PoC:
    46127045K
  4. The Hacker News@TheHackersNews
    🚨 PHP2Shell exploited in real-world attacks. An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment. The intrusion extended into the internal network, where the attacker targeted Active Directory. Suspected China nexus. Signs of AI-assisted tooling. Read the full report:
    Herunterladen
    4112258666K
  5. Tenable@TenableSecurity
    #PHP2Shell drew instant Log4Shell comparisons, but a week of testing showed the key difference: a working exploit has to be tuned to each target's exact PHP build. The exception is devices that all run the same build, like network appliances. Our post-mortem covers why both are true, and what it means for your patch prioritization queue:
    1361.1K
  6. GreyNoise✓@GreyNoiseIO
    GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619). On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor. "We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging." - @ImposeCost, SVP of Adversary Operations at GreyNoise This live activity report is derived from GreyNoise data and updates as we observe new activity:
    Herunterladen
    522928K
  7. Aimore✓@aimorebou
    OpenAI’s PHP2Shell checker can say "OK" about a server it never inspected✊ It reads two HTTP headers and compares the version to the patched releases. That’s it. No exploit probes. No scan of the install. Hidden headers: UNKNOWN. Backported fixes: invisible. PHP 8.1 and older: flagged even on the latest patch. OpenAI’s own README: "Even OK only describes the advertised version." Still a useful first look. Patched: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Do you trust a green check that never touched your server?
    Herunterladen
    529467
  8. Wordfence✓@wordfence
    PHP2Shell Update: Still No Confirmed WordPress Compromises - Here's what we've seen from protecting over 5 million WordPress sites: As of October 28, 2026, Wordfence is not aware of any WordPress site compromises through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities. That does not make an unpatched server safe. The fix is still to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed to contain both fixes) and restart PHP. Updating WordPress does not update PHP. Read more in the full post here:
    710556.8K
  9. CyberDefenders®™✓@CyberDefenders
    An HTTP 500 error doesn't always mean an attack has failed. Sometimes, it's just the beginning of the investigation. 🔍 We've put together a practical detection and incident response guide to help you connect suspicious requests, PHP errors, and host activity to uncover signs of compromise. Now, put your investigation skills to the test with our new hands-on lab: GlassHeap - PHP2Shell 1. Start the lab: Read the guide:
    Herunterladen
    207644
  10. GGSec@GGASecDe
    Closing out #php2shell: a universal black-box PoC for PHP's session upload-progress bug. One pure-HTTP chain - arm the allocator, spray fake refs, leak the heap, beat ASLR, turn a destructor into system(). Verified blind on Debian 13 PHP 8.4.24, x86-64 + arm64: RCE as www-data.
    Herunterladen
    37516.4K
  11. 国家サイバー統括室(注意・警戒情報)@cyber_forecast
    【注意喚起】 2026年10月30日、PHPの複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関するJPCET/CCの注意喚起の件に関連して、オランダの国家サイバーセキュリティセンター（NCSC-NL）が本脆弱性の影響を受ける可能性がある製品一覧や対策情報などをまとめたリポジトリーを公開しています。
    214912.4K969K
  13. Tacuns✓@rsg_rishi
    🚨 If you host WordPress, Magento, or any custom PHP app, your clean code will not save you today. A massive set of unauthenticated Remote Code Execution (RCE) vulnerabilities known as #PHP2Shell (CVE-2026-109618 & CVE-2026-109619) just went critical. The nightmare scenario: • The flaw is in the native PHP engine itself. Your application can be 100% secure, but the server is still fully exploitable. • It’s a Use-After-Free bug triggered by out-of-memory errors during web requests. • A third, related RCE (CVE-2026-115560) was also just quietly confirmed. CISA has officially added this to their Known Exploited Vulnerabilities catalog. Threat intel from this week confirms automated bots are successfully compromising unpatched servers within minutes. Human-speed patching is no longer enough. There are no complete workarounds. You have to update the PHP runtime and restart your workers. Is your infrastructure team aware they need to patch the engine today, not just the CMS? 👇
    20073
  14. PHP Site Audit✓@PHPSiteAudit
    @rsg_rishi
    Right instinct — clean code does not save you here. PHP2Shell sits in the engine below your app, so the check has to cover every PHP environment in your infrastructure. One precision point, since it matters for the fix: CVE-2026-115560 is separate from PHP2Shell, not a third PHP2Shell flaw. PHP2Shell is CVE-2026-109618 + CVE-2026-109619, patched Oct 21: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. CVE-2026-115560 is narrower, and its published mitigation is session.upload_progress.enabled=0. For both: patch, restart PHP workers, and verify the version actually serving requests. An audit gives you that answer per system, in writing. DM me "AUDIT".
    10125
  15. Steven Lim✓@0x534c
    GreyNoise - Indicators Associated with Successful php2shell Exploitation Based on 01 November 2026, 03:48 UTC update. DefenderXDR Scan:
    Herunterladen
    16402.9K
  16. DARKMATTER✓@darkmatrx
    Last week: a 14-year-old flaw in the code behind 69% of websites. Now: the US government confirms attackers are using it. PHP2Shell is a pair of bugs in PHP, the language behind WordPress sites, online shops and government portals. What changed: • Oct 21: PHP ships fixes. CISA says no attacks seen yet • Oct 26: CISA adds both bugs to its list of actively exploited flaws • Oct 29: deadline for US federal agencies to patch or take affected systems offline What we know: • Both rated 9.2 out of 10 • No login needed: an attacker can run code on an unpatched server • Amazon logged the first attempt on Oct 17, four days before the fix • Millions of exploit attempts logged since The real risk now: there's nothing to install on your phone or laptop. The fix has to happen on the servers. The risk for you is that a site you use gets breached and your email and password leak with it. How many sites were actually broken into isn't known yet. Some early claims were retracted. If you reuse one password across sites: change it on your email first, then turn on 2FA.
    Herunterladen
    60201.9K
  17. AlmaLinux@AlmaLinux
    ICYMI, the patched PHP packages for CVE-2026-109618 and CVE-2026-109619 have been rolled out to the production repositories for every PHP stream on AlmaLinux 8, 9, and 10. Learn more about the CVEs and get the patched packages ⤵️
    110533.7K
  18. Jomar✓@J0_mart
    Reproduced on Bun, Python, Node.js and Envoy. Don't publish any new vulnerabilities over the weekend; I want to sleep 🥲 #HTTP2Shell
    OpenAI @OpenAI
    During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below:
    014836
  19. OpenAI✓@OpenAI
    During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below:
    5741K7.1K2.2M
  20. Microsoft Threat Intelligence✓@MsftSecIntel
    Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers
    Microsoft Security Response Center @msftsecresponse
    PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products. Customers should review the issue-by-issue guidance for updates and actions in environments they manage:
    1112379566.6K
  21. Microsoft Security Response Center✓@msftsecresponse
    PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products. Customers should review the issue-by-issue guidance for updates and actions in environments they manage:
    94319376.1K
  22. Aikido✓@AikidoSecurity
    It's been a tough week or so for security and dev teams. You're not alone. PHP2Shell and HTTP2Shell landed in the same few days, and it may get worse before it gets better. We still think defenders come out ahead. Our take on the day after PHP2Shell by @Sooraj_Shah:
    44201.9K
  23. Daniel Púa✓@devploit
    Thanks @TenableSecurity for the mention! They used my php2shell PoC to reproduce CVE-2026-109618/109619 on several PHP 8.4/8.5 setups and wrote up why the exploit is so build-dependent: heap offsets, worker reuse, and why version checks lie. Great read.
    4281316.1K
  25. Mehr Beiträge anzeigen