English

Posts with #http2shell

#http2shell

Public posts on X that use #http2shell.

Related hashtags

  1. Qualys@qualys
    PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on PHP web servers without logging in, and attacks are already underway. Qualys' Interactive Playbook, blogs, webinar, and onboarding guide help you find, fix, and verify PHP2Shell fast. Link to the webinar: Link to the blogs: #Qualys #Cybersecurity #PHP2Shell #VulnerabilityManagement #InfoSec #CVE
    Download
    024665
  2. Hunt.io✓@Huntio
    PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls One week after the #php2shell patch, around 25 internet-facing #PaloAlto firewalls have been rooted, the first confirmed production compromises. On the open internet, the same bug is still only landing shells on honeypots. We pivoted from the public exploitation reports into our AttackCapture open-directory data to see who is running it. What we found: - ~25 internet-facing Palo Alto PAN-OS firewalls rooted, the first confirmed production compromises. Reported by Dream Research, verified by Unit 42, matched in operator logs we captured. - The chain is two bugs: php2shell lands as nobody on the PAN-OS management interface, then a kernel bug (Fragnesia, CVE-2026-46300) escalates to root. - On the open web, watchTowr, 0x4D31, and GreyNoise see shells only on honeypots. Wiz and CrowdStrike found none. - 616 php2shell files across live open directories: a shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, and cloned PoCs. - One operator handed the exploit research to an AI assistant and left the session log exposed. Full research, IOCs, and detection guidance 👇
    Download
    4215913.5K
  4. PHP Site Audit✓@PHPSiteAudit
    @ilolwasdf
    This is the part most site owners skip. Patching closes the hole going forward. It doesn't answer whether anyone walked through it while it was open. CVE-2026-119977 is a race condition in the WordPress upgrade process itself — the update window was the attack surface. After updating to 7.1.4, check the logs around the upgrade window, look for new admin accounts, and look for stray PHP files. CISA's federal deadline is tomorrow, Nov 6. And it's a separate flaw from PHP2Shell — that's the PHP runtime itself, CVEs 109618/109619. Two flaws, two patches. Not sure your last update landed clean? DM "AUDIT" and we'll check.
    00119
  5. greenido✓@greenido
    PHP2Shell is a CVSS 9.2 unauthenticated RCE in the PHP runtime itself. One internet-facing server is enough for an attacker to get a foothold—no app bug or login required. The real failure mode is usually operational: you don’t even know where all your PHP is running. #PHP2Shell #CyberSecurity
    21176
  6. Hillary Musundi✓@HillaryMusundi
    Running a website on PHP? Patch it now. PHP2Shell (CVSS 9.2) lets attackers run shell commands on your server, exploits are public, and CISA says it's being actively exploited. Minimum safe version: PHP 8.2.35. On 7.4 or 8.1? Upgrade today. #php2shell #CyberSecurity
    Download
    003134
  7. Tom's Hardware@tomshardware
    PHP vulnerability post-mortem reveals bug was known two years ago — Small team of maintainers knew of the issue before it was made public, as new PHP2Shell chained exploit ravages servers
    422764.6K
  8. IEEE Spectrum@IEEESpectrum
    PHP2Shell hints that AI may find legacy bugs faster than we can patch them; the next exploit might not end this safely.
    4141.3K
  9. The Hacker News@TheHackersNews
    🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces. The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending. Read ↓
    Download
    147425956K
  10. Asif Hossain✓@asifhossainn
    After the php2shell patch I wanted to know which servers were actually running the fixed PHP, not just which ones had it installed. A queue worker can keep the old binary in memory long after apt and the scanners say you’re done, so I built a small open-source tool to check.
    Download
    20258
  11. Tech Lead Corner@techleadcorner
    PHP patched two critical remote code execution bugs, PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Update, then restart every PHP worker. Advisory:
    Download
    113329
  12. Aimore✓@aimorebou
    OpenAI’s PHP2Shell checker can say "OK" about a server it never inspected✊ It reads two HTTP headers and compares the version to the patched releases. That’s it. No exploit probes. No scan of the install. Hidden headers: UNKNOWN. Backported fixes: invisible. PHP 8.1 and older: flagged even on the latest patch. OpenAI’s own README: "Even OK only describes the advertised version." Still a useful first look. Patched: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Do you trust a green check that never touched your server?
    Download
    529495
  13. Sentilio.io@sentilio_io
    PHP2Shell is two flaws in PHP itself. Crafted upload requests let attackers run code on the server, no login needed. Exploited before the fixes shipped. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no fix. Updating WordPress does not touch PHP.
    122102
  14. Khubab Ahmed@KhubabbAhmed
    Two memory safety bugs in PHP core = unauthenticated RCE on any unpatched server. No app-level bug needed. CVE-2026-109618 & CVE-2026-109619. CVSS 9.2. 36.7M servers exposed. Full analysis with hands-on lab: #PHP2Shell #CyberSecurity #InfoSec
    Download
    101108
  15. Microsoft Security Response Center✓@msftsecresponse
    PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products. Customers should review the issue-by-issue guidance for updates and actions in environments they manage:
    104319376.7K
  16. Paul Roberts@paulfroberts
    In this clip from the latest @securityledger podcast, @silascutler goes over the numbers from @censysio which tracks the tens of millions of devices vulnerable to #php2shell. Full article here:
    securityledger @securityledger
    In our latest Security Ledger podcast, host @paulfroberts interviews @silascutler of @censysio on both the #php2shell attacks and the hack of refrigeration control systems in France earlier this mont (and - maybe - on U.S. military bases back in August?!). Check out the full post here:
    012200
  17. securityledger✓@securityledger
    In our latest Security Ledger podcast, host @paulfroberts interviews @silascutler of @censysio on both the #php2shell attacks and the hack of refrigeration control systems in France earlier this mont (and - maybe - on U.S. military bases back in August?!). Check out the full post here:
    Download
    001267
  19. kylebot✓@ky1ebot
    This is the "upcoming cyber model" from yesterday. Besides 948 Linux vulns, it found 111 renderer RCEs in Firefox, among which, 81 were novel. 30 were exploits for bugs known to developers that were thought to be unexploitable. We are using this technology to scan more OSS projects and secure the Internet infrastructure. This is just a start.
    OpenAI @OpenAI
    Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment. The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work. GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
    141311520.2K
  20. OpenAI✓@OpenAI
    Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment. The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work. GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
    Download
    73993611K1M
  21. Frelzu✓@Frelzu
    @ky1ebot
    "Bugs known to developers that were thought to be unexploitable" is the scariest line here. PHP2Shell went the same way. PHP saw the first signs in 2024, found no concrete attack path, and had no fix until 2026. "Unexploitable" is starting to look like a deadline.
    Frelzu @Frelzu
    70% of websites run on PHP. And you knew about this bug for two years and said nothing? Are you serious? When I wrote about Black October, I told it like most people did: AI found a 14-year-old bug in about a week. I missed the worse part. In 2024, a PHP core developer found the first signs of the problem behind CVE-2026-109618. A possible exploit was discussed, but nobody found a concrete way in. The team couldn't agree on a fix, and the work kept stalling for months. Then on Aug 11, 2026, Calif reported remote code execution with the same root cause. By October, the bug had a name, patches were rushed out, and Cloudflare was seeing millions of attack attempts. PHP's own foundation calls the delay "a structural failure." AI didn't create this hole. It just ended the time PHP thought it had.
    00139
  22. Frelzu✓@Frelzu
    70% of websites run on PHP. And you knew about this bug for two years and said nothing? Are you serious? When I wrote about Black October, I told it like most people did: AI found a 14-year-old bug in about a week. I missed the worse part. In 2024, a PHP core developer found the first signs of the problem behind CVE-2026-109618. A possible exploit was discussed, but nobody found a concrete way in. The team couldn't agree on a fix, and the work kept stalling for months. Then on Aug 11, 2026, Calif reported remote code execution with the same root cause. By October, the bug had a name, patches were rushed out, and Cloudflare was seeing millions of attack attempts. PHP's own foundation calls the delay "a structural failure." AI didn't create this hole. It just ended the time PHP thought it had.
    418302
  23. Hunt.io✓@Huntio
    @Huntio
    Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)👇 2/7
    Download
    205377
  24. Hunt.io✓@Huntio
    📌 October 2026 Research Recap October brought six investigations covering AI-assisted attacks, exposed attacker infrastructure, critical PHP vulnerabilities, and government data theft. Here’s what we covered last month 👇🧵 1/7 #ThreatIntel #ThreatHunting #CyberSecurity
    Download
    14161.4K
  25. Hunt.io✓@Huntio
    @Huntio
    PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls 👇 3/7
    Download
    205144
  26. Show more posts