🤖 PHP2Shell: CVE-2026-109618 & CVE-2026-109619, critical unauthenticated RCE in PHP (mod_php, PHP-FPM, php-cgi, LiteSpeed). Fixed Oct 21 in 8.5.12/8.4.27/8.3.36/8.2.35. Amazon: exploitation began Oct 17, four days before disclosure.
🔗 https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
#CVE #Exploit #CyberSec #PHP
BleepingComputerAmazon says PHP2Shell exploitation began 4 days before patchesSecurity researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.