Beacon: PHP2Shell Patches Land as First Exploitation Attempts Observed

This story appeared in our weekly cybersecurity newsletter Beacon. Sign up to get weekly updates on the latest news, findings and insights, straight to your inbox every Thursday at 10AM.

Top Story This Week:

PHP2Shell Patches Land as First Exploitation Attempts Observed

Two critical vulnerabilities in PHP, dubbed PHP2Shell, have triggered an urgent security response after researchers demonstrated unauthenticated remote code execution in the widely used server-side scripting language. Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS score of 9.2 and could allow attackers to execute code on affected servers or access sensitive memory.

The flaws affect PHP itself, rather than a specific application, potentially putting websites and services running platforms such as WordPress, Drupal and Joomla at risk. Following the release of emergency patches on October 21, security researchers reported exploitation attempts in the wild, triggering an urgent response across organizations to identify affected systems and apply fixes.

Why it Matters

PHP2Shell is particularly significant because it affects PHP itself, a widely used technology underpinning websites and web applications. The vulnerabilities could allow attackers to execute code remotely on affected servers, making the potential consequences serious for organizations running vulnerable versions. With exploitation attempts reportedly underway, identifying affected systems and applying patches is an urgent priority.

The discovery is also another example of AI helping researchers uncover serious vulnerabilities in widely used technologies. Researchers at Wiz used AI models to help identify PHP2Shell, echoing Searchlight Cyber’s discovery of the wp2shell WordPress Core RCE vulnerability in July this year. Findings such as these demonstrate how AI-assisted research can uncover complex flaws across different layers of the web stack, including vulnerabilities that may have remained undetected for years. For defenders, proactive vulnerability research is more important than ever, as is the ability to respond and remediate without delay when these discoveries become public and attackers begin looking for vulnerable systems to exploit.

What this Means for Practitioners

Organizations should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible. For organizations that can't update immediately, PHP has also outlined measures to reduce exposure to specific attack paths in its advisory.

Where an immediate update is not possible, CERT-EU advises organizations to "consider isolating internet-facing applications from public networks until a fix can be applied." There is however no complete mitigation, with updating the only safe choice.

The UK National Cyber Security Centre advises organizations to inventory PHP systems, prioritize internet-facing ones, and monitor them for malicious activity while applying PHP’s updates.

What this Means for Security Leaders

Focus on the operational advice detailed by PHP, CISA, and NCSC.

Following the response - assess your ability to rapidly respond to the new wave of critical vulnerabilities that require patching, as AI accelerates vulnerability discovery.

Focus on gaining full visibility over your external-facing attack surface with the tooling and processes in place to rapidly remediate.

Cybersecurity bodies expect AI-driven exploitation of technical debt to force a wave of fixes across all software, so you need to be able to patch quickly, often and at scale, including across your supply chain.

Discover More

New Report - AI vs. The Patch Window: What's Changed, and What Hasn't

Our latest report cuts through the hype to examine how AI is accelerating vulnerability discovery, exploitation and disclosure. The biggest shift isn’t a doomsday scenario or a brand-new class of attack. It’s an acceleration of trends teams were already struggling to keep up with. Waiting for disclosure, then patching within a comfortable window, is getting harder to sustain. Read more.

More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE

Searchlight Cyber Labs has revisited Adobe Experience Manager (AEM), and this time achieved full unauthenticated remote code execution on AEM Cloud. Explore the full research and technical breakdown, plus learn why the Labs team decided to take another look at the popular enterprise CMS platform. Read more.

Weekly News Digest

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft, Proofpoint and Japanese law enforcement disrupted a Chinese-language cybercrime marketplace known as YAM Store. The marketplace supplied fraudulent accounts, phishing kits and impersonation infrastructure. The operation disabled more than 20,000 accounts and disrupted infrastructure associated with over 100,000 fraudulent domains. The phishing ecosystem has enabled campaigns targeting users in more than 150 countries. Displaced operators may migrate to replacement marketplaces, private messaging channels or new infrastructure. Intelligence teams should monitor the reappearance of associated phishing kits, domains and vendor identities.

Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Internal messages appearing to be from Silent Ransom Group leaked earlier this month, with the chat export covering a period between late August and late September 2026. Following analysis, notable findings from the leak include attempts at a deliberate rebrand to evade law enforcement, records of alleged payments received from 27 organizations and totalling over $200 million, and confirmation of physical threat vectors involving actors entering victim offices and copying files to a removable storage device.

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

ConnectWise’s Cloud Backup service was used to compromise multiple Microsoft 365 tenants, bypassing MFA protections and benefiting from the previously granted permissions of the application to read and write mail attachments, SharePoint files, and Teams chats. While investigation is ongoing, ConnectWise has shut down customer access to the service, with cybersecurity firms familiar with the matter reporting attempts by attackers to establish persistence via backdoors, privilege escalation by granting Global Administrator roles and creation of additional credentials.