ActiveFirst logged Friday, October 23, 2026·3 entries
Every entry about this threat, newest first. The status comes from the most recent entry.
Sunday, October 25, 2026 · Midday watch
Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch.
php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35php -v | head -1find /var/www -name '*.php' -newermt 2026-10-17 2>/dev/null | head -50grep -rl 'PHP_SESSION_UPLOAD_PROGRESS' /var/log/nginx /var/log/apache2 /var/log/httpd 2>/dev/nullAssume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach.
ReferencesCVE-2026-109618, CVE-2026-109619
SourcesUnit 42, Recorded Future, The Hacker News
Saturday, October 24, 2026 · Evening watch
Two days into mass scanning for CVE-2026-109618 and CVE-2026-109619, no successful in-the-wild compromise has been confirmed: Sophos withdrew an earlier report of one, Wordfence and Hunt.io saw only failed attempts, and Sansec now says public exploits fail on default PHP settings. That window may not last. VulnCheck reports a working exploit for CVE-2026-109618 that leaks memory to defeat ASLR on x86-64 with error display off, the usual production setup; it is limited to its paying customers for now. Amazon's honeypots logged an attempt on Oct 17, four days before disclosure, so log reviews should start there. Fixed releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); PHP 8.1 and older get no fix, and neither CVE was in CISA KEV as of Oct 23.
php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35php -v | head -1docker images --format '{{.Repository}}:{{.Tag}}' | grep -iE 'php|wordpress|laravel|drupal'grep -rl 'PHP_SESSION_UPLOAD_PROGRESS' /var/log/nginx /var/log/apache2 /var/log/httpd 2>/dev/nullKeep patching to the fixed PHP releases and rebuild PHP base images; for end-of-life PHP, block multipart uploads at the edge if you can, and hunt for POST bodies containing PHP_SESSION_UPLOAD_PROGRESS from Oct 17 onward.
ReferencesCVE-2026-109618, CVE-2026-109619
SourcesSecurityWeek, AWS Security Blog
Friday, October 23, 2026 · Night watch
PHP shipped emergency releases on Oct 21 for two critical flaws that let an attacker without an account run code on a server. Exploit attempts reported since then number in the millions, with attackers trying to install Mirai botnet malware. On Oct 23 PHP flagged a separate, lower-risk session issue that the emergency builds do not fix; it only affects unusual session-handler configurations.
php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35php -v | head -1php -i | grep session.upload_progress.enableddocker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)php:'Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, including container base images. As a stopgap (and to cover the Oct 23 issue), set session.upload_progress.enabled=0.
ReferencesCVE-2026-109618, CVE-2026-109619, CVE-2026-115560
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.