One week after PHP2Shell: attacked in the wild, and now a Linux kernel flaw on top
On 21 October the PHP team released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”). Back then the question was how fast you could patch. A week later the question has changed: were you attacked in the meantime, and what can an attacker do once PHP is breached? 4 daysattacks reported before the patches came out50,000+exploitation requests tracked by TU…
On 21 October, PHP released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, dubbed "PHP2Shell." Despite the urgency, exploitation began within four days before the patches were released. The scale of potential attacks is large, with over 50,000 exploitation requests from 600 IP addresses in 70 countries.
On 28 October, CISA added CVE-2026-46300, a Linux kernel flaw, which an unprivileged user could exploit to gain root access. When combined with PHP2Shell, this poses a significant threat, allowing attackers to take full control of a server, potentially compromising all sites and secrets. Although the actual number of compromised servers remains unknown, CISA advises server administrators to patch PHP and the kernel as soon as possible.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
