{
  "id": 16622932,
  "title": "PHP2Shell: No login, no app code, no warning. What next?",
  "url": "https://urgent.news/2026/10/26/php2shell-no-login-no-app-code-no-warning-what-next",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T08:00:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336"
  },
  "original_language": "en",
  "account": "Two critical flaws, CVE-2026-109618 and CVE-2026-109619, named PHP2Shell, allow an unauthenticated attacker to run code on a server using only a crafted web request. Both vulnerabilities affect every earlier release of PHP, and public exploitation has begun. The patch to address these flaws is available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, finding and patching every copy of PHP in an environment is challenging, as PHP often hides in multiple locations. Tanium has released Guardian content to help identify PHP installations across Linux, Windows, and macOS, enabling organizations to prioritize patching efforts and minimize the risk of exploitation.",
  "summary": "PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Black October: what one week of PHP2Shell, LiteLLM and eMudhra says about who scans your code",
        "url": "https://urgent.news/2026/10/26/black-october-what-one-week-of-php2shell-litellm-and-emudhra-says",
        "published": "2026-10-26T16:14:35.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}