{
  "id": 16623724,
  "title": "PHP2Shell: No login, no app code, no warning. What next?",
  "url": "https://urgent.news/2026/10/26/php2shell-no-login-no-app-code-no-warning-what-next-16623724",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T08:00:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336"
  },
  "original_language": "en",
  "account": "PHP2Shell represents two critical flaws that allow unauthenticated attackers to execute code on a server using a simple web request. Both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect every version of PHP prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP is found in various server setups including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk of exploitation is highest on ARM64 systems and those with address space layout randomization (ASLR) disabled. While reliable public exploits are scarce, early attacks have been detected by watchTowr and Cloudflare. Most at risk are internet-facing PHP applications, especially those running mod_php or on ARM64 hosts. Organizations should prioritize patching vulnerable PHP installations and monitor their systems for any signs of exploitation. Tanium Guardian content is available to help detect and prioritize patching of PHP instances across Linux, Windows, and macOS environments.",
  "summary": "PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Black October: what one week of PHP2Shell, LiteLLM and eMudhra says about who scans your code",
        "url": "https://urgent.news/2026/10/26/black-october-what-one-week-of-php2shell-litellm-and-emudhra-says",
        "published": "2026-10-26T16:14:35.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}