{
  "id": 17207857,
  "title": "One week after PHP2Shell: attacked in the wild, and now a Linux kernel flaw on top",
  "url": "https://urgent.news/2026/10/30/one-week-after-php2shell-attacked-in-the-wild-and-now-a-linux-kernel",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T09:56:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mikweb2025design/one-week-after-php2shell-attacked-in-the-wild-and-now-a-linux-kernel-flaw-on-top-4a9b"
  },
  "original_language": "en",
  "account": "On 21 October, PHP released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, dubbed \"PHP2Shell.\" Despite the urgency, exploitation began within four days before the patches were released. The scale of potential attacks is large, with over 50,000 exploitation requests from 600 IP addresses in 70 countries. On 28 October, CISA added CVE-2026-46300, a Linux kernel flaw, which an unprivileged user could exploit to gain root access. When combined with PHP2Shell, this poses a significant threat, allowing attackers to take full control of a server, potentially compromising all sites and secrets. Although the actual number of compromised servers remains unknown, CISA advises server administrators to patch PHP and the kernel as soon as possible.",
  "summary": "On 21 October the PHP team released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”). Back then the question was how fast you could patch. A week later the question has changed: were you attacked in the meantime, and what can an attacker do once PHP is breached? 4 daysattacks reported before the patches came out50,000+exploitation requests tracked by TU…",
  "key_points": [
    "PHP released emergency updates for PHP2Shell flaws on 21 October",
    "Linux kernel flaw CVE-2026-46300 allows root access exploitation",
    "Combined threat can compromise servers and all associated sites and secrets"
  ],
  "editors_take": "The combination of these vulnerabilities creates a lethal pathway for attackers to escalate privileges and seize total server control, turning isolated software flaws into a systemic threat to web infrastructure.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}