Act
active
Public PHP2Shell scanner targets CVE-2026-109618/-109619 LFI chain
- Engineer — Act: A turnkey scanner for the handler-mismatch + LFI → shell chain is now trending on GitHub, lowering the bar for mass exploitation; any PHP deployment should be patched to fixed versions for CVE-2026-109618 and CVE-2026-109619 and audited for handler misconfigurations immediately, even though EPSS is low and KEV is not yet triggered.
- SOC/IR — Plan: A no-dependency scanner trending on GitHub means opportunistic exploitation attempts against PHP hosts are likely soon; build or tune detections for LFI probe patterns and php2shell session-chain anomalies (unusual session handler requests followed by file-read behavior) in web server and WAF logs before active campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.