Php-Rce on CuraSec

Public RCE toolkit targets all PHP versions via CVE-2026-109619/109618

Sun, 25 Oct 2026 14:56:19 +0000

Engineer — Act: EPSS 1.00 plus a public, actively maintained exploit toolkit covering PHP 5.4–8.4.26 means exploitation pressure is immediate. Patch PHP to the latest release beyond 8.4.26 and audit any internet-exposed PHP applications for successful exploitation attempts.
SOC/IR — Act: The toolkit’s JA3 impersonation capability specifically evades TLS fingerprint-based detections, requiring tuning beyond standard signatures. Hunt for unauthenticated HTTP sequences matching this RCE chain against PHP endpoints dating back to the toolkit’s first appearance on GitHub.
Leader — Act: A public exploit kit with EPSS 1.00 covering the entire PHP version tree is a systemic exposure on par with Log4Shell in breadth. Confirm this week whether PHP is present across your estate and that engineering has emergency-patched it; be prepared to brief leadership if a breach follows.
Signals: CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources

Fri, 23 Oct 2026 15:44:28 +0000

Engineer — Act: Critical RCE in PHP warrants immediate action given PHP’s ubiquity in web stacks; check your PHP version and apply the patches referenced in the official PHP.net advisory without delay.
SOC/IR — Learn: Advisory contains no IOCs, TTPs, or exploitation activity details; monitor for follow-on reporting with behavioral indicators before building detections.
Leader — Plan: Critical PHP RCE with broad potential exposure warrants a this-quarter inventory of PHP versions in use and confirmation that patching is underway; no confirmed active exploitation or KEV listing yet to escalate further.

Fri, 23 Oct 2026 15:44:28 +0000

Engineer — Act: Active mass exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) with public PoCs on GitHub make patching urgent even though current attacks are reportedly unsuccessful; apply PHP patches for both CVEs now and confirm no internet-facing PHP instances remain on vulnerable versions.
SOC/IR — Act: Millions of in-progress exploit attempts against PHP deployments attempting to install the Potassium Mirai variant provide a clear detection surface; hunt for HTTP request patterns matching known PHP2Shell exploitation attempts and sweep for Mirai/Potassium C2 beaconing from PHP server hosts since campaign start.
Leader — Plan: A mass-scale campaign against widely deployed PHP infrastructure warrants confirming internal PHP exposure this quarter; exploitation is currently failing and neither CVE is KEV-listed, so no board brief is needed yet, but track for escalation if successful compromises are confirmed.
Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources