Daily Briefing

PHP2Shell flaws under active exploitation — one hit a European government within two hours

By The IT Security Desk

Good morning. The Hacker News reports that threat actors are exploiting the PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, which it refers to as PHP2Shell. In one case described by The Hacker News, attackers targeted a government entity in Europe and, within two hours of the initial intrusion, were observed using agentic artificial intelligence platforms for post-exploitation activity. The Hacker News also describes global scanning for the flaws. CVE-2026-109618 carries a CVSS base score of 9.8 and CVE-2026-109619 a CVSS base score of 8.1.

Help Net Security reports that the PHP security team announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC, fixing two vulnerabilities. If you run PHP, match your deployment against the PHP security advisory and apply that release. The vendor advisories are at https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). Given active exploitation reported by The Hacker News, treat patching as urgent and review internet-facing PHP hosts for signs of compromise.

The Hacker News reports that a security researcher published findings this week showing that a single hacked device on a Tailscale network can be used to gain root access to other servers it can reach. The Hacker News states the attack requires two things: Tailscale SSH configured to allow port forwarding, and an attacker who already controls one device on the network. The outlet's headline describes the flaws as unpatched. If you use Tailscale SSH, review whether port forwarding is enabled and whether it needs to be.

Read the full briefing →