PHP2Shell: What to know about two critical PHP flaws
2026-10-27T08:51:33Z•0581431a39cd984f00c5ae43d83e1418cecad2bfb217960b4864808aad1c089d
CVE-2026-109618CVE-2026-109619AI-securityAmadeyCVEFamousSparrowMATCHBOILMythicRatatoskrPHPSMB-securitySandwormSecure-BootSparroWockyStealcUAC-0099UEFIYggdrasilbackdoorcritical-vulnerabilityinfostealermalwarephishingquishingransomwarescamsthreat-intelligencevulnerability
What happened
ESET WeLiveSecurity feed covering cybersecurity news and research from June through October 2026. Key items include two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the MythicRatatoskr Go-based backdoor using the Yggdrasil mesh network in a UAC-0099/Sandworm-linked destructive operation, MATCHBOIL downloader activity, the SparroWocky backdoor associated with FamousSparrow, vulnerable UEFI shims capable of bypassing Secure Boot, and disruption efforts targeting Amadey and Stealc. The feed also covers phishing, scams, AI-enabled threats, ransomware, infostealers, supply‑ки
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 0581431a39cd984f00c5ae43d83e1418cecad2bfb217960b4864808aad1c089d
- Enrichment time
- 2026-10-27T08:51:33Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.