The adversary economy: How threat actors are reacting to PHP2Shell

Tenable reports that two critical, unauthenticated PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), were exploited before public disclosure and added to the CISA Known Exploited Vulnerabilities catalog. Criminal forums, including BreachForums, reportedly initiated emergency migrations because vulnerable PHP infrastructure could expose member identities, communications and stolen credentials. Patches are available for supported PHP 8.x branches, and organizations should prioritize inventory, patching and threat hunting.