The adversary economy: How threat actors are reacting to PHP2Shell
2026-10-23T08:52:11Z•8fcfbe95b1164595a2e02bfb6bb4d79de3208f996d85b74a11167a29bc433c31
CVE-2026-109618CVE-2026-109619CVE-2026-96951AI-agent-identityAI-securityCISA-KEVMicrosoft-Patch-TuesdayOraclePHPPHP2Shellactively-exploitedcriminal-forumsremote-code-executionshadow-AIunauthenticated-exploitationvulnerability-managementzero-day
What happened
Tenable reports that two critical, unauthenticated PHP remote code execution vulnerabilities (PHP2Shell: CVE-2026-109618 and CVE-2026-109619) were exploited before public disclosure and are listed in CISA's Known Exploited Vulnerabilities catalog. Patches are available for supported PHP 8.x branches. The source also covers emergency migration of criminal forums in response to the vulnerabilities, shadow AI governance risks, multilingual AI threat detection, Oracle's October 2026 CPU, AI agent identity security, and Microsoft's October 2026 Patch Tuesday.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- tenable_blog
- Record identifier
- 8fcfbe95b1164595a2e02bfb6bb4d79de3208f996d85b74a11167a29bc433c31
- Enrichment time
- 2026-10-23T08:52:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.