Skip to main content

PHP2Shell Security Flaws Now Successfully Exploited

1 week 4 days ago
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. "The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports. "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.

Read more of this story at Slashdot.

BeauHD

Skydance Offers Buyouts, Gives 5-Day RTO Order

1 week 4 days ago
Skydance, as it begins integrating Paramount and Warner Bros. Discovery, is offering voluntary buyouts to some employees and imposing a five-day-a-week office requirement. Layoffs are also expected as the company targets more than $6 billion in annualized cost savings within three years. Variety reports: The new program was outlined by chairman and CEO David Ellison and co-CEO Ynon Kreiz in a memo to staffers Monday. "As we bring our teams together, we recognize that not everyone will see their future here, and we respect that. To give eligible employees the option to move on in a way that works for them, we are introducing a Voluntary Buyout (VBO) Program," the execs wrote. "Those who qualify will receive an individual communication with their personalized details and terms, and a window to decide whether to accept this one-time offer." They added, "Please know we don't take any of this lightly. We are clear about what we're building: a company that tells the stories people around the world love, embraces new ways to connect with audiences, and leads the next era of media and entertainment. We have the talent, the creative firepower and the ambition to do it, and we will get there together." [...] In the Oct. 26 memo, Ellison and Kreiz also said the new Skydance is moving to a mandatory five-days-per-week in-office policy across the company. "We believe in-person collaboration is vital to our culture and to the success of our business. Especially in a creative company like ours, the best ideas come from people in the same room, sharing perspectives, challenging one another and solving problems," the execs said. "We truly believe this is in the best interest of our company and our people. We've seen the benefits firsthand at Paramount, and we want every part of Skydance to share in them."

Read more of this story at Slashdot.

BeauHD