PHP2Shell: CVE-2026-109618 and CVE-2026-109619. See how CrowdStrike Falcon helps you identify affected assets and container images, assess risk, and investigate potential exploitation. Watch the technical demo:

After the PHP2Shell vulnerability, every site of mine is being scanned so damn much for "index.php" (none are PHP) Just great, and already dreading what happens if/when there's a vulnerability in the OS or web framework they use

Following the Node2Shell and PHP2Shell incidents, we shipped a workflow to detect which repos may be affected: Detect-2Shell How it works: It finds where the Node or PHP version is listed in Docker image tags, .nvmrc files, IaC, and CI setup steps. First, it finds version references in Python, it checks out whether that version is 🔴 vulnerable, 🟠 unpinned, 🟢 fixed, or ⚪ unknown. Then, it uses AI to look deeper, in places where the version is inside a variable, bundled image, or built from source. The results show where there is risk and guidance for how to fix it. Detect-2Shell is now available for customers with Workflows enabled.

Frontier AI-assisted research found PHP2Shell in code that had been in PHP for years. The time from discovery to exploitation keeps getting shorter. This week, hear from the researchers and experts on the front lines of the PHP2Shell response: CrowdStrike’s @Adam_Cyber, Head of Counter Adversary Operations, CrowdStrike’s Anthony Roman, Detection Product Leader, and @OpenAI's @clintgibler, Cyber Security Research Lead. You’ll learn: ✅ What researchers have learned about PHP2Shell ✅ How adversaries are responding ✅ Clear steps to find affected systems, apply fixes and detect suspicious activity ✅ How to proactively prepare as vulnerability timelines keep shrinking 📆 Streaming globally: ➡️ Americas: October 28 @ 10 a.m. PT | 1 p.m. ET ➡️ Europe: October 28 @ 3 p.m. GMT ➡️ JAPAC: October 29 @ 3 p.m. AEDT | 12 p.m. SGT | 9:30 a.m. IST Register now →

🔒 Quick update on the PHP vulnerability (PHP2Shell) hitting the web this week. AlloX does not use PHP. Anywhere in our stack. • Websites: not affected • Smart contracts: not affected • Your funds: never held by us. Not for a second. No action needed on your side. Stay sharp over the next few days. Plenty of sites out there are still patching. 👉

AWS SAYS AMAZON THREAT INTELLIGENCE IDENTIFIED PHP2SHELL EXPLOITATION PRIOR TO PUBLIC DISCLOSURE IN MADPOT, WITH THE ACTIVITY CONDUCTED BY A THREAT ACTOR, THOUGH IT REMAINS UNCLEAR HOW THE ACTOR ACQUIRED EXPLOIT INFORMATION BEFORE DISCLOSURE

A developer left a PHP server vulnerable to the new PHP2Shell flaws and put a Bitcoin key on it, challenging hackers to steal the funds. After around 19 hours, a researcher known as KillaBoi successfully exploited the vulnerability and extracted the private key. The wallet contained around $2,000, but the key turned out to be linked to the wrong wallet, so the funds couldn’t actually be taken. The dev still confirmed the exploit worked and paid the researcher the prize.

Cregis’s systems and official website are unaffected by the recent PHP2Shell vulnerabilities. For more on what happened and what digital asset businesses should watch out for, check out our latest article: