watchTowr FAQ confirms PHP2Shell PHP flaws exploited in the wild
Security firm watchTowr's FAQ page states that CVE-2026-109618 and CVE-2026-109619 are collectively named PHP2Shell and that the flaws have already been exploited in the wild, according to a report by OSCHINA (开源中国). The report says watchTowr observed the exploitation through its globally distributed Attacker Eye honeypot network, and it describes this as the first source to confirm the bugs moved from theoretical risk to a real threat. The report cites no independent measurement, targeting details or exploitation volume, and the article also notes that the PHP vulnerability had drawn attention from Japan's prime minister.
The report presents this as the first source confirming that the PHP2Shell flaws are being exploited, shifting them from theoretical risk to an active threat for PHP deployments.
PHP 那个惊动日本首相的漏洞，有了代号和更坏的消息。安全公司 watchTowr 的 FAQ 页面确认：CVE-2026-109618 和 CVE-2026-109619 合称「PHP2Shell」，且已在野被利用——这是第一次有信源确认这个漏洞从「理论风险」变成了「现实威胁」。watchTowr 是通过自己的蜜罐网络（Attacker Eye，全球分布）观察到在野利用的，时...