Unverified
Gathered automatically from the outlets below; our newsroom hasn't checked it yet.
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 –…
- New headline Was: “PHP2Shell RCE confirmed in a honeypot; Unit 42 retracts gov-hack link”
- BleepingComputer is now reporting this
- New headline Was: “PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity”
- Our desk filed its story
- New headline Was: “PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking”
15 earlier updates
- New headline Was: “Critical Vulnerabilities in PHP Require Immediate Patching”
- CISA Advisories is now reporting this
- New headline Was: “PHP ships fixes for two critical engine flaws that allow remote code execution”
- Matthew Prince (@eastdakota), Cloudflare CEO (X post) and The Korea Herald are now reporting this
- Our desk updated its story
- Rappler (Reuters) and CNA (Reuters) are now reporting this
- Rappler is now reporting this
- France 24 is now reporting this
- Bangkok Post (AFP) is now reporting this
- Bangkok Post is now reporting this
- Our desk updated its story
- Sanae Takaichi (@takaichi_sanae), Prime Minister of Japan (X post) is now reporting this
- Our desk updated its story
- BBC is now reporting this
- Daily Maverick is now reporting this
How it’s being reported
2 sourcesFirst reported by 
The Hacker News
The Hacker NewsFirstPHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Leads with a figure in the headline.
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the…
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Gives this outlet’s account of the story.
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 –…