October 22, 2026
October 22, 2026 Hash 1f8664efcf4faf37304d1e0e739703005 2d10ae6b31014f501e69a55c87e74476d 323352a66e30c2822a601357f5397ab24 URL 1http[:]//monicamarinhopsi[.]com[.]br/ 2https[:]//monicamarinhopsi[.]com[.]br/ 3http[:]//silkrete[.]com/ IP 1103[.]189[.]208[.]13 2213[.]230[.]127[.]104 3103[.]84[.]236[.]242...
Analysis of the GitHub “php2shell” Repository: Public PoCs and Defense Tools That Spread Immediately After the Disclosure of the PHP Vulnerability
Overview Immediately after the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, a large number of repositories named “php2shell” were created in a short period of time on GitHub, a code repository platform. Of the top 100 repositories (excluding forks) found by searching for “php2shell,” 99 addressed
Reproducing the PHP2Shell Vulnerability and Detection Using AhnLab EDR/XDR
On October 22, 2026, the PHP Security Team announced in an advisory that it would release security updates addressing the vulnerabilities CVE-2026-109618 and CVE-2026-109619. Although the causes of the two vulnerabilities differ, they are both remote code execution vulnerabilities that allow an unauthenticated threat actor to execute arbitrary code remotely.
Vercel Product Security Update Advisory (CVE-2026-96889)
A security update has been released to address a vulnerability in a Vercel product. The affected product is Next.Js, and the Affected Versions are those prior to 15.5.28 And prior to 16.4.1. The vulnerability that has been addressed is CVE-2026-96889, a use-after-free vulnerability (a vulnerability where memory that has already
F5 Product Security Update Advisory
F5 Security Update Advisory F5 has released security updates to address vulnerabilities in NGINX-related products. The affected products are NGINX Plus, NGINX Open Source, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, F5 DoS for NGINX, NGINX App Protect DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.
“Approximately 110,000 PHP Servers” in Korea: How Were They Counted?
After an article titled “Two Critical PHP Vulnerabilities Discovered… Urgent Updates Needed Due to Risk of Web Server Attacks” was posted on the AhnLab website yesterday (October 21), we received many inquiries asking for the basis of the figure “approximately 110,000 Korean PHP server IP addresses” cited in the article.
