PHP media sweep, 2026-11-09T1420Z

Eleventh sweep under the fixed plan, and the third of the Monday and Thursday schedule (plan, change of 30 October 2026). Discovery only: it finds leads, measures nothing and estimates no coverage. Compared against every earlier sweep file: 2026-10-24T0830Z.md, 2026-10-24T1830Z.md, 2026-10-25T0630Z.md, 2026-10-26T0630Z.md, 2026-10-27T0630Z.md, 2026-10-28T0630Z.md, 2026-10-29T0630Z.md, 2026-10-30T0630Z.md, 2026-11-02T1526Z.md and 2026-11-05T1419Z.md.

Searches run: 2026-11-09, from 14:20 UTC. The six queries were sent in the plan's order, standard mode, one search each, no retry. The tool is US-only and English.
Pages read: four attempted with WebFetch, one request each, at about 14:21 UTC; one read as an article, one returned a blog index rather than an article, two refused (HTTP 403). Nothing was saved. Before any page was opened, each candidate went through scripts/robots_gate.py (provider anthropic); three candidates were refused and not opened (see below).
Comparison: by normalised URL (scheme, leading "www." and trailing slash dropped) against every URL in the ten earlier sweep files, with grep. 96 results returned (10, 14, 19, 16, 17 and 20 per query); 96 distinct URLs; 72 are new, 24 repeat. The result sets differ much more from 5 November's than that sweep's did from 2 November's: the sources listed under queries 2 to 6 changed for most ranks. The tool's ranking, not the news, may explain that.

Results as returned

Titles are as the tool gave them (some shortened or translated where the tool gave a non-English or generic title). [new] marks a URL in no earlier sweep file.

6. `PHP vulnerability affected products vendors patch`

[new] PHP ships emergency patches for critical php2shell flaws enabling remote code execution (Dealroom): https://app.dealroom.co/news/note/php-ships-emergency-patches-for-critical-php2shell-flaws-enabling-remote-code-execution
[new] Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow] (SANS ISC, story 44534): https://isc.sans.edu/diary.html?storyid=44534
[new] (same title, SANS ISC, story 30926): https://isc.sans.edu/diary.html?storyid=30926
[new] (same title, SANS ISC, story 38433): https://isc.sans.edu/diary.html?storyid=38433
[new] php rce flaws patch october 2026 prepare now (Rescana): https://rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now
Update issued for critical PHP vulnerabilities: Security agencies warn patch now or take systems offline (ITPro): https://itpro.com/security/fixes-issued-for-critical-php-vulnerabilities-security-agencies-warn-patch-now-or-take-systems-offline
[new] PHP Security Update Advisory (AhnLab ASEC): https://asec.ahnlab.com/en/79453/
NordVPN Promotion (CircleID): https://circleid.com/posts/php-releases-emergency-security-patches-as-researchers-report-exploit-attempts
[new] cve.circl.lu (search, vendor php): https://cve.circl.lu/search?vendor=php
[new] Running self-managed GitLab? Critical flaws could allow server code execution (LinuxSecurity): https://linuxsecurity.com/news/server-security/php-vulnerabilities-emergency-updates
[new] vulnerability.circl.lu (search, vendor php): https://vulnerability.circl.lu/search?vendor=php
[new] CVE-2023-3824 (GCVE-0-2023-3824): https://db.gcve.eu/vuln/cve-2023-3824
[new] Refine your search (circl, vendor PHP): https://cve.circl.lu/search?vendor=PHP
[new] db.gcve.eu (search, vendor php): https://db.gcve.eu/search?vendor=php
PHP ships emergency patches for critical PHP2Shell flaws (BleepingComputer): https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0818
[new] Action not permitted (CVE-2026-7568, page 3): https://vulnerability.circl.lu/vuln/CVE-2026-7568?page=3
Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-1007
php2shell affected products list: https://securityonline.info/php2shell-affected-products-list/
Action not permitted (CERT-FR 2025 item): https://db.gcve.eu/vuln/certfr-2025-avi-0209

Tool summaries (unread except where read below):

Query 1: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) exploited; honeypot operators recorded successful exploitation against an Apache mod_php setup on PHP 8.4.26, "caught by Adel Karimi" of Perplexity (the tool's account); CISA added both to its catalogue; fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4, 8.0 and 8.1; CVSS v4 9.2; a possible process-memory exposure of credentials. CVE-2026-115560 has "no patch yet" with PHP mitigation guidance. The tool warns that some results are dated inconsistently. CVE-2024-4577 results are an older flaw.
Query 2: the tool's account is that the flaws are a memory-handling bug and a state-left-between-requests bug, both 9.2, fixes on 21 October; "first instances of PHP2Shell scanning" seen "over 5 hours before" the CVEs were published (this matches the F5 page read below); the tool names advisory identifiers GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, not retrieved. Several results are exploit or scanning tool repositories; none was opened.
Query 3: informational notice of 23 October; trigger needs session.serialize_handler set to php_binary or php_serialize and switched to php at runtime before session_start(), with upload progress enabled; unscored; no patch; mitigation session.upload_progress.enabled=0 until the next regular bugfix release; "No exploitation ... has been reported yet"; one outlet's 9.2 score looks to the tool like the other flaw's. It did not verify NVD. Nothing on a version scope or fix.
Query 4: shutdowns in the Netherlands, Finland, Germany, France, Belgium and the Czech Republic, the UK's Office for Budget Responsibility, some councils and Wikipedia's operator; FBI and NSA advice to take systems offline; Cloudflare "millions of attempts"; Amazon said the flaw is "being broadly exploited in the wild" (tool's account); Belgium's cybersecurity centre recorded no attacks; Valtori called its shutdown precautionary.
Query 5: Calif found one flaw with GPT-5.6 Sol; Wiz found both with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; Wiz found the first on 19 August and reported on 24 August; patches 21 October. It sets SmartScope's argument (human researchers used AI as an assistance tool) against Wiz's and Google's accounts. Model names unverified.
Query 6: fixed upstream versions as above; PHP 8.1 and older have no official fixes, with limited source patches for 7.4, 8.0 and 8.1; the tool says a tracker names QNAP, Synology and Sophos, and that Cisco published an advisory; many vendors' fixed builds were still pending at the tracker's snapshot. These concern the two fixed flaws, not CVE-2026-115560.

Totals: 96 results, 96 distinct URLs; 72 new, 24 repeated (query 1: 6 new of 10; query 2: 14 of 14; query 3: 13 of 19; query 4: 13 of 16; query 5: 13 of 17; query 6: 13 of 20).

New since earlier sweeps

The 72 new URLs are marked in the results above. By query: query 1, six (cybersecuritynews.com, bankinfosecurity.com, two op-c.net pages, securityweek.com, cybermagazine.com); query 2, all fourteen; queries 3 to 6, thirteen each. Several are syndicated copies of a piece already seen (the Reuters-style and local-station copies under query 4), repository or tag pages, or older-flaw items.

Which pages were opened

The plan's rule is the four highest-ranked new results that make a claim of fact. In query order those were cybersecuritynews.com (query 1, rank 3), bankinfosecurity.com (query 1, rank 5), securityweek.com (query 1, rank 8) and cybermagazine.com (query 1, rank 9); the two op-c.net pages concern the older CVE-2024-4577 and were passed over. The robots gate refused two of the four:

cybersecuritynews.com: not fetched (robots.txt); the gate could not reach the site's robots.txt ("robots.txt unreachable; not fetched in this run").
bankinfosecurity.com: not fetched (robots.txt); disallowed for ClaudeBot (Disallow: /).

The next two new candidates in order were then gated: buildwithangga.com (query 2, rank 1), not fetched (robots.txt), disallowed for ClaudeBot (Disallow: /); and the Level Up Coding page (query 2, rank 2), passed over because the tool titled it "Member-only story" (a login wall is not something to get around). The four pages actually requested, all allowed by the gate, were securityweek.com (query 1), cybermagazine.com (query 1), localtonet.com (query 2, rank 3) and F5 Labs (query 2, rank 4). One request each, no retry. WebFetch returns a small model's answer to a prompt, not the page text, so the quotations below are unverified.

Pages read

A. SecurityWeek, "PHP2Shell patches land as first exploitation attempts hit sensors"

URL: https://securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors
Attempted 2026-11-09 at about 14:21 UTC. Status: HTTP 403; nothing read. No retry. The robots gate had allowed it.

B. Cyber Magazine, "Decade-old Critical PHP2Shell Bugs Put 70% Websites at Risk"

URL: https://cybermagazine.com/news/how-critical-php2shell-bugs-put-70-websites-at-risk
Attempted 2026-11-09 at about 14:21 UTC. Status: HTTP 403; nothing read. No retry. The robots gate had allowed it.

C. Localtonet, "24 min read" guide to PHP2Shell

URL: https://localtonet.com/blog/php-2-shell-vulnerability-guide
Read: 2026-11-09 at about 14:21 UTC, page returned, but WebFetch's answer was that it is a blog index (listing 509 posts), not an article. No claim of fact about the flaws was read. Page's own date: none for the article. Recorded as not read as an article; the guide itself may have moved.

D. F5 Labs, "PHP2Shell exploitation attempts observed"

URL: https://f5.com/labs/articles/php2shell-exploitation-attempts-observed
Read: 2026-11-09 at about 14:21 UTC, page returned. Page's own date: 22 October 2026 (shown as 10/22/2026); byline Adam Metcalfe-Pearce, "Threat Researcher, F5". A vendor's research post, so a first-party source for F5's own sensors.
Claims, each reported by the page:
- It reports that F5 saw scanning before disclosure: "we saw the first instances of PHP2Shell scanning", at 08:36 UTC on 21 October 2026, "over five hours before the CVEs were published", and that details "leaked onto public channels" the evening before coordinated disclosure. The source is F5's own honeypots and sensors ("a global network of honeypots and other sensors").
- It reports volume and shape: "recording thousands of exploit attempts", with CVE-2026-109619 making up "around 98%" of attempts and CVE-2026-109618 "around 2%", and three request patterns (a self-identified verification probe, repeated minimal triggers with rotating session IDs, and one large out-of-memory-style payload). It makes no claim that any attempt succeeded.
- It reports that both flaws are use-after-free bugs reached through the session upload-progress feature, scored 9.8 (CVSS) by F5 where PHP's own score is 9.2, that fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that disabling "the vulnerable upload progress tracking feature" and a WAF virtual patch are interim measures. Primary source named: F5 Security Advisory K000163821, not read.
- It makes no claim about AI and does not mention CVE-2026-115560.

Triage

Leads for the driving session (none read under a protocol):

F5 Labs' report of first scanning at 08:36 UTC on 21 October, over five hours before publication, with details leaked the evening before. This is an exploitation-attempt report with a stated source (F5's own sensors). It is a new source and an earlier timing than Amazon's 17 October honeypot attempt only in the sense of F5's own observation; the 17 October report is earlier. It reports attempts, not successful compromise. The public account's treatment of pre-disclosure attempts could compare the two clocks; F5's advisory K000163821 is the primary source to read first.
F5's use of "session upload-progress feature" as the route to the two fixed flaws, and its 9.8 score against PHP's 9.2: a detail that could be confused with CVE-2026-115560, which also involves upload progress. The F5 page says nothing about that CVE. Not a version scope or fix for it.
Query 1 tool summary: honeypot exploitation on PHP 8.4.26 credited to a Perplexity researcher, and CISA's catalogue listing; both match what the public account already holds.
Query 4 tool summary: Amazon quoted as saying the flaw is "being broadly exploited in the wild". The tool's account, not read.
Query 5: SmartScope's argument that AI was an assistance tool, not autonomous, set against Wiz's account: a new page (SmartScope) not read.
Query 3: new pages from Wiz's vulnerability database, The Register, Computing, the oss-sec archive (seclists.org/oss-sec/2026/q4/359) and a Taiwanese outlet. None read. The oss-sec thread and Wiz's entry are the places a version scope could first appear; nothing in the tool's summary gives one.
Items carried over, still unread: Unit 42's retracted attribution, PHP's informational advisory for CVE-2026-115560, Red Hat RHSB-2026-013, JPCERT-AT-2026-0033, Amazon, Wordfence, watchTowr, Cloudflare posts, vendor advisories.

Contradiction to record: none new. The query 3 tool summary says no exploitation of CVE-2026-115560 has been reported; the query 4 summary has Amazon calling "the flaw" broadly exploited, which on the other summaries concerns the two fixed flaws.

Not pursued: repository and tag pages, the older-flaw results (CVE-2024-4577, CVE-2023-3824, CERT-FR items), the three WEAR/WLOS/WSET photo-gallery pages and the Level Up Coding member-only page.

Limits

One search tool's ranking, on one day, in English: what it returns depends on its index and on wording, and an absence means nothing. Media restate each other; a claim repeated by many outlets is one claim. The tool's summaries are the tool's, not a reading of the pages, and are not evidence. WebFetch answers through a small model, so quotations are unverified. Of four pages requested, one was read (F5), one was an index, and two returned HTTP 403; three further candidates were not opened because of robots.txt or a login wall. No page read today gives a version scope, a fix, a claim of compromise or a claim of exploitation with a stated source for CVE-2026-115560, and none reports a compromise. Written by a Claude Sonnet 5.5 sub-agent for the driving session; unreviewed.

To the log

F5 Labs reports that its honeypots and sensors saw the first PHP2Shell scanning at 08:36 UTC on 21 October 2026, over five hours before the CVEs were published, and "thousands of exploit attempts" since, about 98 per cent of them for CVE-2026-109619 (F5's post of 22 October, read 9 November; attempts only, no success claimed; sweep file). Nothing on CVE-2026-115560.

PHP media sweep 2026-11-09T1420Z

PHP media sweep, 2026-11-09T1420Z

Results as returned

1. PHP vulnerability exploited in the wild

2. PHP2Shell

3. PHP session upload progress vulnerability CVE-2026-115560

4. PHP vulnerability websites taken offline

5. PHP vulnerability AI discovered Gemini OpenAI Wiz

6. PHP vulnerability affected products vendors patch

New since earlier sweeps

Which pages were opened

Pages read

A. SecurityWeek, "PHP2Shell patches land as first exploitation attempts hit sensors"

B. Cyber Magazine, "Decade-old Critical PHP2Shell Bugs Put 70% Websites at Risk"

C. Localtonet, "24 min read" guide to PHP2Shell

D. F5 Labs, "PHP2Shell exploitation attempts observed"

Triage

Limits

To the log

1. `PHP vulnerability exploited in the wild`

2. `PHP2Shell`

3. `PHP session upload progress vulnerability CVE-2026-115560`

4. `PHP vulnerability websites taken offline`

5. `PHP vulnerability AI discovered Gemini OpenAI Wiz`

6. `PHP vulnerability affected products vendors patch`