VulnCheck

I'll be talking about the router implant research VulnCheck has been doing at VulnCheck at BSides NoVA this Saturday. We found three implants in ZBT router firmware, reverse engineered them, and ended up registering an abandoned C2 domain to see what would happen. Turns out, hundreds of routers were still calling home. Saturday at 1 PM, Threat Village. https://lnkd.in/ei4-qptc

One of the most common questions we've been getting: just how widely is PHP used across enterprise products? Over the past week, we've been closely monitoring PHP2Shell and processing CPE into our community and commercial products to help defenders see which products are actually affected in their environment. Working from vendor advisories, we're getting early insight into the types of products that bundle PHP, and the footprint is already wide. The graphic below shows insight into just a handful of the impacted products we are tracking right now: firewalls, load balancers, NAS devices, SIEMs, phone systems, and even ICS/OT products. It's not comprehensive, but it's a clear insight into how deep this reaches. This CPE data is free in VulnCheck NVD++: https://lnkd.in/ghhFgCgw Another interesting consideration is how two vulnerabilities require an update for 100s, if not 1,000s of products across an enterprise. We'll keep expanding coverage as more vendor advisories are issued. Bottom line, exposure across internet-facing enterprise products is high. #php2shell #cybersecurity #infosecurity

✅ As of 7 PM ET today, VulnCheck's weaponized exploit for #PHP2shell CVE-2026-109618 supports PHP 8.4.10-8.4.26 with no modifications. Our Canaries are now seeing hundreds of exploit attempts, none of which (at least as of earlier this afternoon) had actually succeeded. ‼️As of this afternoon, we've identified at least one public PoC that successfully bypassed ASLR on x86-64 systems for a single version of PHP (8.4.26) with default heap configurations. In our team's testing, the PoC did not work outside of this specific setup. Validated public PoCs are available to the community in our exploit database here: https://lnkd.in/gxiac47A 📈 Ongoing observations from our research team: https://lnkd.in/gAVmqfW7 #threatintel #cybersecurity #exploits

Throughout the day, the VulnCheck team has been writing exploits and detections, spinning up canaries, and working to understand the impact of PHP2Shell. We’re now observing exploitation of both CVE-2026-109618 and CVE-2026-109619. Caitlin Condon, Jacob Baines, kimber D., David J Bruce and team have been updating our blog with broader visibility from our Canary and Target Intelligence services, including Indicators of Compromise (IOCs) and insight into the PHP software footprint. Honestly, by the time I finished this image, there were already a lot more IOCs and activity appears to be scaling, so please read the blog for the latest and update your PHP: https://lnkd.in/gnS-CnBN #cybersecurity #infosecurity #php #threatintel

If you're using National Institute of Standards and Technology (NIST) NVD and still waiting on CPE for the PHP vulnerabilities today, I recommend trying VulnCheck community's NVD++. The CPE's for CVE-2026-109618 and CVE-2026-109619 were automatically generated within minutes of the CVE's being published. You can access it for free here: https://lnkd.in/ghhFgCgw #cybersecurity #infosecurity

AI is rewriting how vulns get found and exploited. Kimber and Patrick are breaking it down with real campaign data on Oct 28. Come hang out.