Security researcher James Pavur launched a server intentionally vulnerable to PHP2Shell on October 24, equipped with a bitcoin wallet and offering participants a reward for successfully exploiting it. British pentester Jaydip Modhwadia, known as Killa, achieved remote code execution on October 25 at 15:47 UTC using a Python script and fewer than twenty HTTP requests. The reward, initially set at $500, was raised to $2,000 through community donations, with part of the proceeds set to go to the Lupus Foundation. According to Censys, 32.51 million PHP services were still running vulnerable versions when patches were released. CISA added vulnerabilities CVE-2026-109618 and CVE-2026-109619 to its catalog of actively exploited vulnerabilities, assigning them a severity score of 9.2 out of 10.
Source: Read the original article
