SHELLPROOF

⚠️ ALERT: More “Black October” PHP2SHELL breach reports are emerging, including a massive new allegation involving PwC. Everest group claims to have stolen 590.69 GB of PwC files, including sensitive employee and HR data. Many other verified breaches have emerged such as Capcom's exposure of 11.77 million email addresses, and Onamae Cloud's discovery of malware on customer servers. These incidents are a reminder to do our part to protect our accounts. Here are 5 precautions to take to stay safe: 1. Expect fake “Breach alerts” “Your account was exposed.” “Install this emergency security update.” “Verify your details to avoid suspension.” A real incident gives scammers a believable story. Open the company’s app or use a saved bookmark to check. Don’t use the link or phone number supplied in an unexpected message. 2. Don’t install a “PHP security patch” from a message PHP2Shell is a server-side problem. Ordinary visitors do not need to install PHP software on their phone or laptop to browse. Keep your browser, operating system and apps updated through their built-in settings or official stores. Do not follow a website’s instructions to paste commands, install certificates or disable security protections to “fix” this incident. 3. Check your accounts for changes Look for unfamiliar devices, changed recovery details, unexpected purchases and messages you didn’t send. For email, check forwarding rules and filters too. An attacker can use them to keep receiving your messages. 4. Secure your main email first Your inbox receives password-reset links for other accounts. Give it a unique password, review its recovery email and phone number, and enable a passkey or two-factor authentication. 5. Use passkeys where available Passkeys resist fake login pages because they are tied to the genuine service. Where passkeys aren’t available, enable two-factor authentication. Prefer a security key or authenticator app where supported. We can’t prevent every company breach. But unique passwords, passkeys and quick action can help stop one breach from spreading to our other accounts.

The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.