Supply-chain news — Is It Dead Yet?

Follow these headlines in your RSS/Atom reader. Included with Free; a verified account is required. Set up your feed → · Your profile →

Up to 50 matching topic groups, latest coverage first. Clear search

Recent headlines · 4

Last completed feed check: 2026-11-06T07:44:38.019Z.

2 sources could not be refreshed

Infostealers, CERT-FR. They will be retried on the next poll.

News topics ordered by latest coverage; first recorded report, key topic, publisher and linked coverage
Latest · UTC	First report	Key topic	Publisher
10-26 16:12	PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560] ↗CVE-2026-109618 +2 · Snyk Blog · 2026-10-26 16:12 UTC 1 more reports First recorded report: Snyk Blog · 2026-10-26T04:00:00.000Z Related coverage: 26th October – Threat Intelligence Report ↗ Check Point Research · 2026-10-26 16:12 UTC Article mentions: CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560 No unambiguous tracked-package match.	CVE-2026-109618 +2	Snyk Blog
10-23 20:04	PHP2Shell: All You Need to Know About CVE-2026-109618 and CVE-2026-109619 ↗CVE-2026-109618 +1 · JFrog Security Research · 2026-10-23 20:04 UTC 44 more reports First recorded report: JFrog Security Research · 2026-10-21T00:00:00.000Z Related coverage: PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation ↗ Datadog Security Labs · 2026-10-21 00:00 UTC PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes \| CVE-2026-109618 and CVE-2026-109619 ↗ Aikido Security Blog · 2026-10-21 01:54 UTC Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now ↗ Qualys Threat Research Unit · 2026-10-21 02:59 UTC PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws ↗ SecurityWeek · 2026-10-21 07:02 UTC PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert ↗ The Hacker News · 2026-10-21 09:05 UTC PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws ↗ Security Affairs · 2026-10-21 10:13 UTC Critical Vulnerabilities in PHP Require Immediate Patching ↗ CISA Alerts & Advisories · 2026-10-21 12:00 UTC PHP releases emergency fixes for 2 critical vulnerabilities ↗ CyberScoop · 2026-10-21 13:40 UTC PHP2Shell: Critical PHP vulnerabilities patched, update now! ↗ Help Net Security · 2026-10-21 13:51 UTC PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet ↗ Wiz Blog · 2026-10-21 13:59 UTC NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP ↗ NCSC Netherlands · 2026-10-21 14:01 UTC PHP ships emergency patches for critical PHP2Shell flaws ↗ BleepingComputer · 2026-10-21 14:07 UTC PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched ↗ The Register Security · 2026-10-21 15:08 UTC Two critical RCEs in PHP core ↗ Cisco Talos Intelligence · 2026-10-21 15:10 UTC Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) ↗ Kaspersky Securelist · 2026-10-21 15:18 UTC CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP ↗ Rapid7 Blog · 2026-10-21 15:22 UTC Widespread PHP Flaw May Cause Many Site Outages Today ↗ Krebs on Security · 2026-10-21 15:26 UTC PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline ↗ Socket Blog · 2026-10-21 15:28 UTC PHP2Shell: Why many websites had to go offline ↗ Malwarebytes Labs · 2026-10-21 16:14 UTC PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ↗ SecurityWeek · 2026-10-21 16:50 UTC PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches ↗ Socket Blog · 2026-10-21 19:06 UTC 'PHP2Shell' Bugs Signal Red Alert for Security Industry ↗ Dark Reading · 2026-10-21 19:19 UTC Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) ↗ SANS Internet Storm Center · 2026-10-21 21:02 UTC Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot ↗ AWS Security Blog · 2026-10-21 22:36 UTC PHP blames supply chain security biz Chainguard for putting entire web at risk ↗ The Register Security · 2026-10-21 23:02 UTC PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk ↗ The Register Security · 2026-10-21 23:02 UTC Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) ↗ AWS Security Blog · 2026-10-22 00:50 UTC Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed ↗ The Hacker News · 2026-10-22 06:34 UTC What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers ↗ Help Net Security · 2026-10-22 10:22 UTC New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 ↗ Help Net Security · 2026-10-22 12:03 UTC Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure ↗ The Register Security · 2026-10-22 12:15 UTC Tech and Security Companies Respond to PHP2Shell Vulnerabilities ↗ SecurityWeek · 2026-10-22 12:20 UTC SonarQube container scanning is now in open beta ↗ Sonar Blog · 2026-10-22 13:00 UTC Responding to php2shell PHP Vulnerability When You Don’t Know What Secrets Are Deployed ↗ GitGuardian Blog · 2026-10-22 14:11 UTC PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports ↗ Security Affairs · 2026-10-22 14:55 UTC PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) \| Endor Labs ↗ Endor Labs Blog · 2026-10-22 15:20 UTC Hackers got a four-day head start on epic PHP2Shell vulnerability ↗ Ars Technica Security · 2026-10-22 15:25 UTC PHP2Shell puts dozens of UK government services out of service ↗ The Register Security · 2026-10-22 16:05 UTC PHP2Shell exploit bypasses protections designed to stop remote code execution ↗ The Register Security · 2026-10-22 20:37 UTC PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware ↗ The Hacker News · 2026-10-23 07:40 UTC PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet ↗ Security Affairs · 2026-10-23 10:52 UTC Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge ↗ SecurityWeek · 2026-10-23 12:45 UTC Understanding PHP2Shell Vulnerabilities and Reducing Risk While You Patch ↗ Fortinet Blog · 2026-10-23 13:00 UTC (Reliable)? php2shell exploitability, (Fri, Oct 23rd) ↗ SANS Internet Storm Center · 2026-10-23 20:04 UTC Article mentions: CVE-2026-109618 · CVE-2026-109619 org.apache.logging.log4j:log4j-core · Checked after news was detected	CVE-2026-109618 +1	JFrog Security Research
10-23 20:04	Cloudflare deploys protections against php2shell vulnerability ↗CVE-2026-109618 +2 · Cloudflare Blog · 2026-10-23 20:04 UTC 2 more reports First recorded report: Cloudflare Blog · 2026-10-21T13:56:45.000Z Related coverage: PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches ↗ Security Affairs · 2026-10-23 18:07 UTC There's a third PHP2Shell bug, but it won't get an emergency fix ↗ The Register Security · 2026-10-23 20:04 UTC Article mentions: CVE-2026-115560 · CVE-2026-109618 · CVE-2026-109619 No unambiguous tracked-package match.	CVE-2026-109618 +2	Cloudflare Blog
10-23 11:25	PHP2Shell Makes PHP Inventory and Patch Ownership Urgent ↗CVE-2026-115560 · Sonatype Blog · 2026-10-23 11:25 UTC 1 more reports First recorded report: Sonatype Blog · 2026-10-21T15:56:40.000Z Related coverage: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches ↗ The Hacker News · 2026-10-23 11:25 UTC Article mentions: CVE-2026-115560 No unambiguous tracked-package match.	CVE-2026-115560	Sonatype Blog

Reviewed incident reports · 0

Last reviewed 2026-10-08. Selected historical incidents; a past compromise does not establish that a current release is compromised.

No reviewed stories match these filters. This does not mean no incidents have occurred.

About this feed and search

Search stored headlines, publishers, article mentions and matched package names, plus reviewed-report summaries. Full article bodies are not searchable. Coverage with the same specific topic is grouped within a 72-hour episode. Each row links to its earliest recorded report; later coverage is linked under Details. Roundups, generic platforms and separate campaign waves are not merged on a broad mention alone. Multiple reports are not independent corroboration. Ecosystem filtering uses package matches, so unmatched articles are excluded when you select an ecosystem.

Article mentions identify terms, not confirmed affected products or versions. Package links are automated leads, not confirmed vulnerability findings. Maintenance checks do not prove an affected version is safe.

Selected vulnerability advisories · 0

Sources and package mappings checked 2026-10-08. This is a manually reviewed selection of historical advisories, not a current exploitation ranking or complete CVE database. The news headlines above update separately.

An identity match is a reason to investigate, not confirmation that your installed release is vulnerable. Manifest checks do not establish runtime configuration or resolve every transitive dependency.

Vulnerability	Product / package relationship

No selected advisories match these filters. This is not a security clearance.

Runtime advisories on OpenCVE

Browse CVEs by vendor and product. Runtime CVEs do not automatically apply to every package in that ecosystem; verify affected versions and configurations.

News sources · 81 configured feeds

The news worker checks for due feeds one minute after each completed run. Individual feeds use one-, two- or ten-minute intervals; slow requests can delay a check. Clear tracked-package mentions trigger priority checks; they do not establish that an installed version is vulnerable. Sources without an RSS link and Feedspot’s directory are browsing resources. Reviewed reports above remain curated.

Security news and research

Recent headlines · 4

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560] ↗CVE-2026-109618 +2 · Snyk Blog · 2026-10-26 16:12 UTC

PHP2Shell: All You Need to Know About CVE-2026-109618 and CVE-2026-109619 ↗CVE-2026-109618 +1 · JFrog Security Research · 2026-10-23 20:04 UTC

Cloudflare deploys protections against php2shell vulnerability ↗CVE-2026-109618 +2 · Cloudflare Blog · 2026-10-23 20:04 UTC

PHP2Shell Makes PHP Inventory and Patch Ownership Urgent ↗CVE-2026-115560 · Sonatype Blog · 2026-10-23 11:25 UTC