P0Exploit
Apache mod_php Enables PHP2SHELL Remote Code Execution
PHP2Shell — Unauthenticated RCE in mod_php on PHP 8.4.26
Two critical PHP2Shell vulnerabilities allow unauthenticated remote code execution against Apache mod_php builds; researchers observed working shells and decoded cookie data demonstrating RCE. The presence of confirmed shells increases risk to any internet-facing mod_php endpoints and embedded products that include vulnerable PHP runtimes.
BLEEPINGCOMPUTER · PHP2Shell Flaws Exploited in the Wild Across Apache mod_php
P1Exploit
Brotli Decoders Trigger HTTP2SHELL Memory Corruption
HTTP2Shell Memory Issue in Brotli Decoders
A critical Brotli decoder flaw can cause memory corruption and potential remote code execution when processing malicious Brotli data; vendors including Microsoft, Google, Node.js and Python package maintainers issued emergency fixes. The vulnerability affects client and server decoders, expanding risk beyond single platforms to libraries used across ecosystems.
BLEEPINGCOMPUTER · Critical HTTP2Shell Brotli Flaw Prompts Emergency Patches
P2Supply chain
Threat Actor Infects 953 Online Stores with Loader
953 stores infected over campaign since July 2025
Researchers attribute a long-running campaign that infected 953 online stores with a loader, using rotating domains and Cloudflare hosting to evade takedown; earlier infections exploited known e-commerce vulnerabilities. Compromised stores risk customer card skimming, credential theft, and persistent backdoors in web supply chains.
SECURITYWEEK · 953 Online Stores Infected in Long-Lasting Malware Campaign
P3Incident
DreamHost Forces Password Resets After File Manager Incident
DreamHost forcibly reset email and FTP/SFTP credentials following a File Manager disruption; affected users were informed and logins remain blocked until new credentials are set. The provider asked customers to review email forwarding rules for unauthorized configurations.
BLEEPINGCOMPUTER · DreamHost Forcibly Resets Passwords After File Manager Incident
