poc – PwnDefend

Vulnerabilities in PHP (CVE-2026-109618 / CVE-2026-109619)

Another day, another vulnerability, as has been so… for basically forever. However if you run PHP you don’t want to sleep on this one, due to some shenanigans there’s been an ‘early release of intel’ (leak) and a patch for PHP is on the way, however there’s also now a PoC in the wild! But the devil, as always is in the details! So let’s explore those, as always this is a fast publish and you should look to the vendor for guidance etc. with that important caveat aside, let’s explore:

Threat Intel

WP2SHELL

Yesterday afternoon/early evening a patch for WordPress was released (7.0.2) which address two vulnerabilities which are named: WP2SHELL. This is a fast post (largely generated by Claude Opus) to provide some detail. For reference in our research we have found ~20% of WordPress sites still vulnerable as of a few hours ago (based on a sample), so this is a live scenario and it would be strongly advisable for organisations to take appropriate steps. This morning I’ve built a docker lab of a vulnerable WordPress site and demonstrated hash theft and web shell deployment to a vulnerable lab instance.

I’ve put some resources for people (use at own risk) into a repo: https://github.com/mr-r3b00t/wp2shell/

that includes a scanner, some info on the vulns and a PoC tool!

Education

A tech demo – Gyroscope & Accelerometer Detector

Ad tech is a threat that really doesn’t get much airtime! So let’s do quick demo:

Defense

ProxyLogon (CVE-2021-26855) PoC and Metasploit Module Released

The last two weeks we’ve seen major activity around the world with defenders and criminals rushing to respond to the recent zero day vulnerability patches and then the race to reverse engineer the kill chain to create an explot. We saw a PoC fairly early but it required that you reverse engineer some exchange DLLs and/or TAP the 443 to 444 interface on an exchange server to work out how to weaponise it. Things however have progressed, 8 hours ago we saw a metasploit module go online: