The Adversary Economy: How Threat Actors Are Reacting to PHP2Shell

Written by Raymond Carney, Senior Director of Research Special Operations at Tenable. Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. PHP powers an estimated 75% of websites with identifiable server-side technology, making it the backbone of the modern web. That infrastructure extends far beyond legitimate businesses. Criminal forums, dark web marketplaces, and underground communication platforms rely on the same PHP-based software stacks, such as phpBB, custom forum engines, and web-based administration panels, that power their legitimate counterparts. On Oct. 20, 2026, two critical unauthenticated remote code execution vulnerabilities in PHP were publicly disclosed: CVE-2026-109618 (OOM Corruption) and CVE-2026-109619 (Stale Global State), each carrying a CVSS v4.0 score of 9.2. The two…