The adversary economy: How threat actors are reacting to PHP2Shell

Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target.

Key takeaways

1. The adversary economy operates on the same fundamental principles as the legitimate economy. 
2. Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking themselves offline within hours of PHP2Shell disclosure, citing direct risk to their operations.
3. Underground operators face a dual threat: both law enforcement and rival criminal groups could weaponize PHP2Shell against forum infrastructure storing member identities, private communications, and stolen credentials.
4. The adversary response mirrors legitimate enterprise incident response, including emergency patching, platform migration, and business continuity planning.
5. Historical precedent from the 2024 BreachForums seizure conditioned criminal operators to treat infrastructure vulnerabilities as existential business risks

Background

PHP powers an estimated 75% of websites with identifiable server-side technology, making it the backbone of the modern web. That infrastructure extends far beyond legitimate businesses. Criminal forums, dark web marketplaces, and underground communication platforms rely on the same PHP-based software stacks, such as phpBB, custom forum engines, and web-based administration panels, that power their legitimate counterparts.

On Oct. 20, 2026, two critical unauthenticated remote code execution vulnerabilities in PHP were publicly disclosed: CVE-2026-109618 (OOM Corruption) and CVE-2026-109619 (Stale Global State), each carrying a CVSS v4.0 score of 9.2. The two flaws target different stages of PHP’s memory management, and chaining them together yields a more reliable exploitation path than either alone. Researchers credit frontier AI models with both the initial discovery and the exploitation chain connecting them. Tenable Vulnerability Watch classified both as Vulnerabilities of Concern (VOC). Within hours, the cybersecurity community began its familiar cycle of assessment, patching, and remediation. (For a full technical breakdown, see our blog “php2shell: Frequently asked questions about critical PHP remote code execution vulnerabilities”.) 

At the same time, a parallel response was already underway including criminal forum self-evacuations and steps to protect the adversary economy. 

“We take our security seriously”

The adversary economy operates on the same fundamental principles as the legitimate economy. Criminal operators invest in infrastructure, manage risk, plan for business continuity, and respond to threats against their operations with the same systematic urgency that any well-run organization would apply. From the credential theft supply chains we documented earlier this year to the infrastructure-level emergency playing out now, a consistent pattern emerges: the underground functions as an economy, and economies have attack surfaces. PHP2Shell affected both sides of the security divide simultaneously, and the underground's response demonstrates that sophisticated threat actors have already internalized the severity of this exposure.

Within 48 hours of PHP2Shell disclosure, administrators across multiple major criminal forums posted emergency notices to their communities. BreachForums, one of the largest English-language criminal marketplaces, posted an advisory that included a phrase familiar to anyone who has read a corporate breach notification: “We take our security seriously.”

The irony is difficult to overstate. A platform best known for trafficking stolen credentials, facilitating ransomware operations, and hosting leaked corporate data deployed the same language that Fortune 500 companies use after their own security incidents. But behind the borrowed corporate-speak was genuine operational urgency.

BreachForums was not alone. DarkForums posted its own shutdown notice: “DF will remain offline until PHP has been patched globally.” PwnForums went dark without explanation. Dread, the Reddit-like platform serving the Tor ecosystem, posted a maintenance notice explicitly naming both CVEs. Several forums temporarily restricted new registrations, and others migrated critical communications to Telegram channels as a contingency measure, treating their PHP-based web platforms as potentially compromised infrastructure.

The dual threat

The urgency behind these evacuations reflects a threat model that legitimate organizations would recognize immediately. Criminal forums run on PHP infrastructure, and that infrastructure stores exactly the kind of data that makes a vulnerability like PHP2Shell catastrophic.

The simultaneous self-evacuation is a significant behavioral indicator. Analysis from DarkOwl, a dark web intelligence firm, highlighted the scope of what sits behind a typical forum’s PHP application layer: member email addresses, IP logs, private messages, financial transaction records, and the very stolen credentials that members uploaded for sale. A successful exploit of a forum’s PHP stack would not merely disrupt the platform. It would expose the identities and operational security of every participant.

Forum operators face a threat that most legitimate businesses do not: the adversary attacks from two directions simultaneously. Law enforcement agencies have demonstrated both the capability and the willingness to exploit criminal infrastructure, as the FBI’s operation against Hive ransomware and multiple forum takedowns have shown. But rival criminal groups represent an equally serious threat. Competing forums, extortionists, and opportunistic hackers all have incentive to breach a rival platform’s database to steal its user base, to extort its operators, or to eliminate competition.

This dual threat transforms a PHP vulnerability from a technical issue into an existential business risk. The criminal underground last evacuated platforms at this scale during the 2024 BreachForums seizure — but that response was triggered by law enforcement action. PHP2Shell marks the first time a technical vulnerability in shared infrastructure provoked the same reaction, a shift suggesting criminal operators now treat their PHP dependency as a systemic single point of failure. They evaluate this exposure in precisely the same terms as a CISO assessing a critical unpatched vulnerability: the question is not whether someone will attempt exploitation, but when.

The BreachForums lesson

That institutional memory was shaped by hard experience. The 2024 FBI seizure of BreachForums demonstrated in concrete terms what happens when criminal infrastructure is compromised.

That seizure resulted in the exposure of operational details, the arrest of the forum’s administrator, and the disruption of thousands of active criminal operations that depended on the platform. For the underground economy, it was the equivalent of a major supply chain breach: a single point of failure that cascaded across an entire ecosystem.

The lesson was absorbed. Criminal operators began treating their web infrastructure as a single point of failure requiring the same resilience planning that legitimate enterprises apply to critical systems. PHP2Shell validated that concern. The two CVEs affect every PHP version below 8.3, meaning that the approximately 59% of internet-facing PHP hosts running end-of-life branches are permanently exposed absent a version upgrade. Criminal forums running older PHP versions face the same impossible math as any enterprise with a large install base of unsupported software: the patch does not exist, and the only remediation is migration.

From defense to offense: the exploit economy

The criminal underground’s relationship with PHP2Shell extends beyond defensive measures. Intelligence reporting indicates that exploit code for both CVEs circulated in private channels before the public embargo lifted, with pre-disclosure exploitation observed as early as Oct. 17 from infrastructure traced to an IP address geolocated in Australia.

The exploit development pipeline has accelerated in ways that should concern every organization running PHP. Researchers have documented the use of AI-assisted vulnerability analysis tools to accelerate the development of working exploits and to identify additional exploitation vectors within the disclosed vulnerability classes. This represents a broader trend in which the same AI capabilities that accelerate defensive security research simultaneously compress the window between disclosure and weaponization.

The monetization forecast follows a pattern we have documented before. The developer credential economy operates through three layers (generation, distribution, and weaponization), and PHP2Shell maps cleanly onto each. Initial access brokers will package PHP2Shell exploitation into their service offerings. Ransomware affiliates will incorporate the vulnerabilities into their initial access playbooks. And the criminal forums that patched their own infrastructure will become the marketplaces for selling access to organizations that did not. We saw a preview of this commoditization cycle during the Miasma campaign, where open-sourced attack toolchains accelerated exploitation at scale. The adversary economy is efficient: the same operators who scrambled to protect their own PHP stacks will profit from organizations that fail to do the same.

What this means for defenders

The criminal underground’s reaction to PHP2Shell is, paradoxically, one of the clearest available signals of the vulnerability’s severity. When threat actors treat a disclosure as an emergency requiring immediate operational response, defenders should calibrate their own urgency accordingly.

Organizations running PHP should treat both CVE-2026-109618 and CVE-2026-109619 as immediate remediation priorities. Every PHP version below 8.3 is affected, and no patches will be issued for end-of-life branches including all of PHP 5.x, 7.x, 8.0, 8.1, and 8.2. For environments where an immediate upgrade is not feasible, compensating controls including web application firewalls, network segmentation, and enhanced monitoring for exploitation indicators should be deployed without delay. The criminals have already patched. The question for every organization is whether they will do the same before the exploit economy catches up.

Identifying affected systems

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages for CVE-2026-109618 and CVE-2026-109619 as they’re released. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

• PHP Security Advisory — CVE-2026-109618
• PHP Security Advisory — CVE-2026-109619
• CISA Known Exploited Vulnerabilities Catalog
• The developer credential economy: Why exposure data is the new front line in the supply chain war
• What the Miasma campaign reveals about the new supply chain threat model and the underground

Join Tenable’s Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about the Tenable One Exposure Management Platform, the exposure management platform for the modern attack surface.