Blog argues php2shell is unlikely to be mass-exploited
A public PoC needs four hits on one PHP worker plus the exact build, which the author says is slow to brute-force.
34
Product
mod_php
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned1d ago
Timeline
3 articles · newest firstPHP patches two unauthenticated RCE flaws in four current branches
Maintainers say updating is the only fix, with the highest risk on Apache mod_php.
78
Critical PHP use-after-free bugs allow unauthenticated code execution
CVE-2026-109618 and CVE-2026-109619, called php2shell, have fixes for PHP 8.2 through 8.5; a PoC exists but no active attacks are confirmed.
78
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- LiteSpeedproduct · 2
- PHPvendor · 2
- PHP-FPMproduct · 2
- FrankenPHPproduct · 2
- Canadian Centre for Cyber Securityorganization · 1
- HoneyLabsorganization · 1
- PHPproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.