Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Original title: PHP2Shell: What to know about two critical PHP flaws
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
Details emerged last week on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. On an unpatched server, an attacker can run their own code without logging in. Government advisories followed, website owners rushed to patch, and some sites went offline as a precaution. ESET says initial exploitation attempts were not long in coming and points owners to advisories from the PHP Project, CISA, CERT-EU and NCSC.
Unconfirmed: The item reports initial exploit attempts but does not describe how widespread successful compromise is, and the PHP usage share is an estimate.
- ESET says the flaws were discovered by AI.
- PHP is estimated to be used by three out of four websites.
- The explainer directs readers to PHP Project, CISA, CERT-EU and NCSC advisories.
- No affected or fixed version numbers are stated in the item.
Impact: Unauthenticated remote code execution on unpatched PHP servers
| Product | Affected |
|---|---|
| PHP Project PHP | — |
- 1.Apply the PHP patches described in the PHP Project advisory.
- 2.Use the CISA, CERT-EU or NCSC advisories for mitigation steps.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
1 min read at welivesecurity.comHere's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.