PHP2Shell: What to know about two critical PHP flaws
Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, have been discovered, allowing attackers to run code without authentication on unpatched servers.
Details of the vulnerabilities emerged last week, triggering security alerts from government agencies and causing website owners to rush to apply patches. Some sites even went offline as a precautionary measure. The flaws, discovered by AI and named PHP2Shell, pose a significant threat due to PHP's widespread use in web development.
Critical vulnerabilities
On an unpatched server, attackers can exploit these vulnerabilities to execute their own code without logging in. With approximately three out of four websites globally using PHP in some capacity, the potential for widespread exploitation is substantial. Initial attempts to exploit these flaws have already been observed.
Recommended actions
Website owners and IT teams are urged to apply patches immediately. For detailed mitigation steps and additional information, security advisories have been issued by the PHP Project, CISA, CERT-EU, and NCSC.
Related
