- Joined
- Aug 9, 2022
- Messages
- 65
Heads up, two critical vulnerabilities dubbed PHP2Shell (CVE-2026-109618 & CVE-2026-109619) have been disclosed, potentially allowing Remote Code Execution (RCE) on vulnerable PHP servers.
Extremely dangerous, its officially rated 9.2 (CVSS v4.0) by the PHP Security Team (and initially reported as 10.0), Infrastructure-Level Flaw, Massive Version Impact (PHP 5.4+)
Security researchers warn that automated mass scanning and exploitation in the wild are expected within 15 minutes of patch publication.
Be ready for the patches on 21 October 2026 at 14:00 UTC.
Sources:
www.php.net
thehackernews.com
watchtowr.com
Extremely dangerous, its officially rated 9.2 (CVSS v4.0) by the PHP Security Team (and initially reported as 10.0), Infrastructure-Level Flaw, Massive Version Impact (PHP 5.4+)
Security researchers warn that automated mass scanning and exploitation in the wild are expected within 15 minutes of patch publication.
Be ready for the patches on 21 October 2026 at 14:00 UTC.
Sources:
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP2Shell involves two critical PHP RCE flaws rated CVSS 9.2, with emergency fixes scheduled following a disclosure leak.
thehackernews.com
PHP Remote Code Execution FAQ: CVE-2026-109618 | watchTowr
CVE-2026-109618 FAQ: affected PHP versions, fixes and more - updated as details emerge.
watchtowr.com