Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Read original article ↗AI Summary
Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed in PHP, affecting versions 5 through 8. The flaws, related to use-after-free and memory corruption in the handling of multipart/form-data with session.upload_progress, allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. An exploit named PHP2Shell has been demonstrated in the wild against popular PHP applications including WordPress, MediaWiki, and Drupal. Exploitation is highly likely immediately after patch release, and mitigation requires immediate patching or temporary configuration changes such as disabling upload progress and blocking multipart requests.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.