PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution
Read original article ↗AI Summary
Two critical use-after-free vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, enable unauthenticated remote code execution on affected servers. The flaws exist in the PHP runtime and can be exploited via crafted web requests, allowing attackers to take control of servers, execute arbitrary code, read sensitive memory, or establish persistence. Public proof-of-concept code emerged before patches were available, and exploitation attempts have been observed since October 17, 2026, with increased activity following disclosure. All PHP installations handling web requests are affected, especially those using Apache with mod_php, and immediate patching is strongly advised.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.