Two critical RCEs in PHP core

Cisco Talos has identified two critical unauthenticated remote code execution (RCE) vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell'. These flaws affect all PHP versions since 5.4 and can be exploited via a plain HTTP request before any application code runs, making them highly dangerous. The vulnerabilities stem from improper handling of out-of-memory conditions and reuse of stale internal state after memory deallocation. While initial exploitation has been limited to scanning and basic payloads, Talos expects more sophisticated campaigns to emerge as threat actors integrate the vulnerabilities into their tooling.

AI-extracted · verify before operational use