PHP releases emergency patches for critical PHP2Shell vulnerabilities
The PHP security team has released emergency patches for two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell. These patches address CVE-2026-109618 and CVE-2026-109619.
Summary: The PHP security team has released emergency patches for two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell. These patches address CVE-2026-109618 and CVE-2026-109619.
Emergency security patches have been released for two critical RCE vulnerabilities (PHP2Shell) found in the PHP runtime. Such RCE vulnerabilities allow attackers to execute arbitrary code on the target system and are typically classified in the highest risk category.
These vulnerabilities might stem from improper handling by specific PHP functions or internal mechanisms. Low-level errors like insufficient input validation, deserialization flaws, or memory management issues often lead to RCE.
All web applications and services using PHP need to apply these patches quickly. Internet-facing PHP applications, in particular, can become primary targets for such vulnerabilities, potentially leading to severe data breaches or system compromises.
System administrators and developers should check their PHP versions and apply the latest patches as soon as possible. Additionally, extra security layers like a web application firewall (WAF) can offer some protection against these types of attacks.
🔗 Source: BleepingComputer
📡 Authoritative feeds & live tracking: Radar