PHP2Shell: CVE-2026-109618 and CVE-2026-109619 - Critical Unauthenticated RCE in PHP
PHP2Shell is a pair of critical vulnerabilities in the PHP runtime, rated CVSS v4.0 9.2, that let unauthenticated attackers execute code on web servers. Apache mod_php can be exploited before any application code runs. This advisory covers affected versions, how each attack chain works, patching, interim php.ini mitigations, detection and compliance impact.
11 min read Updated
