PHP2Shell: The grace period is over
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
In October 2025, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowed unauthenticated remote code execution and forced many German websites and services offline as a precaution.