PHP2Shell: No login, no app code, no warning. What next?
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), reportedly let an unauthenticated attacker run code through a crafted web request. Each is rated CVSS v4.0 9.2, and all earlier releases are affected. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 7.4, 8.0 and 8.1 get only source backports. watchTowr reports honeypot exploitation, while other telemetry shows mostly probing. The claims come from a vendor post without cited sources, so the hard task is inventorying every PHP install.