Just a heads-up folks, there are new critical vulnerabilities affecting PHP:
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Product | PHP core | PHP core |
| Severity | Critical, CVSS v4 9.2 | Critical, CVSS v4 9.2 |
| Impact reported | Remote Code Execution | Remote Code Execution |
| Authentication | Reported as unauthenticated | Reported as unauthenticated |
| Affected versions | Reports indicate PHP 5.4+ | Reports indicate PHP 5.4+ |
| Name | Collectively referred to as PHP2Shell | Collectively referred to as PHP2Shell |
Initial reports suggest these vulnerabilities have the potential for unauthenticated RCE. If a public facing site can’t be patched, it should be taken offline.
Still very sparse but should know once there is additional information.
