PHP2Shell Flaws Prompt Organizations to Take Services Offline

Summary

The article says two PHP flaws enabled unauthenticated remote code execution, with exploitation attempts observed 19 minutes after the scheduled fix release. Organizations reportedly took services offline; guidance includes patching, isolating, and checking for signs of

Key points

The article identifies PHP2Shell as two critical flaws, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution on servers.
It says a demonstration video appeared before the fix was released and researchers observed exploitation attempts 19 minutes after the scheduled release.
The article reports that some organizations took services offline or isolated systems they could not patch promptly.
It recommends updating to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
For systems managed by vendors, it advises requesting written confirmation of exposure and patch status; unpatchable systems should be isolated or taken offline.
It also recommends checking for possible compromise, including unusual processes started by PHP.

Article Details

Vulnerability Types: Unauthenticated remote code execution
Severity: Critical
Affected Versions: PHP (any version; national cyber agencies warned that organizations running any version were affected)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Isolate systems that cannot be patched from the internet.
Switch off systems that cannot be patched or isolated.