Weekly Recap: PHP2Shell RCE Flaws Draw Millions of Exploitation Attempts
Summary
The weekly recap reports PHP2Shell RCE flaws, widespread scanning and millions of exploitation attempts detected by Cloudflare, but no successful exploitation observed. It also lists numerous vulnerabilities and urges patching or mitigation.
Key points
- The PHP Foundation released patches for critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, which could enable unauthenticated remote code execution.
- Cloudflare said it detected millions of exploitation attempts after public disclosure; the recap says no successful exploitation had been observed.
- Some websites went offline as a precaution because of the flaws’ severity and PHP’s widespread use.
- The recap lists vulnerabilities affecting products including Cisco, Google Chrome, Atlassian, and HPE, but provides limited detail on most entries.
- It advises checking exposed systems, patching where possible, locking down systems that cannot be patched, and treating leaked keys as urgent.
Article Details
- Event Type
- Disclosure and patching of two critical PHP vulnerabilities, followed by widespread scanning and reported exploitation attempts.
- Impact
- CVE-2026-109618 and CVE-2026-109619 could enable unauthenticated remote code execution. Cloudflare reported detecting millions of exploitation attempts after disclosure, but no successful exploitation had been observed. Several websites went offline as a precaution.
MITRE ATT&CK
CVE
CVE-2026-109618on Alert — The PHP Foundation released patches for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated remote code execution. The security flawsCVE-2026-109619— The PHP Foundation released patches for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated remote code execution. The security flaws have been codenamed
Vendors
CloudflarePHP2Shell. Since public disclosure, the shortcomings have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure. To date, no successfulThe PHP FoundationPHP2Shell Flaws Puts Organizations on Alert — The PHP Foundation released patches for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that could lead to unauthenticated remote code execution.