CERT24Critical PHP remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619Loading data…
CERT24Threat Observatory
Period

Critical PHP remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619

Unit 42 describes two critical vulnerabilities in PHP, referred to as PHP2Shell. Both enable remote code execution (RCE) and are rated 9.2 under CVSS 4.0. The source recommends that organizations assess their exposure and patch immediately.

← Back to intelligence

Critical PHP remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619

Unit 42 describes two critical vulnerabilities in PHP, referred to as PHP2Shell. Both enable remote code execution (RCE) and are rated 9.2 under CVSS 4.0. The source recommends that organizations assess their exposure and patch immediately.