CERT24Limited reports of PHP bug exploitation emergeLoading data…
CERT24Threat Observatory
Period

Limited reports of PHP bug exploitation emerge

Multiple cybersecurity firms have reported successful exploitation of two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell.” GreyNoise observed at least six successful exploitations. Dream described a campaign in which PHP2Shell was chained with CVE-2026-46300 against firewall software; researchers found 24 compromised firewalls.

← Back to intelligence

Limited reports of PHP bug exploitation emerge

Multiple cybersecurity firms have reported successful exploitation of two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell.” GreyNoise observed at least six successful exploitations. Dream described a campaign in which PHP2Shell was chained with CVE-2026-46300 against firewall software; researchers found 24 compromised firewalls.