CERT24PHP2Shell: what we know about the threat two weeks after patchesLoading data…
CERT24Threat Observatory
Period

PHP2Shell: what we know about the threat two weeks after patches

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on a server. The source confirms exploitation in real-world attacks and describes additional vulnerabilities and defensive measures.

← Back to intelligence

PHP2Shell: what we know about the threat two weeks after patches

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on a server. The source confirms exploitation in real-world attacks and describes additional vulnerabilities and defensive measures.