Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP, potentially allowing unauthenticated attackers to execute arbitrary code on vulnerable servers.
Tracked as PHP2Shell, both flaws affect PHP’s internal memory management and can put internet-facing PHP applications at serious risk.
Fixed versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators should update affected PHP installations immediately. PHP 8.1 and older require special attention, as they are no longer officially supported.
Important: These vulnerabilities are now reported as actively exploited in the wild.
Read our full technical analysis and mitigation guide:
PHP2Shell: A Technical Analysis of Two Critical PHP Vulnerabilities