PHP2Shell flaws exploited in the wild
Event Brief generated 29 s read
Written by an AI. It was merged from the source on this page and has not been reviewed by a person.
The short version
- Two critical PHP remote code execution flaws are now exploited in the wild.
- The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell.
- Any PHP server that is exposed and unpatched is at risk.
What happened
BleepingComputer reports that two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, have been successfully exploited in the wild. The summary does not list affected PHP versions or attack volume.
Why it might matter
Remote code execution on a web server gives an attacker control of the host. Operators running PHP applications should check exposure now.
What we don’t know yet
The feed summary does not give affected versions, patch status, or the number of compromised systems. Details are in the full article.
