PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
Read original article ↗AI Summary
PHP has released emergency patches for two critical remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, which affect all versions since PHP 5.4 and can be exploited without authentication. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, stem from memory-safety flaws in the PHP engine and allow attackers to execute arbitrary code on vulnerable web servers before application-level code runs. Both the NSA and CERT-EU have advised organizations to take unpatched systems offline due to the severity, with active exploitation already observed. Cloudflare has implemented temporary WAF rules, but a full runtime update is required for complete mitigation.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.