PHP2Shell: Critical PHP vulnerabilities patched, update now!
ID: fdcb7c3a-9a2b-51ec-bffc-9829ec1cb36e
STIX ID: report--fdcb7c3a-9a2b-51ec-bffc-9829ec1cb36e
Feed Name: Help Net Security
The PHP project released emergency patches for two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that affect virtually every PHP installation serving web requests; a working unauthenticated exploit has been demonstrated and administrators are urged to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or obtain vendor backports. The report emphasizes the severity (decades-old flaws made exploitable), broad exposure (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), mitigation advice (take systems offline if unpatchable, vendor packages, Cloudflare WAF rules), and concern over a long tail of unpatched embedded or forgotten installations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.