Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
Cybersecurity Classified by Officially
Executive Summary PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 score of 9.2, that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. …
This is an extract. The publication continues at the source.
Read the original at the source: https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities
Officially imported this from Qualys’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
This publication has changed since it was first published
4 versions recorded. The original is kept in full — nothing is overwritten.
- v4 imported change on current
- v3 imported change on
- v2 imported change on Titled: “PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates”
- v1 as first published on Titled: “PHP Announces Critical Security Release for Two Vulnerabilities”
Provenance
- Organization
- Qualys — imported from official source
- Official source
- https://blog.qualys.com/feed RSS
- Imported
- October 21, 2026 04:00
- Versions
- 4 recorded
- Identity
-
https://blog.qualys.com/?p=42857