PHP2Shell: Two Critical PHP Vulnerabilities and What to Do Now
- 916 words
- 5 min read
Two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. Here is what the advisories and public reports say, how a WAF and layered controls help, and how to patch PHP and your Docker images.