PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
ZDNET’s key takeaways
- The disclosure of critical bugs in PHP leads to an urgent rush to patch.
- Cybercriminals are likely to weaponize these vulnerabilities.
- Organizations should act now to prevent exploitation.
A flaw in PHP triggered a worldwide scramble to patch vulnerable websites, and now, further instructions have been issued by the PHP Project to prevent “an unlikely Remote Code Execution (RCE) vector” in PHP2Shell attacks.
What is PHP2Shell?
PHP2Shell refers to a pair of PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that have each earned critical severity scores of 9.2 and impact most PHP builds. The PHP Project released patches to fix these bugs on Wednesday, and the critical nature of these flaws prompted a worldwide scramble to apply PHP’s fixes as quickly as possible.
More from ZDNET
Why the rush? Because PHP (a recursive acronym for Hypertext Preprocessor) is a general-purpose programming language that provides the backbone for many...
Copyright of this story solely belongs to www.zdnet.com. To see the full text click HERE
