PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP has rolled out patches fortwo critical-severity vulnerabilitiesnamed PHP2Shell that could provide attackers with unauthenticated remote code execution (RCE).
The issues are tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-2026-109619 (stale global state) and have a CVSS score of 9.2. For both, RCE was confirmed on Apache with mod_php.
“Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix,” the PHP Foundation says.
Patches for both were included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 were also released.
Before the fixes arrived, however, proof-of-concept (PoC) exploits targeting the two security defects started circulating.
Preemptive attack surface management firm WatchTowr says it has seen the first in-the-wild exploitation attempts hitting its sensors around...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
