PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
Source: ZDNet ·
The PHP Project provides instructions to stop further RCE exploits in limited settings.
From the source
A flaw in PHP triggered a worldwide scramble to patch vulnerable websites, and now, further instructions have been issued by the PHP Project to prevent “an unlikely Remote Code Execution (RCE) vector” in PHP2Shell attacks. Also: Chrome warns you about suspicious websites now PHP2Shell refers to a pair of PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , that have each earned critical severity scores of 9.2 and impact most PHP builds. The PHP Project released patches to fix these bugs on Wednesday, and the critical nature of these flaws prompted a worldwide scramble to apply PHP’s fixes as quickly as possible. Why the rush? Because PHP (a recursive acronym for Hypertext Preprocessor) is a general-purpose programming language that provides the backbone for many of the websites and services we access daily — everything from WordPress websites to e-commerce platforms. According to Wiz’s security team , which discovered the vulnerabilities with the help of AI, PHP can be found on…