PHP2Shell Zero-Day Exploits Force Immediate Patch for Millions of Sites
Two critical PHP flaws, PHP2Shell, allow remote code execution on PHP 8.2.x and 8.3.x sites. Immediate patching and configuration hardening are mandatory.
php
9 stories
PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
Two PHP core memory-safety flaws allow remote code execution on 69% of web servers, prompting emergency patches and site outages.
PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP 8.2.x and 8.3.x. PHP is used by approximately 75% of all websites.
PHP Releases Second Windows Update in Five Days to Patch PHP Brotli Flaw
PHP releases a second Windows update within five days to patch the PHP Brotli flaw (CVE-2026-111497) that can enable memory corruption and code execution.
PHP2Shell CVEs Force Immediate Patch for Millions of Sites
Two critical PHP CVEs expose millions of sites to unauthenticated RCE; patches released, scanning activity detected, and mitigation steps outlined.
PHP2Shell RCE Exposes Web Apps – Immediate Patch Required
A remote code execution flaw in PHP2Shell allows attackers to run arbitrary commands on vulnerable servers. Apply the vendor patch before exploitation.
PHP2Shell RCE Exposes Palo Alto GlobalProtect VPN
Palo Alto Networks PAN-OS and Panorama servers exposed to PHP2Shell RCE; update to PHP 8.5.12 or later and apply vendor patches immediately.
Mirai ASLR bypass Enables PHP2Shell Compromise
Mirai operators now use an ASLR bypass to compromise PHP2Shell installations, forcing immediate patching and hardening of affected web servers.
PHP CVE-2026-109618 Trigger Widespread Site Outages
PHP CVE-2026-109618 and CVE-2026-109619 enable remote code execution and denial of service, causing widespread outages across Drupal and other PHP-based sites.