PHP2Shell: Critical PHP Flaws Let Attackers Take Over Web Servers Without a Login
PHP maintainers released emergency fixes for two critical flaws, nicknamed PHP2Shell, on October 21 that can let someone with no account and no password take control of a web server by sending it carefully crafted requests. PHP is the software running underneath a large majority of the world's websi...
https://insomnisec.com/posts/2026-10-22-php2shell-cve-2026-109618-109619_insomnisec_v3/
insomnisec.comPHP2Shell: Critical PHP Flaws Let Attackers Take Over Web Servers Without a LoginPHP has released emergency fixes for PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) in the PHP engine itself that can let an unauthenticated attacker run code on a web server. Amazon says attackers were already trying to exploit them on October 17, four days before the fix, and attempts have since climbed into the millions. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.