🤖 PHP2Shell patched but already exploited: CVE-2026-109618 and CVE-2026-109619 are critical RCEs in the PHP runtime itself — no app bug, no account needed. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (8.1/8.0 get no fix). Krebs: working exploits, ~70% of websites unpatched, outages expected.
🔗 https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
#CVE #Exploit #CyberSec
BleepingComputerPHP ships emergency patches for critical PHP2Shell flawsThe PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.