What to know, what to do, and how to detect exploitation — before the patch drops.

Yesterday, two critical vulnerabilities in PHP itself were disclosed: CVE-2026–109618 and CVE-2026–109619, both rated 9.2 on CVSS 4.0.

PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers must update.

Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.

PHP2Shell: How a Core Runtime Zero-Day Broke the Web (CVE-2026–109618 & CVE-2026–109619) Inside the low-level C memory corruption granting unauthenticated RCE across millions of production …

CVE-2026–109618 & CVE-2026–109619 — pre-auth RCE in PHP core, explained for the rest of the team.

As security researchers and developers, we’ve often been told to trust core web frameworks and runtime environments. After all, they’ve…

TL;DR Attackers are now exploiting PHP2Shell, a pair of critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Amazon saw the first attempt on October 17, four da…

PHP powers roughly 70% of websites on the internet.

Initial attempts were observed on October 17, and mass activity began shortly after patches were released.