CISA advises organizations to urgently address two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, referred to as php2shell, enable unauthenticated remote code execution on any PHP installation handling web requests. The specific versions required to fix these issues are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Although exploitation has not yet been observed, CISA recommends taking unpatched systems offline or using a web application firewall as a temporary measure.
Read the full story at cisa.gov.
Photo: StockSnap / Pixabay
