Vulnerabilities
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP has released patches for two vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), after several cybersecurity firms detected exploitation attempts before the fixes shipped, SecurityWeek reports.
PHP has released patches for a pair of vulnerabilities collectively dubbed "PHP2Shell," even as security researchers report that attackers began probing for the flaws before the fixes were available, SecurityWeek reports.
According to the outlet, several cybersecurity companies observed exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 prior to PHP's official patch release. The activity was picked up on the firms' sensors, indicating that threat actors were already scanning for or attacking vulnerable systems in the wild at an early stage.
The report does not specify the technical details of the two flaws, which PHP versions are affected, or which organizations detected the exploitation attempts. However, the "PHP2Shell" name suggests the vulnerabilities could allow an attacker to gain shell-level access to a targeted server — a serious risk given how widely PHP is deployed across websites and web applications worldwide.
The observation of exploitation attempts before patches were available raises the possibility that details of the flaws circulated among attackers ahead of the public fix, though the report does not confirm how the vulnerabilities became known to threat actors.
Administrators running PHP-based infrastructure are advised to apply the newly released patches as soon as possible and to review server logs and security telemetry for signs of compromise. Organizations should also ensure monitoring is in place to detect suspicious activity targeting their PHP deployments, given that exploitation attempts have already been observed.
Source: SecurityWeek
