PHP2Shell: What to know about two critical PHP flaws

Video

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes

26 Oct 2026

Last week, details emerged about a pair of critical vulnerabilities in PHP, a server-side scripting language commonly used in web development. The news prompted security advisories from government agencies and sent website owners scrambling to apply the patches, with some sites even going offline as a precaution. This is because on an unpatched server, an attacker can exploit the vulnerabilities to run their own code without logging in. As three out of four websites globally are estimated to use PHP in some capacity, its ubiquity helps create an environment ripe for abuse; indeed, initial attempts to exploit the flaws – discovered by AI and dubbed PHP2Shell – weren't long in coming.…