PHP2Shell

Legendary card · No. 186

PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE). PHP is a popular programming language on which many website and web application codebases are built; these vulnerabilities were estimated to affect nearly 70% of websites at the time of their disclosure. The vulnerabilities were discovered with the help of AI in August 2026 and their existence was publicly announced on 20 October 2026. An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous websites temporarily taken offline to apply the patches before exploits (software that uses a security hole to compromise a computer) could be used.

Read on Wikipedia · Image Wikimedia Foundation, CC BY 4.0