PHP2Shell: Two Critical PHP Vulnerabilities Allow Unauthenticated Remote Code Execution
RedSide Security October 21, 2026 CVE 26 views
PHP has released emergency security updates for two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. The flaws affect PHP memory management and could allow unauthenticated remote code execution on vulnerable web servers. Administrators are urged to upgrade to patched PHP versions immediately.
Cybersecurity
Exploit
RCE
Vulnerability Management
Threat Intelligence
Memory Corruption
Remote Code Execution
Web Server Security
Zero-Day
Critical Vulnerability
Web Application Security
Server Security
PHP
PHP2Shell
CVE-2026-109618
CVE-2026-109619
CVSS 9.2
PHP Security
Apache
mod_php
PHP-FPM
Use-After-Free
Out-of-Memory
Security Patches
Security Advisory
Continue reading: PHP2Shell: Two Critical PHP Vulnerabilities Allow …