PHP2Shell: Remote Code Execution in PHP (CVE-2026-109618 / CVE-2026-109619)
Description
PHP2Shell is a pair of critical flaws in PHP itself, the engine that powers a large share of the web (including platforms such as WordPress and Drupal). By sending a specially crafted web request, an attacker who has no account and no credentials can corrupt PHP's internal memory while it handles the request. This can let them run their own code on the server or read sensitive data left in memory, such as passwords, tokens and keys. Because the weakness is in PHP itself, a site can be affected even when its own application code is secure.
Remediation
Update PHP to a patched release: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. If an immediate update is not possible, limit the accepted request body size and the maximum number of multipart parts, and restrict multipart uploads to the endpoints that require them.