How new PHP vulnerabilities threaten home users | Kaspersky official blog
Source: Kaspersky Blog
At a glance
Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619 . Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell. The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day. We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do .…