PHP2Shell: How to Protect Your Server | Kaspersky official blog
Source: Kaspersky Blog
At a glance
Two critical vulnerabilities have been discovered in the popular PHP programming language. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 , allow attackers to remotely execute code on a server running PHP without authentication. The language’s development team has released updates for all supported branches, but the first attempts to exploit the vulnerabilities were observed even before the patches were published. The exploit has been named PHP2Shell. The architectures of popular marketplaces, e-commerce platforms, and learning management systems (LMS) are written in P…