DigiNews

Summary

PHP2Shell describes a family of critical PHP core vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution and memory disclosure across PHP-powered sites. The report details affected versions, CVEs (CVE-2026-109618, CVE-2026-109619), attacker capabilities, coordinated disclosures, and recommended remediation, including upgrading PHP runtimes and applying mitigations. It also highlights demonstrations on WordPress, Drupal, and Joomla, and credits multi-party collaboration including Wiz Research and OpenAI Codex Security.