Critical PHP2Shell Vulnerabilities Allow Remote Code Execution, Exploited by Attackers

Researchers in security have verified that two freshly disclosed remote code execution (RCE) defects, identified as CVE-2026-109618 and CVE-2026-109619, are currently being leveraged in active attacks. Dubbed PHP2Shell, these flaws target a widely used PHP extension that permits command‑line access from web‑based scripts.

The vulnerabilities first came to light via the cybersecurity outlet BleepingComputer, which noted that threat actors have already used the defects to execute arbitrary commands on susceptible servers. Each CVE carries a critical severity rating, indicating that a successful exploit can grant an attacker complete control of the compromised machine without requiring legitimate credentials.

PHP continues to be a foundational language for web development, driving a large portion of dynamic sites online. It is common for custom applications to employ extensions that connect PHP with the underlying operating system, and any flaw in that bridge can expose a direct route to the server itself. With PHP2Shell, the root cause lies in inadequate input validation, which lets specially crafted data slip past safeguards and trigger system commands.

Analysts in the industry point out that proof of real‑world exploitation heightens the need for swift administrator response. Although the total scope of the incidents remains unclear, initial signs indicate that the attacks are being employed to install web shells, siphon data, and create footholds for subsequent lateral movement across networks.

In reaction, vendors have released patches that remediate the underlying input‑validation flaws. These updates can be obtained via the usual distribution mechanisms for leading operating systems and web‑hosting services. Security personnel should deploy the patches without delay, scrutinize logs for anomalous command‑execution events, and contemplate interim mitigations like disabling the vulnerable extension until the correction is applied.

The appearance of PHP2Shell highlights the persistent difficulty of safeguarding widely used open‑source components. As adversaries keep seeking high‑impact flaws, specialists emphasize the need for continuous software inventory, prompt patch cycles, and defense‑in‑depth strategies to curb the impact of any successful intrusion.