GoKawiilTwo new PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.