GoKawiilPHP Project issues mitigation steps for critical PHP2Shell vulnerabilities
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 in severity, affect most PHP builds and were patched by the PHP Project on Wednesday. Security firm Wiz, which found the flaws with AI assistance, says PHP runs on roughly 70% of websites worldwide, and the bugs allow memory disclosure and unauthenticated remote code execution independent of the application running on PHP.