Understanding PHP2Shell, the Critical PHP RCE Exploit – How To Patch Instructions
PHP2Shell (CVE-2026-109618 & CVE-2026-109619) is now being actively exploited. These critical PHP flaws (CVSS 9.2) allow unauthenticated remote code execution on any unpatched server. See which PHP versions fix it, which backports exist for PHP 7.4–8.1, the temporary mitigations, and how to check whether your server was compromised.
