🇹🇼 Chinese, 27 October 2026, PHP Vulnerability
Two Critical PHP Vulnerabilities Discovered, Threatening Global PHP Infrastructure
Two severe remote code execution vulnerabilities in PHP, rated 9.2 CVSS, have been discovered, allowing attackers to execute malicious code on target servers without authentication.
PHP, one of the most widely used server-side programming languages, has been hit with two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2. The vulnerabilities, known as ‘PHP2Shell’, can be exploited by attackers to execute malicious code on target servers without authentication, posing a significant threat to business systems and sensitive data.
The vulnerabilities affect the PHP core runtime environment, not just individual website plugins, making them a global concern for the internet security community.
The widespread deployment of these vulnerabilities could lead to rapid escalation of their impact, affecting not just individual systems but the global internet infrastructure as a whole.