LinkCalif ResearchResearch
Given PHP's extensive deployment across modern web infrastructure and CMS ecosystems, unauthenticated remote code execution under default configurations represents a critical risk requiring immediate application of the vendor security patches.
The research highlights how out-of-memory conditions, often treated as mere denial-of-service issues, can result in exploitable memory corruption when cleanup logic assumes valid state. By using LLM assistance to generalize the pattern of updating element counts before fallible memory allocations, researchers traced severe flaws in PHP request startup and session upload progress handling, particularly affecting mod_php request teardown.
Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.
Similar in content, found by the AI search.
Link:watchTowr
Dubbed PHP2Shell, two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP allow unauthenticated attackers to execute arbitrary code. Security firm watchTowr confirmed in-the-wild exploitation.
Article:Wiz Research
Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.
VideoVideo:CURT
Two critical vulnerabilities in the PHP core engine, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allow unauthenticated Remote Code Execution before application code even begins to execute.
Article:Daniele Molteni, Dan Jones, and Kuber Nandwani
Cloudflare has rolled out Managed WAF rules to protect against the php2shell vulnerabilities affecting PHP 5.4 and later. The mitigations introduce full transaction detection to block exploits before responses reach requesters.
Link:The PHP team
The PHP team has released updated Windows packages for multiple PHP branches, bundling Brotli 1.2.1 to patch an out-of-bounds write vulnerability.
Link:OpenAI
OpenAI has released the system card for GPT-6 Astra, its first model to achieve a 'Critical' cybersecurity capability rating, featuring stronger alignment and jailbreak resistance compared to GPT-5.6 Sol alongside reduced Chain of Thought monitorability.
Parts of this content were created with the assistance of AI.
