PHP2Shell: Critical Unauthenticated RCE in PHP — Patch Now (CVE-2026-109618 & 109619)
This article is for learning and defence. Use what you read here only on systems you own or are explicitly authorised to test. Attempting to exploit these flaws on systems you do not control is illegal under India's IT Act and similar laws worldwide. Do not try to reproduce or weaponise these vulnerabilities. Two critical PHP bugs, nicknamed php2shell , can lead to unauthenticated remote code execution on web-facing PHP. Patch to 8.5.12 , 8.4.27 , 8.3.36 or 8.2.35 as soon as you can. If you cannot patch an internet-facing host, take it offline until you can. This post explains impact and patching only — not how to attack anyone. If you run PHP on the public internet — WordPress, Laravel, custom APIs, shared hosting, the works — you need to read this today. In late October 2026 the security community lit up around a pair of critical PHP flaws that people are calling php2shell . CISA told operators to patch immediately. CERT-EU noted that proof-of-concept material was ...