Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
About this summary. This is a short excerpt from the description that Wiz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wiz.io/blog/php2shell-php-rce
Source attribution: headline and facts are from Wiz (wiz.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own…
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass.
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…
Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP…