The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
PHP2Shell will persist in enterprise environments for years
- Published
- Record updated
Summary
Two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed in PHP, and CISA has added both to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Many PHP runtimes embedded in NAS devices, firewalls, printers and OT panels cannot be patched directly, and some run unsupported versions with no upstream patch, so the flaws may persist for years. Researchers reported widespread scanning and attempted exploitation but no confirmed compromise of production systems.
Mitigation
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the official fixed versions. Linux distributions deliver fixes through their own package managers, and for some end-of-life or LTS branches, fixes must be backported by distribution maintainers or obtained through paid support contracts. Relying on version numbers alone is not sufficient.