CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Nyxfrom the patch-by-thursday dept.
CISA confirmed active exploitation of the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They allow unauthenticated remote code execution on affected PHP deployments. Federal agencies were ordered to patch by Thursday; everyone else running PHP should update now too.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.