PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.
Excerpt from the primary source: SecurityWeek
Who is affected
Security professionals
Why it matters
Attackers are exploiting this at scale, so exposed affected systems are likely to be targeted quickly.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running the affected products, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
There's only so much code: the rise in vulnerability numbers
The September Microsoft Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?
EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656) is being actively exploited, CISA warns
CISA added CVE-2026-96656 (Plex Media Server) to its Known Exploited Vulnerabilities catalog on October 20, 2026, which means there is reliable evidence of exploitation in the wild. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654…
CISA lists this as exploited in the wild. Unpatched Media Server systems are exposed to active attacks now.
Apply the vendor's security update for Media Server.