Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
Executive Summary PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 score of 9.2, that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. Cloudflare has already reported […]
Read at Qualys Threat Research Unit
- Vendor
- Cloudflare, PHP
- Product
- Cloudflare WARP / Workers / Zero Trust, PHP
- CVSS v4.0
- 9.2
- EPSS
- 1.00 (p100)
- Exposure class
- Cloud platform, Web platform
Why it ranks 52 (High)
- CVSS v4.0 9.2 critical
- EPSS 1.00 (high probability of exploitation)
- Product class: cloud platform, web platform
- Covered by 37 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Qualys Threat Research Unit (blog.qualys.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-115560 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.