Php2shell: A Network Edge Risk Playbook
TL;DR: Most appliance vendors have shipped php2shell fixes. The remaining exposures linger in devices that will stay vulnerable until someone replaces them. On October 21, 2026, the PHP project fixed two remote code execution flaws in the PHP core code, tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 (Critical). Researchers at Calif, working with […] The post Php2shell: A Network Edge Risk Playbook appeared first on Eclypsium .
- Vendor
- PHP
- Product
- PHP
- CVSS
- 9.2
- EPSS
- 0.83 (p100)
- Exposure class
- Web platform
Why it ranks 58 (High)
- CVSS 9.2 critical
- EPSS 0.83 (high probability of exploitation)
- Product class: web platform
- Covered by 42 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Eclypsium (eclypsium.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2023-36845 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-46300 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.