vulnerability
There's a third PHP2Shell bug, but it won't get an emergency fix
HighCVSS 9.8EPSS 6%
Summary
A third PHP vulnerability, dubbed PHP2Shell, has been identified, but it’s unlikely to be widely exploited due to a complex configuration requirement. The PHP Foundation has released an advisory suggesting users disable the session upload progress feature until a regular bugfix release.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 26 other source(s)
- Multiples vulnérabilités dans PHP (21 octobre 2026)
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- PHP2Shell : deux failles critiques menacent les serveurs web
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Two critical RCEs in PHP core
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- PHP2Shell Exploitation Started Days Before Patches
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- New Serious PHP Vulnerabilities Released and Patched
- PHP2Shell puts dozens of UK government services out of service
- Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- Exposed to PHP2Shell? Cyber Experts Weigh in With Advice