Major PHP CVE "php2shell"
- Posts
- 61
- Group
- Members
- Joined
- 22nd Mar 26
- Reputation
- 17
Two major PHP CVEs (CVE-2026-109618/109619) announced a few hours ago under the name “php2shell” affects any site running PHP 5 to 8.
At the time I write this post PHP devs have been released a new update for 8.2, 8.3, 8.4 and 8.5 which patches this issue and same with Sury PHP repositories (with patches for =<8.1 versions) in case someone is using that on Debian (like me).
Cloudflare also released a WAF rule regarding this issue too but it may not be a solution to this exploit.
More info at https://php2shell.com/ and https://en.wikipedia.org/w/index.php?title=PHP2Shell
Last edited by Alien Hominid
- Posts
- 240
- Group
- Administrators
- Joined
- 2nd Mar 26
- Reputation
- 23
Yikes thankfully none of my sites were affected by this. (Since this forum is hosted on Forum Spark at least lol.) My other ones are fine too thankfully. I don’t have a VPS anymore so I don’t need to worry about having to upgrade anything.