Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, could allow remote code execution without authentication on affected servers. PHP powers 69.3% of websites with an identified server-side language, while France accounts for 60% of the 11 million PHP services detected worldwide, although that estimate was inflated by an error in the Freebox count. There is currently no confirmation that Freebox devices are vulnerable, and the presence of PHP on a server does not establish that it can be compromised. Administrators should apply the patches as soon as they are released at the server level, check remote access to Freebox OS and, for crypto activity, postpone non-urgent transactions on websites with uncertain security.
Source: Read the original article
