Two critical PHP flaws, named PHP2Shell and identified as CVE-2026-109618 and CVE-2026-109619, allow an unauthenticated attacker to execute code remotely on a web server. They were discovered by a researcher using OpenAI’s GPT-5.6 Sol model and independently confirmed by Wiz, a division of Google Cloud. Fixes were released for PHP 8.2.12, 8.3.36, 8.4.27 and 8.5.12, while backports were under way for versions 7.4 through 8.1. About one-third of PHP websites remained unpatched, and more than 800,000 hosts were still running versions too old to receive a fix. Operational effects have already been observed in Finland and the Netherlands, where several government services were taken offline as a precaution.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
