PHP2Shell: Critical Vulnerabilities Actively Exploited
PHP2Shell: Critical Vulnerabilities Actively Exploited
Two critical PHP vulnerabilities, CVE-2026-1096118 and CVE-2026-1096119, both scored 9.8 out of 10, were patched on 21 October 2026. Within hours, attackers began probing for unpatched servers. These flaws allow unauthenticated remote code execution on vulnerable PHP installations, affecting WordPress, WooCommerce, Magento and countless UK small business websites. The vulnerabilities involve memory corruption and stale global state handling. Emergency patches are available for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.