Latest / The Digital Warfare Podcast
EP. 187: PHP2Shell Gives Attackers a Direct Shot at Internet-Facing Web Servers
Summary
PHP has released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical PHP2Shell vulnerabilities that can allow unauthenticated remote code execution. CVE-2026-109618 involves corruption during out-of-memory handling, while CVE-2026-109619 can leave stale global state pointing into freed request memory.
The vulnerabilities affect a broad range of PHP deployments, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Authorities have warned that internet-facing PHP servers are at heightened risk, and reports of active exploitation are now being tracked.
Key…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.