By A new cyber attack that can let an attacker run commands on a web server without logging has been uncovered the PHP project team, according to a new security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.
According the security report, both vulnerabilities can let an attacker run commands on a web server without logging in adding that nearly all PHP versions extending as far back as 5.4 are reportedly affected.
Details of the vulnerabilities were disclosed before the patches were available, and attackers began trying public exploits before patches were released.
The report warned that a successful attack gives full server access to execute remote code without authentication, and provide full memory access stressing that that can lead to stolen data or defaced pages, and in the worst case a full takeover of the system.
“Passwords and APl keys held in memory can also be exposed. Security firms have already observed exploitation attempts”, the experts noted.
The report further stated that “Potentially affected systems include PHP-based websites and applications, including popular platforms such as WordPress, Drupal, Joomla and Laravel, as well as vendor products that bundle PHP.”
The report recommended updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, starting with public-facing systems adding “If you cannot update now, take the system offline until it is fixed. Confirm your hosting provider and PHP-based tools like WordPress and Laravel run a fixed PHP version, and check for signs of compromise.”
