PHP2Shell: How to Assess Exposure, Exploitation and Impact
A vulnerable PHP runtime can establish technical exposure. It cannot, by itself, establish that an attacker executed code, accessed data or compromised an organization. That distinction is central to assessing CVE-2026-109618 and CVE-2026-109619, the PHP-core vulnerabilities referred to collectively in public reporting as PHP2Shell. The supplied PHP advisories describe different mechanisms: one concerns out-of-memory handling […]
