https://hackpuntes.com/categories/vulnerabilities/Recent content in Vulnerabilities on HackpuntesHugo -- gohugo.ioen-usWed, 21 Oct 2026 00:00:00 +0000https://hackpuntes.com/posts/php2shell-php-rce-cve-2026-109618-109619/Wed, 21 Oct 2026 00:00:00 +0000https://hackpuntes.com/posts/php2shell-php-rce-cve-2026-109618-109619/<p><a href="https://hackpuntes.com/images/php2shell-php-rce-cve-2026-109618-109619/php2shell-banner.webp"><img src="https://hackpuntes.com/images/php2shell-php-rce-cve-2026-109618-109619/php2shell-banner.webp" alt="PHP2Shell, the critical PHP RCE (CVE-2026-109618 and CVE-2026-109619)" loading="eager" decoding="async" /> </a> </p> <p>Today, October 21st 2026, PHP shipped emergency patches for a pair of flaws that had been sitting in the code for <strong>fourteen years</strong> and that a lot of people are going to remember for a while. They are called <strong>PHP2Shell</strong>, they are <strong>CVE-2026-109618</strong> and <strong>CVE-2026-109619</strong>, and they allow remote code execution <strong>without authentication</strong> against a huge number of PHP servers. This is not a plugin or a framework bug, it lives in the PHP core itself, so the surface is massive.</p>