Mmastodon TechnologyCybersecurity first seen 22 h ago, last 22 h ago, peak #5
Critical Pre-Auth PHP Flaws PHP2Shell Draw Security Focus
Original: PHP2Shell: What Is Easy and What Is Hard to Exploit PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair
Security researchers are discussing PHP2Shell, a pair of pre-authentication remote code execution flaws in PHP's request parser, tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2. The flaws are reportedly reachable through any PHP endpoint on default configurations, involving session upload progress and file uploads, and analysis is focusing on which exploitation paths are easy versus hard in practice.
Why now: A newly discussed pair of critical, easily reachable PHP vulnerabilities raises immediate concerns for defenders assessing patching and exposure.
PHPCVE-2026-109618CVE-2026-109619
Evidence
- PHP2Shell: What Is Easy and What Is Hard to Exploit PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of pre-authentication RCE flaws in PHP's request parser, reachable through any PHP endpoint on default configs (session upload progress and file uploads).… · beyondmachines1@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/3612484