#php

★ latest2026-10-21 · 12 min · #php

PHP2Shell: what CVE-2026-109618 and CVE-2026-109619 are and how to protect your PHP servers

Two critical PHP flaws allow unauthenticated remote code execution, before your application even runs. Which versions are affected, who is exposed, what Cloudflare's WAF covers, how to update and what to mitigate in the meantime.

• php
• security
• vulnerabilities
• laravel
• devops