CVE Research
sekurity-team
InSEKurity of the Week (CW43/2026): PHP2Shell Unauthenticated RCE in PHP (CVE-2026-109618, CVE-2026-109619)
Two engine-level bugs in PHP itself turn a single unauthenticated multipart request into code execution as the web worker -- before any application code runs. CVSS 9.2, every PHP version back to 5.4, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Exploit
01
