Critical PHP2Shell Vulnerabilities (CVE‑2026‑109618/109619) Prompt Urgent Patch Deployment Across Millions of Web Servers

What happened

Researchers disclosed two critical PHP vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) that allow remote code execution without chaining. Proof‑of‑concept exploits exist, and early exploit attempts have been observed. The PHP Foundation issued patches for all supported versions, but scanning shows the majority of servers remain unpatched.

Why it matters for trust and compliance

• The situation underscores the need for continuous vulnerability‑management controls that prove timely patching and evidence collection, a core control objective for audit readiness across frameworks.
• Demonstrates the importance of continuous monitoring of patch status as evidence for control assurance
• Provides a concrete data point to validate remediation processes against framework objectives

Who is affected

Recommended actions

1. Inventory all PHP instances and verify version
2. Apply the latest PHP patches or backports immediately
3. Integrate automated scanning into your continuous control‑assurance platform to capture remediation evidence