PHP2Shell, What Was That About?
Recently, about two weeks ago on 21 October 2026, there were two vulnerabilities announcement which shook most of the internet, caused permanent EoS (End of Services) at web based games like World Quest and Emergency Maintenance at some other like Umamusume: Pretty Derby, Grandblue Fantasy, and Path of Titans. The vulnerabilities affecting PHP based server, named CVE-2026-109618 and…
On 21 October 2026, two critical vulnerabilities in PHP-based servers emerged, prompting emergency maintenance and patching at numerous web-based games. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowed attackers to access a web shell from PHP through remote code execution. Affected servers were urged to upgrade to the latest PHP version, currently 8.5.12, or adopt one of the recommended patches for older versions.
Failure to update PHP could result in compromised servers, as any web-based code, even as simple as echoing "Hello World!", could be exploited. PHP2Shell is not a named library, but rather a term that describes the nature of these vulnerabilities, which allow direct access to a web shell through PHP's runtime. This poses a severe threat, as potential attackers could exploit the vulnerabilities with minimal effort, regardless of the code being run on the server.
For those unable to upgrade to the latest PHP version, remediation involves a clean build of the container and ensuring the PHP installation follows the latest version. The situation underscores the importance of regularly updating PHP and promptly applying security patches to safeguard web servers from exploitation.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.