FlagThis — Daily Cybersecurity Intelligence Briefing

PHP2Shell is a critical, pre-authentication remote-code-execution chain targeting the PHP runtime by combining CVE-2026-109618 (OOM memory corruption during multipart request cleanup) and CVE-2026-109619 (use-after-free via stale session upload-progress state). Exploitation occurs prior to application-level execution, significantly impacting Apache mod_php environments. Observed attacks have successfully pivoted from PHP-based web servers to Broadcom VMware ESX hypervisors, compromising approximately 25 servers, including U.S. government-linked infrastructure. Despite emergency patches released in October 2026, telemetry from OX Security indicates a severe remediation gap, with over 99% of exposed instances remaining unpatched.