PHP Vulnerability

PHP2Shell Explained: How CVE-2026-109618 and CVE-2026-109619 Let Hackers Hijack a PHP Server Without a Password

A new PHP flaw nicknamed PHP2Shell lets an attacker take over a server with a single request — no login, no stolen password, no bug in your code required. Here's exactly how CVE-2026-109618 and CVE-2026-109619 work, how to check if you're exposed with a free script, and how to fix it before someone else finds it first.