Overview
- Two critical PHP memory‑management bugs called php2shell (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution and were patched by the PHP Foundation on 21 October.
- Security teams and CISA have confirmed active exploitation of php2shell with honeypots recording executed shells and millions of automated scanning and exploit attempts observed.
- Scanners report large numbers of still‑vulnerable installations, with Censys showing roughly four million services in Germany reporting vulnerable PHP version strings.
- A separate Brotli decoder overflow (CVE-2026-111497, nicknamed Broccoli2Shell) and a 16‑year‑old EDK II UEFI PXE bug (CVE-2026-97631) have proven exploitable or are being probed, and vendors have released patches for Brotli, Node.js, Python and some firmware vendors have issued fixes or mitigations.
- Operators are urged to update immediately, disable Brotli decoding or PXE where not needed, treat affected systems as potentially compromised, and expect faster exploit development driven by AI and early disclosure leaks to squeeze remediation windows in future incidents.