Skip to content
Sign in
StableReported 2026-10-23 11:03

PHP2Shell vulnerability exposes millions of servers to remote code execution

On October 21, 2026, two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed as 'PHP2Shell' allow unauthenticated remote code execution. Over 5.1 million internet-facing PHP hosts are potentially affected, posing severe risk to critical infrastructure. QiAnXin's 'Tianji' AI penetration testing system offers a one-click assessment solution.

Why it matters. The vulnerability affects a foundational component used by roughly three-quarters of all websites globally, creating widespread exposure that threatens government, financial, energy and other critical infrastructure assets, and…

01

Who and what it touches

WordPressusesDrupalusesApache 2usesDrupalusesJoomlausesWebsitesenablesMagentoenablesmemoryusesPHP

Into PHP

From PHP

Each line is a relation with evidence behind it, drawn in the direction it points. A line shows that two things are connected, not how far this change reaches.

02

Evidence

  • 雷雷峰网Media2026-10-23 11:03
    View source