PHP2Shell: CVE-2026-109618 and CVE-2026-109619 PHP RCE flaws actively exploited, hitting 10% of organizations worldwide
Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meanin…