Boss appreciating me for keeping our servers safe from the PHP2Shell exploit (CVE-2026-109618).
Me who is still running static HTML pages because I never learned PHP.
The detailed vanity site
php2shell.com/
AI endpoint security chart so you can understand where these products sit, how they get in there and what they can enforce based on the path.
Search your domain on fullhunt.io/search with tag:php to find if you have exposed PHP apps @FullHunt @mazen160
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations php.net/
Search your domain on fullhunt.io/search with tag:php to find if you have exposed PHP apps
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed







