Windows Security Alert: Two Critical PHP RCE Vulnerabilities (PHP2Shell) Rated CVSS 9.2

Windows Security Alert: Two Critical PHP RCE Vulnerabilities (PHP2Shell) Rated CVSS 9.2

Two critical vulnerabilities, collectively referred to as PHP2Shell, have been reported in PHP, raising serious security concerns for websites and applications running on affected PHP installations.

Both vulnerabilities have been assigned a CVSS v4.0 severity score of 9.2 and are reported to allow remote code execution (RCE). Successful exploitation could enable attackers to execute malicious commands on vulnerable servers, potentially leading to unauthorized access, data theft, and system compromise.

Vulnerability details

  • Vulnerability Name: PHP2Shell

  • CVE IDs: CVE-2026-109618 and CVE-2026-109619

  • Severity: Critical 

  • CVSS v4.0 score: 9.2

  • Impact: Remote code execution 

  • Platform: Windows

PHP is used as a portable application without requiring a traditional installation. As a result, such PHP installations may not be identified through conventional vulnerability scans.

To enable vulnerability detection for these portable PHP installations, kindly contact our support team to enable Drive Scan on your managed computers. Drive Scan helps identify PHP files and binaries present on the endpoints, allowing affected installations to be assessed for these vulnerabilities.

Once the vulnerabilities are detected, please follow the vendor-recommended remediation steps and upgrade to the recommended PHP versions specified directly within each vulnerability's detail section. You can download and upgrade the latest applicable version from the official PHP website to protect affected systems from potential exploitation.