Hi,

An AI model just helped researchers uncover a Remote Code Execution (RCE) flaw that had been present in PHP for a decade. Security patches are now available.

Tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), these critical vulnerabilities (9.2 CVSS) allow an unauthenticated attacker to execute arbitrary commands on a server.

We have already added both PHP2Shell vulnerabilities into the Fluid Attacks platform, so our clients don't have to wait to find out if their systems are exposed.

Log in to your workspace and use the search bar to filter your current vulnerabilities by the CVE IDs (CVE-2026-109618 or CVE-2026-109619). This will show you exactly which projects and container images require an immediate update:

• Affected versions: The vulnerabilities impact PHP branches 8.2 through 8.5, as well as older End of Life (EOL) branches.
• Required action: Update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Once updated, you must restart every PHP worker and rebuild your container images to clear the global state.
• WAF limitations: Web Application Firewalls (WAF) provide a defense-in-depth layer but do not remove the underlying risk. A code-level patch is mandatory.

Our latest blog post explains how this attack bypasses common defenses to drop a web shell. Read it here.