PHP2Shell: critical PHP remote code execution
CVE-2026-109618 / CVE-2026-109619. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch and restart.
Not sure which of your vendors run affected PHP? That is exactly what we can help you assess.
Read the Rescana advisory →How we can help
- Identify which of your third and fourth parties may be exposed
- Prioritize the vendors that matter most to your business
- Know what to ask them, and track their answers
Rescana is a third-party risk platform, not an incident response firm. If your own environment is actively breached, please also engage your incident response provider and the relevant authorities.