Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE 2026 109618 and CVE 2026 109619 nicknamed PHP2Shell, let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is affected, and exploitation in the wild...
