Two Critical PHP Flaws Let Attackers Run Commands on Web Servers Without a Login

Two critical vulnerabilities, collectively named PHP2Shell, have been disclosed in core PHP, the engine behind a large share of the web. They are tracked as CVE-2026-109618 and CVE-2026-109619, and both score 9.2 (Critical) on the CVSS 4.0 scale. Each allows an unauthenticated remote attacker to run arbitrary system commands on an affected web server over HTTP.

According to CrowdStrike, both flaws share one root cause. When PHP hits a fatal condition, such as running out of memory, exceeding its time limit or losing the client connection, it abandons the current task abruptly. Anything half-built is left incomplete, yet PHP carries on with a cleanup routine that assumes everything is in good order. The attacker controls the trigger and the data PHP then misreads. CrowdStrike says it verified that a single anonymous POST request can make an Apache mod_php worker launch a shell and run an attacker-chosen command.

The placement of the flaws is what makes them serious. PHP processes incoming request data before extensions load and before any application code runs, so a well-maintained website is exposed just as much as a neglected one. The attack is also quiet: the worker does not crash, the server returns a normal HTTP 200 response, and application logs show nothing unusual. CrowdStrike says its Falcon platform detects post-exploitation activity for both vulnerabilities.