PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs

The hardest part of a critical infrastructure vulnerability is often finding every place where it is exposed. A company may know which applications use PHP, but not which PHP binaries actually serve those applications, which configuration files they load, or whether a public endpoint accepts request bodies the application never intended to process. That gap matters with the newly reported PHP2Shell issues, CVE-2026-109618 and CVE-2026-109619 . PHP has announced two critical…