PHP2Shell CVE-2026-109618 and CVE-2026-109619 still unpatched after patches

Nearly two weeks after the release of emergency patches for the critical PHP2Shell vulnerabilities, millions of scannable servers remain unpatched. Security data and recent real-world incidents reveal that attackers are actively exploiting the flaws, sometimes combining them with other vulnerabilities like the Linux kernel issue Fragnesia. Although mass compromises have not materialized due to the specific configurations required, developers strongly urge administrators to audit systems, install subsequent library updates, and apply security patches. Open article →