PHP2Shell critical RCE flaws exploited in the wild

Two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, are now being actively exploited in the wild. The exploitation indicates a shift from proof-of-concept to real-world attacks, increasing urgency for patching. The full scope of affected systems and threat actor attribution remains unclear.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works