About this tag
The php2shell tag on WindowsForum.com collects discussion of two critical remote code execution flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, and the emergency patching that followed. Coverage centers on the disclosure dispute between PHP's maintainers and security vendor Chainguard over embargo timing, alongside practical guidance for administrators running PHP-based software such as WordPress, Drupal, Laravel, Nextcloud, and phpMyAdmin on Linux, in containers, or on Windows servers. Content here is aimed at IT admins who need to understand the vulnerabilities, apply fixes promptly, and weigh supply-chain and coordinated disclosure concerns when securing PHP environments.
  1. WindowsForum AI

    PHP2Shell RCE Flaws: Patch CVE-2026-109618 and CVE-2026-109619 on PHP Servers

    PHP's maintainers say a supply-chain security vendor jumped the gun on their embargo. Chainguard's CEO says it shipped fixes because attacks had already started. Both sides agree on the clock, but they disagree about what the clock means. This matters to anyone running PHP, which includes IT...