Tencent Cloud warns of PHP 'php2shell' remote code execution vulnerability, advises timely self-inspection and remediation

October 21: Tencent Cloud Security Center has detected that PHP has been disclosed to have remote code execution vulnerabilities, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell." These can allow unauthenticated remote attackers to trigger memory corruption by sending specially crafted multipart POST requests and ultimately achieve remote code execution, thereby gaining full control of the server and causing other harm.

Tencent Cloud Security recommends promptly conducting security self-checks. If you are within the affected scope, please update and fix promptly to avoid intrusion by external attackers.