Tencent Cloud Issues Risk Advisory on PHP "php2shell" Remote Code Execution Vulnerability

On October 21, Tencent Cloud issued a risk advisory on the PHP "php2shell" remote code execution vulnerability. The advisory states that Tencent Cloud Security Center detected that PHP has been disclosed to contain a remote code execution vulnerability, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell." It could allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, thereby fully controlling the server and causing other harm. To avoid business impact, Tencent Cloud Security recommends conducting timely security self-checks and, if affected, promptly updating and patching to prevent intrusion by external attackers.