Tencent Cloud Issues Advisory on PHP "php2shell" Remote Code Execution Vulnerability

On October 21, Tencent Cloud Security Center detected that a remote code execution vulnerability was disclosed in PHP, with vulnerability identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". This flaw could allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, resulting in severe impacts such as complete server compromise.

Tencent Cloud Security recommends conducting timely security self-assessments. If your systems fall within the affected scope, please apply updates and patches promptly to prevent intrusion by external attackers.