DICT Cybersecurity Unit Warns of Critical PHP Vulnerabilities 'PHP2Shell'

The National Computer Emergency Response Team (CERT-PH) has issued a warning regarding two critical vulnerabilities in PHP, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These flaws could allow attackers to remotely execute malicious code on affected servers, potentially exposing sensitive information, enabling unauthorized website changes, or disrupting online services. System administrators and web developers are urged to apply security patches immediately, as PHP is widely used in approximately 70% of websites.