CISA Warns of Critical PHP Vulnerabilities, Including New Unpatched RCE, Affecting Web Applications

CISA has updated its alert regarding critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as "php2shell"), which allow unauthenticated remote code execution and have been added to its Known Exploited Vulnerabilities Catalog. Additionally, a new unpatched remote code execution vulnerability, CVE-2026-115560, has been disclosed, posing further risks to PHP-based web applications. Organizations are urged to patch immediately.