Two critical remote code execution vulnerabilities reported under the collective name PHP2Shell are being exploited in the wild, with BleepingComputer's report identifying them as CVE-2026-109618 and CVE-2026-109619. Confirmed real-world exploitation is the central fact of this story: these are no longer theoretical issues, and administrators running PHP workloads should treat patching as a priority task.
What is established
According to the BleepingComputer report, both flaws are rated critical, and both have been observed being exploited by attackers in actual incidents. The two vulnerabilities are grouped together as PHP2Shell, and the pairing suggests a relationship, one likely serving as a stepping stone to the other, though that relationship has not been formally confirmed.
Equally important is what the currently available reporting does not establish:
- Affected versions — the specific PHP versions or component builds at risk have not been identified in the source material.
- Exploit prerequisites — it is not yet clear what conditions an attacker must satisfy to trigger either flaw.
- Threat attribution — no actor or campaign has been publicly linked to the exploitation.
- Indicators of compromise — full IOCs have not been released.
Until the primary vendor advisory is available, administrators should not use the absence of version information to scope themselves out of risk. Guidance should be taken from official PHP project advisories rather than secondary reporting alone.
Why it matters
PHP remains foundational to a large share of the web, particularly in content management systems and small-to-medium business applications. Any RCE flaw confirmed as actively exploited carries broad blast radius: a successful exploit lets an attacker run arbitrary code with the privileges of the web server process, which typically means filesystem access, database credentials, and a foothold for lateral movement.
For Hong Kong readers, the relevance is the general one — no locally specific exposure or response is claimed in the current reporting, but any environment running an unpatched PHP runtime stays in scope until the vendor says otherwise.
For environments where PHP is deployed through managed hosting or bundled into standard website stacks (a common pattern across many IT teams, including those managing WordPress-based sites), the vulnerable runtime may be maintained by a third party. In those cases, the practical first step is confirming with the hosting provider which PHP version is in use and whether an upgrade path exists. For teams managing their own runtime, a quick php -v check is the starting point for inventory.
Priority actions
- Inventory. Identify every system, container, and hosting account running PHP, and record the exact version.
- Patch. Apply the vendor's fixed release as soon as it is published; do not wait for a full technical post-mortem.
- Audit exposed services. Confirm that PHP-facing endpoints are not unnecessarily reachable from the public internet, and that administrative interfaces sit behind authentication.
- Hunt for post-exploitation artefacts. Look for unexpected processes spawned by the web server user, new or modified files in web roots, and unexplained outbound connections.
- Monitor for IOCs. Subscribe to authoritative feeds so that indicators, once released, can be matched against logs quickly.
Bottom line
The gap in public detail is not a reason to delay. When exploitation is confirmed and version guidance is pending, the safest posture is to patch first and verify scope afterwards, then update controls as vendor advisories, patched versions, and technical analyses land. This report will be revised as those primary sources become available.
兩個統稱為 PHP2Shell 的致命遠端執行代碼（RCE）漏洞已被證實在野外遭實際利用，BleepingComputer 的報導將其分別標示為 CVE-2026-109618 及 CVE-2026-109619。現實世界中的利用已獲確認，這正是本篇報導的核心重點：相關問題已非純理論性質，負責管理 PHP 工作負載的系統管理員應將修補漏洞列為優先任務。
已確知的事實
根據 BleepingComputer 的報導，兩個漏洞均被評定為 critical 級別，且在多宗實際事件中均觀察到遭攻擊者利用。這兩個漏洞被歸類為 PHP2Shell，成對出現顯示它們之間可能存在關聯——其中一個很可能是另一個的踏腳石——但此關聯尚未獲得正式確認。
同樣重要的是，目前可得的報導未能確知的事項：
- 受影響版本 — 原始材料中並未指明哪些特定 PHP 版本或元件 build 版本存在風險。
- 漏洞利用先決條件 — 攻擊者須符合哪些條件方能觸發上述漏洞，目前仍未清楚。
- 威脅歸因 — 尚未有任何攻擊者或攻擊行動被公開指認為此次漏洞利用的來源。
- 入侵指標（IOC） — 完整的 IOC 尚未發布。
在廠商官方安全公告出爐之前，系統管理員不應因缺乏版本資訊而斷定自己不在風險範圍之內。指引應取自 PHP 專案官方公告，而非單靠二手報導。
為何重要
PHP 依然是大部分網站的基礎技術，尤其常見於內容管理系統及中小型企業應用程式。任何已被證實遭積極利用的 RCE 漏洞，影響範圍極為廣泛：攻擊者一旦成功利用，即可利用 web server process 的權限執行任意代碼，通常代表可存取檔案系統、取得數據庫憑證，並為橫向移動建立據點。
對香港讀者而言，相關性屬一般層面——現有報導並未聲稱存在本地特定的風險或應對措施——但在廠商另行通知之前，任何執行未修補 PHP runtime 的環境均仍在風險範圍之內。
對於透過託管服務（managed hosting）部署 PHP，或將 PHP 整合至標準網站技術組合的環境（這是不少 IT 團隊的常見模式，包括管理 WordPress 網站的團隊），有漏洞的 runtime 可能由第三方維護。在此情況下，實際上第一步是向 hosting provider 確認正在使用的 PHP 版本，以及是否存在升級途徑。至於自行管理 runtime 的團隊，執行一次 php -v 檢查即是建立版本清單的起點。
優先行動
- 盤點。 識別所有執行 PHP 的系統、container 及 hosting 帳戶，並記錄確實版本。
- 修補。 建議廠商發布修復版本後盡快套用；毋須等待完整的技術事後報告（post-mortem）。
- 審計對外服務。 確認面對公眾的 PHP endpoint 並非不必要地從公開互聯網可達，且管理介面設有身份驗證保護。
- 搜尋漏洞利用後遺留痕跡。 檢查是否有 web server 用戶意外產生的 process、web root 下新增或修改的檔案，以及無法解釋的對外連線。
- 監控 IOC。 訂閱權威消息來源，以便 IOC 一經發布即可迅速與日誌比對。
總結
公開資料有所欠缺，並非延遲處理的理由。在漏洞利用已獲證實、版本指引仍待發布之際，最穩妥的做法是先修補、後確認影響範圍，其後再隨著廠商安全公告、已修補版本及技術分析陸續出台而不斷更新防護措施。本報導將隨上述一手消息來源的公佈而作修訂。