PHP2Shell
Two flaws in PHP let anyone on the internet run their own code on a server that uses PHP, without logging in. About 70% of websites run PHP, and attacks were seen before the fix was public.
- On a Mac
- Matters if PHP is installed on your Mac, for example for local web development. The websites you use have to patch their own servers; nothing on your Mac changes that.
- The fix
- PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
- CVEs
- CVE-2026-109618, CVE-2026-109619
- Sources
From the Briefing, updated 15 minutes ago.
