PHP2Shell effects PHP versions 5.4 – 8.5. Remote code execution, so it is pretty seriously. Seems like it leaked prematurely. Found by AI unsurprisingly. The real question is why did PHP sit on this for a month before starting to work on it.
Article:
Quote:
|
https://www.wiz.io/blog/php2shell-php-rce
|
Here is the proof of concept:
Quote:
|
https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
|
Given exetools is on vBulletin which uses PHP, admins should be notified as this is pretty severe.