PHP 8.2 – 8.5
criticalCVSS 9.2
PHP2Shell: pre-authentication remote code execution through the session.upload_progress handler, exploiting memory corruption in the Zend engine.
Dampak
An unauthenticated attacker can execute arbitrary code with the web server user, read environment secrets and pivot into the internal network.
Perbaikan
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) and recycle all PHP-FPM workers.
Referensi resmi
https://nvd.nist.gov/vuln/detail/CVE-2026-109618Apakah situs Boss terdampak?
VulScan Pro mencocokkan versi komponen yang terdeteksi dengan CVE yang relevan, termasuk CVE-2026-109619.
Jalankan audit gratis