php2shell one week later: Why one exploit doesn’t work everywhere

Tenable reports active exploitation concerns for two critical unauthenticated PHP remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Exploitation reliability depends on the target’s exact PHP build and configuration, but shared software builds such as network appliances may enable broadly reusable exploits. The feed also highlights Brotli2Shell (CVE-2026-111497), a critical out-of-bounds write in Google’s Brotli decoder with public proof-of-concept exploit code and CISA KEV inclusion; affected ecosystems include Node.js, .NET, Bun