php2shell one week later: Why one exploit doesn’t work everywhere

Tenable reports on actively exploitable critical vulnerabilities affecting PHP and Google's Brotli decoder. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) can enable unauthenticated remote code execution, with exploitation dependent on target-specific PHP builds but especially relevant to internet-facing management interfaces, network appliances, and unsupported PHP branches. Brotli2Shell (CVE-2026-111497) is a 9.2-CVSSv4 out-of-bounds write with public proof-of-concept exploits, affecting applications and runtimes that decompress attacker-controlled Brotli data; it has been added to CISA'sเค