Link SharePSA: Critical Vulnerability Found with PHP

For developers - just to be aware. theunderKurrent does not run via PHP.

PHP2Shell - discovered by LCFR (@lcfr_hax on X.com)

The vulnerabilities consist of:

• CVE-2026-109618: corrupt process memory and execute arbitrary code
  Affected: upload progress, remote process memory disclosure
• CVE-2026-109618: corrupt process memory and execute arbitrary code, corrupt a PHP state and execute code
  Affected: fatal-error backtrace use-after-free, OPcache type confusion

How it was demonstrated: pre-authentication Remote Code Execution (RCE) with major CMSs, such as: Drupal, Wordpress, and Joomla, etc.

Since this is a low-level exploit and affects low-level PHP processes - pretty much any site will be affected.