CRITICAL SECURITY ADVISORY: PHP REMOTE CODE EXECUTION VULNERABILITIES (CVE-2026-109618 AND CVE-2026-109619 – "PHP2SHELL")
Uploaded 22 October 2026
The Cyber Security Experts Association of Ghana (CSEAG) wishes to draw the attention of all members to two critical vulnerabilities in the core PHP engine, disclosed on 21st October, 2026 and publicly referred to as "PHP2Shell". Each vulnerability carries a CVSS score of 9.2 (Critical). Members should note that early social media reports quoting a CVSS score of 10.0 were incorrect.

