Critical PHP vuln: php2shell (CVSSv4 9.2, CVE-2026-109618 / CVE-2026-109619)

[daern]

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger.

Yes, it is vulnerable, unlike what @meyergru would apparently like us to think. If you can reach any part of the web UI, you can reach php.

Add a firewall rule to only accept traffic to the management UI from the single PC you are currently sat at and sit tight for the update. You could even block all access and only manage the server via the console until such time as an update is available. Either way, there are mitigations available to you and a rushed, untested patch could probably end up resulting in the downtime that you are presumably trying to avoid.

No, it's not an ideal situation, but @meyergru is right in saying that if you think this is the only AI-driven exploit going around, you should probably open your eyes...

[mimugmail]

Calm down guys, Franco is already working on a patch :)

[nero355]

Calm down guys, Franco is already working on a patch :)

COOL! :)

[muchacha_grande]

The security check is frightening !!! it's better not to ask for it

[br_opnsense]

Seems like PHP 8.5.12 is available for 26.7.