H3-2026-0082¶
PHP Possibly Affected by PHP2Shell Memory-Handling Vulnerabilities (Inconclusive)
| Category | VULNERABILITY |
| Base Score | 5.3 |
Description¶
NodeZero encountered PHP hosts that it could not conclusively clear of the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619). Either the active probe could not reach a verdict, or only the advertised version indicated exposure. This is a lower-confidence companion to the confirmed CVE findings, and warrants manual review.
Impact¶
If the host is (in fact) unpatched, an unauthenticated attacker could corrupt the PHP worker's memory and potentially achieve code execution. This finding does not confirm exploitability.