PHP Exposed with php2shell Remote Code Execution Vulnerability, Tencent Cloud, OpenAI, and Google Issue Joint Announcements
English text is being prepared.
PHP has been disclosed to contain remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, codenamed php2shell, through which attackers can trigger memory corruption via specially crafted multipart POST requests and gain full control of the server. Tencent Cloud issued a risk advisory on the evening of October 21 and recommended self-inspection and remediation; OpenAI said this is one of the most impactful vulnerabilities recently and will provide defenders with $1 billion in subsidized access credits through the Daybreak for Frontline Defenders program; Google said Google Cloud itself is not affected, but users running PHP on the platform may still face risks, and Gemini4Argon participated in vulnerability discovery, exploit development, attack detection, and patch verification.
Why read this
AI score 74
The high-risk PHP vulnerability has prompted simultaneous responses from Tencent Cloud, OpenAI, and Google, revealing the different roles cloud vendors and model vendors play in vulnerability response.
Topics
Body
文章主体
腾讯云10月21日晚发布PHP"php2shell"远程代码执行漏洞风险通告。通告称，腾讯云安全中心监测到，PHP被披露其存在远程代码执行漏洞，漏洞编号分别为CVE-2026-109618,CVE-2026-109619，代号"php2shell"。可导致未经身份验证的远程攻击者通过发送特制的multipart POST请求，触发内存破坏并最终实现远程代码执行，从而完全控制服务器等危害。为避免业务受影响，腾讯云安全建议及时开展安全自查，如在受影响范围，请及时进行更新修复，避免被外部攻击者入侵。
稍早前，PHP官方发布声明称，在10月20日(星期二)约UTC时间15:00，涉及本次漏洞的两个CVE编号开始在在线论坛和社交媒体上流传。
OpenAI就PHP软件中发现的严重漏洞发表声明，指出鉴于漏洞的严重性和PHP的广泛使用，这是近期影响最大的漏洞之一。OpenAI承诺通过其“Daybreak for Frontline（FRO） Defenders”计划，提供价值10亿美元的补贴访问额度，以支持防御者。
谷歌就PHP核心漏洞CVE-2026-109618和CVE-2026-109619作出回应。谷歌表示，Google Cloud云平台本身不受这两个漏洞影响，但在该平台上运行PHP的用户仍可能面临风险。谷歌还表示，Gemini4Argon参与了漏洞发现、漏洞利用程序开发、攻击检测和补丁验证工作。
（文章来源：财闻） 正文中部 内嵌广告