PHP is cooked - patch the forum

[chants]

PHP2Shell effects PHP versions 5.4 – 8.5. Remote code execution, so it is pretty seriously. Seems like it leaked prematurely. Found by AI unsurprisingly. The real question is why did PHP sit on this for a month before starting to work on it.

Article:

https://www.wiz.io/blog/php2shell-php-rce

Here is the proof of concept:

https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

Given exetools is on vBulletin which uses PHP, admins should be notified as this is pretty severe.