Tencent Cloud has issued a risk advisory for the PHP "php2shell" remote code execution vulnerability.

Tencent Cloud Security Center has detected that PHP has been disclosed to have remote code execution vulnerabilities, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". These can allow unauthenticated remote attackers to trigger memory corruption by sending specially crafted multipart POST requests and ultimately achieve remote code execution, thereby gaining full control of the server and causing other harm. Tencent Cloud Security recommends that you promptly conduct a security self-check. If you are within the affected scope, please update and remediate promptly to avoid intrusion by external attackers.