CCCS Alert AL26-026: Critical PHP CGI/FastCGI Vulnerabilities (“PHP2Shell”)
Unauthenticated remote command injection in PHP CGI/FastCGI implementations enabling arbitrary server takeover without prior credentials. Threat Sentinel swept 32 client web endpoints across multi-tenant Plesk clusters, identified active runtime versions (8.3, 8.2, 8.1, legacy 5.6), and deployed Nginx upstream filtering rules within 15 minutes of feed ingestion.
CVE-2026-109618
CVE-2026-109619
Impact:
32 Endpoints Assured • Zero Downtime