Member-only story
PHP2Shell
Two Flaws, 70% of the Web as the Target, and the 11 Minutes That Could Have Saved Millions.
An executive briefing on the PHP2Shell vulnerabilities (CVE-2026–109618 & CVE-2026–109619)
Introduction:
At 2:14 a.m. on a Saturday, a single HTTP request slipped into the web server of Meridian Freight Solutions, a mid-sized logistics company. It carried no password, tripped no login, and triggered no alert. The server answered with a routine HTTP 200, and the application logs recorded nothing unusual. By the time anyone noticed, the attacker had read the database credentials straight out of memory, pivoted to the customer billing system, and quietly exfiltrated 400,000 shipping and payment records. The forensic bill, regulatory fines, and lost contracts would eventually total an estimated $12 million.
Here is the part that should make every security leader uncomfortable: Meridian had been warned. Three weeks earlier, their senior cloud architect had flagged the newly disclosed PHP2Shell vulnerabilities and requested an emergency change window to patch. The request was deferred.
“It’s an internal portal, it’s behind our firewall, and we have a WAF. It can wait until the next maintenance cycle.” -VP, Meridian Freight Solutions
