Two CVEs (CVE-2026-109618, CVE-2026-109619) in PHP's own engine let an unauthenticated attacker run code or read server memory, with no app bug required. Wiz Research found them with frontier AI and showed working exploits on WordPress, Drupal and Joomla.
| Patch PHP | WAF rules | OpenNHP | |
|---|---|---|---|
| Works before the CVE is known | ✕ | ✕ | ✓ |
| Needs an exploit signature | — | Yes | No |
| Blocks unauthenticated RCE | ✓ once applied | ~ known variants | ✓ |
| Blocks memory disclosure | ✓ once applied | ~ known variants | ✓ |
| Hides the server from scanners | ✕ | ✕ | ✓ |
| Fixes the bug itself | ✓ | ✕ | ✕ |
They work together: OpenNHP removes the unauthenticated attack path, and patching removes the bug. Patch anyway.
-
Admin panels (
/wp-admin, Drupal admin) -
Internal PHP apps and back offices
-
APIs used by known clients
-
Staging and management servers
-
Anonymous-visitor websites
-
Patch these first, use WAF rules
-
Hide their admin and origin access
Authorized users can still reach a hidden app, so OpenNHP shrinks who can attempt an exploit from "the whole Internet" to "people you approved."
Authenticate Before Connection.
The next PHP2Shell is already in someone's AI pipeline. Give it nothing to reach.
Want help hiding your PHP services? Contact us at [email protected].