PHP2Shell Needs One HTTP Request. OpenNHP Never Lets It Arrive

Wiz Research discovered two vulnerabilities in PHP's own engine, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker execute code or read server memory without any application bug, and demonstrated working exploits against WordPress, Drupal and Joomla. OpenNHP is pitching its authenticate-before-connection product as a way to remove the unauthenticated attack path by hiding PHP admin panels, internal apps and APIs from scanners, while still advising that organizations patch PHP and apply WAF rules.

Two CVEs CVE-2026-109618, CVE-2026-109619 in PHP's own engine let an unauthenticated attacker run code or read server memory, with no app bug required. Wiz Research https://www.wiz.io/blog/php2shell-php-rce found them with frontier AI and showed working exploits on WordPress, Drupal and Joomla. | | Patch PHP | WAF rules | OpenNHP | |---|---|---|---| | Works before the CVE is known | ✕ | ✕ | ✓ | | Needs an exploit signature | — | Yes | No | | Blocks unauthenticated RCE | ✓ once applied | ~ known variants | ✓ | | Blocks memory disclosure | ✓ once applied | ~ known variants | ✓ | | Hides the server from scanners | ✕ | ✕ | ✓ | | Fixes the bug itself | ✓ | ✕ | ✕ | They work together: OpenNHP removes the unauthenticated attack path, and patching removes the bug. Patch anyway. - Admin panels /wp-admin , Drupal admin - Internal PHP apps and back offices - APIs used by known clients - Staging and management servers - Anonymous-visitor websites - Patch these first, use WAF rules - Hide their admin and origin access Authorized users can still reach a hidden app, so OpenNHP shrinks who can attempt an exploit from "the whole Internet" to "people you approved." Authenticate Before Connection. The next PHP2Shell is already in someone's AI pipeline. Give it nothing to reach. Want help hiding your PHP services? Contact us at \ email protected\ https://opennhp.org/cdn-cgi/l/email-protection 67141217170815132708170209090f1749081500 .