426 Android and iOS Apps Linked to PHP2Shell Backend Risks
426 Android and iOS apps linked to servers with PHP2Shell vulnerabilities.
Run NowSecure?
Get an email when a reviewed story names NowSecure, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Security researchers discovered 426 mobile applications on Android and iOS that connect to backend servers potentially vulnerable to PHP2Shell flaws. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute code on affected servers. Developers are urged to verify their backend server versions and apply patches to prevent potential exploitation.
The lesson from this incident
Full lessonHundreds of Android and iOS applications were found connecting to backend servers running a vulnerable version of PHP2Shell, exposing them to two critical CVEs that allow unauthenticated remote code execution. The root cause is straightforward: developers failed to keep their server-side dependencies patched and audited, creating a silent but severe attack surface behind otherwise functional mobile apps. This matters because exploiting these flaws requires no credentials, meaning any internet-connected attacker could fully compromise the backend and the data of every user served by those 426 apps. The scale of the exposure — spanning both major mobile platforms — illustrates how a single unpatched backend component can become a systemic risk across an entire developer ecosystem.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
- cve — CVE-2026-109618
- cve — CVE-2026-109619