PHP2Shell

PHP2Shell
CVE identifiersCVE-2026-109618
CVE-2026-109619
Date patched21 October 2026; 0 days ago (2026-10-21)
Affected softwarePHP versions 5–8

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scripting language PHP.

The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with all other information about the vulnerability.

Early reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected.

Wikimedia's Phabricator as seen hours before the patch, having been disabled as a precaution

The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. Wiz Research who discovered it said the severity reached 10.

It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update as soon as the patch was released. One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release". PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.[better source needed] Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.

Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter.

See also

References

  1. ↑ "PHP: News Archive - 2026". www.php.net. 2026-10-20. Retrieved 2026-10-21.
  2. 1 2 "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)". Huntress. Retrieved 2026-10-21.
  3. ↑ "php.announce: [ANNOUNCE] Upcoming Critical PHP Security Release". news-web.php.net. Retrieved 2026-10-21.
  4. 1 2 Abrams, Lawrence. "PHP warns admins of two critical flaws, emergency patches coming tomorrow". BleepingComputer. Retrieved 2026-10-21.
  5. ↑ "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet". Retrieved 2026-10-21.
  6. ↑ "Critical vulnerabilities in PHP | Stay tuned for php2shell mitigation and patches". www.aikido.dev. Retrieved 2026-10-21.
  7. ↑ Goodin, Dan (2026-10-21). "PHP warns it plans to release 2 emergency patches imminently". Ars Technica. Retrieved 2026-10-21.
  8. ↑ "Only for the curious..." jackalsyn.com. Retrieved 2026-10-21.
  9. ↑ Knecht, Dane (21 October 2026). "Dane Knecht 🦭 (@dok2001) on X". X (formerly Twitter).
  10. ↑ "Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits". PC Gamer. 2026-10-21. Retrieved 2026-10-21.
  11. ↑ "RCE via OOM corruption". 2026-10-21. Retrieved 2026-10-21.
  12. ↑ "RCE via stale global state". 2026-10-21. Retrieved 2026-10-21.