PHP2Shell: CVE-2026-109618 & CVE-2026-109619
PHP2Shell is the name researchers now use for two critical vulnerabilities in PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and many custom web applications. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws reportedly allow Remote Code Execution (RCE), and the PHP security team rated each 9.2 on CVSS v4.0.
The flaws surfaced ahead of schedule. Their existence was leaked on October 20, 2026, two days before a coordinated disclosure, and the PHP security team responded that evening with an advance notice of an upcoming security release set for October 21, 2026, at 14:00 Coordinated Universal Time (UTC).
The following FAQ separates what PHP has confirmed from what remains leaked or unverified, shows which PHP branches will receive fixes, and lists what defenders should do before and after the release.
PHP2Shell at a Glance
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-109618, CVE-2026-109619 (not yet named in PHP’s notice) |
| CVSS | 9.2 CVSS v4.0 for each (PHP security team); vector not yet published |
| Affected Products | PHP |
| Affected Versions | Not confirmed by PHP; the leak claims PHP 5 onward |
| Fixed In | To be published with the release; fixes only for 8.2, 8.3, 8.4, and 8.5 |
| Exploitation Status | In-the-wild exploitation reported by some vendors, still under investigation; not yet in the Known Exploited Vulnerabilities (KEV) catalog |
| Patch Available | Scheduled for October 21, 2026, at 14:00 UTC |
| Discovered By | Not yet disclosed |
PHP2Shell Timeline
| Date (UTC) | Event |
|---|---|
| October 20, 2026 | Details of two critical PHP RCE flaws leak ahead of a coordinated disclosure |
| October 20, 2026 | Researchers confirm the flaws are leaked |
| October 20, 2026 | PHP security team publishes its advance notice of a security release |
| October 20, 2026 | CERT-EU publishes Security Advisory 2026-018 |
| October 21, 2026, 14:00 | Scheduled PHP security release |
| October 22, 2026 | Original coordinated disclosure date |
1. What Is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that researchers say let a remote attacker run code on a server running PHP. The name points to the expected result, a shell on the target.
Because the fix ships in PHP itself, protection for WordPress, Drupal, Magento, and other PHP applications depends on updating the server’s PHP version. Updating the application alone does not close the gap.
2. How Did PHP2Shell Become Public Before the Patch?
PHP2Shell became public through a leak. On October 20, 2026, details surfaced claiming that two PHP RCE flaws, rated critical and affecting every version since PHP 5, would be disclosed on Thursday, October 22, 2026. watchTowr then confirmed on X that the flaws were real and under embargo, and urged users to apply patches once available.
3. How Severe Are CVE-2026-109618 and CVE-2026-109619?
The PHP security team rates both flaws 9.2 on CVSS v4.0, which is critical severity. As of October 21, 2026, PHP had not published the scoring vector, root cause, or affected component for either flaw.
CERT-EU, the cybersecurity service for European Union institutions, says the 9.2 scores point to possible unauthenticated RCE.
4. Which PHP Versions Are Affected by PHP2Shell?
PHP has not yet confirmed which versions are affected. The reports claimed every release from PHP 5 onward, butno vendor advisory has confirmed that scope or described any configuration or feature requirement. PHP will publish affected and fixed versions with the release.
Fixes will ship only for the four supported PHP branches:
| Branch | Latest Release Before the Fix | Support Status | Receives the Fix |
|---|---|---|---|
| 8.5 | 8.5.11 (September 24, 2026) | Active support until December 31, 2027 | Yes |
| 8.4 | 8.4.26 (September 24, 2026) | Active support until December 31, 2026 | Yes |
| 8.3 | 8.3.35 (September 24, 2026) | Security fixes only until December 31, 2027 | Yes |
| 8.2 | 8.2.34 (September 24, 2026) | Security fixes only until December 31, 2026 | Yes |
| 8.1, 8.0, 7.x, 5.x | No further releases | End of life | No |
5. Will End-of-Life PHP Versions Get a PHP2Shell Fix?
No. End-of-life PHP branches, including 8.1, 8.0, 7.x, and 5.x, will get no fix from PHP. If PHP2Shell reaches those versions, servers running them will have no vendor patch, which makes upgrading to a supported branch the only permanent remedy.
Shodan lists around 884,000 internet-facing hosts running PHP 8.1 or older. An additional 740,000 hosts run PHP without specifying a version number.
6. Is PHP2Shell Being Exploited in the Wild?
As of October 21, 2026, PHP has not reported in-the-wild exploitation of PHP2Shell, and the Cybersecurity and Infrastructure Security Agency (CISA) has not added either CVE to its catalog.
Some security vendors, however, report attacks. Aikido said on October 21, 2026, that exploitation had been reported in the wild, and Patchstack said it had confirmed multiple active exploitation incidents. Neither has published technical details of the attacks so far.
Underground Forums Go Offline Over PHP2Shell
Concern about PHP2Shell has also reached the Dark Web. Some underground forums, such as BreachForums and Dread, have taken their sites offline as a precaution.
7. Is There a Public PHP2Shell Exploit or Proof-of-Concept (PoC)?
As of October 21, 2026, some online posts claim that both CVE-2026-109618 and CVE-2026-109619 have been recreated and tested in lab and real-world environments. Separately, watchTowr says it has reproduced CVE-2026-109618 and is withholding details until patches ship.
Threat Actors Look for PHP2Shell Exploits
Hacker forums also show interest in a working exploit. In one PHP2Shell thread, a user asked others to share an exploit, noting the one they found did not work on all versions, and another said they were eager to start compromising servers.
8. How Fast Could Attackers Exploit PHP2Shell After the Patch?
Attackers could move within minutes, because published fixes show where the bugs are.When CVE-2024-4577, a flaw in PHP’s Common Gateway Interface (CGI) mode on Windows, became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.
9. Is There a PHP2Shell Workaround Before the Patch?
PHP has published no workaround for PHP2Shell, so upgrading is the only vendor-backed fix. Where immediate patching is not feasible, CERT-EU advises organizations to consider isolating internet-facing applications from public networks until a fix can be applied.
10. How Can Security Teams Detect PHP2Shell Exploitation?
Detection has to focus on post-exploitation behavior, because PHP has not described how the flaws work. Alert when php-fpm, php-cgi, httpd, or apache2 launch shells, script interpreters, or download tools such as curl and wget.
If an alert fires, isolate the server, preserve web server and PHP logs, and hunt for web shells, new files in the web root, new cron jobs or scheduled tasks, and unexpected accounts.
11. How Can SOCRadar Help Track PHP2Shell Exposure?
With a critical PHP release landing and attacks expected soon after, organizations need to know both which PHP2Shell details are confirmed and where PHP is externally exposed.
SOCRadar can support that process through:
- Attack Surface Management: Helps identify internet-facing assets running PHP and prioritize exposed systems, including those on end-of-life branches, for patching or isolation.
- Cyber Threat Intelligence: Tracks CVE severity, exploitation developments, KEV status, affected and fixed versions, and changes in public vulnerability intelligence for CVE-2026-109618 and CVE-2026-109619.
Combining external asset visibility with vulnerability intelligence can help security teams find exposed PHP servers quickly while patching and compromise assessment proceed.
12. What Should Organizations Do Right Now?
Find every PHP installation now, then upgrade the moment PHP’s release lands. As of October 21, 2026, the priorities are:
- Inventory every install: Include PHP bundled in vendor appliances, Windows software, and hosting control panels such as cPanel and Plesk.
- Patch at release: Move supported branches to PHP’s fixed versions, internet-facing systems first, then restart the PHP FastCGI Process Manager (PHP-FPM) or web server so the new build loads.
- Check backports: Watch your Linux distribution and hosting provider for patched packages.
- Isolate what you cannot patch: Keep end-of-life and unpatched internet-facing systems off public networks, or behind a VPN or web application firewall, until a fix is applied.
- Verify and monitor: Confirm affected and fixed versions against PHP’s release notes, and keep watching PHP worker processes for unexpected child processes.
