Back Akamai

Critical Remote Code Execution Vulnerabilities in PHP Core

Akamai • October 21, 2026

Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.

Adaptive Security Engine : 3000991 v1 — PHP Remote Code Execution Attack Detected (CVE-2026-109618, CVE-2026-109619 )

Based on our investigation, Akamai App & API Protector is mitigating weaponized payloads with existing command injection rules.

The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules is critical to block attack attempts.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Affecting PHP Core On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities allow unauthenticated attackers to execute arbitrary code on servers running vulnerable PHP versions, affecting a wide range of applications including WordPress, Drupal, and Joomla. The flaws stem from improper memory handling during request processing, with CVE-2026-109618 related to out-of-memory (OOM) conditions and CVE-2026-109619 involving stale global state. Exploitation attempts were reported shortly after the vulnerabilities were disclosed, with proof-of-concept (PoC) code circulating publicly. PHP installations serving web requests, particularly those using Apache with mod_php, are at the highest risk. Organizations are urged to patch immediately to mitigate potential exploitation. 82 sources 73

Extracted Entities

Critical Remote Code Execution Vulnerabilities in PHP Core

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

MITRE ATT&CK (1)

Platforms (2)