Php2shell Leaked Critical Php Rce Cve 2026 109618 Cve 2026 109619

Back hadrian.io

Php2shell Leaked Critical Php Rce Cve 2026 109618 Cve 2026 109619

hadrian.io • October 21, 2026

Share: View original

WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)

WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)

Start your journey today

Hadrian’s end-to-end offensive security platform sets up in minutes, operates autonomously, and provides easy-to-action insights.

Monitor assets and config changes

Monitor assets and config changes

Understand asset context

Understand asset context

Identify risks, reduce false positives

Identify risks, reduce false positives

Prioritize high-impact risks

Prioritize high-impact risks

Streamline remediation

Streamline remediation

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)

Platforms (1)

Vulnerabilities (1)