Back Securityweek

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Securityweek •Ionut Arghire • October 21, 2026

Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches.

On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said .

It also warned that the fixes may be rolled out earlier, should technical details on the security defects be published or evidence of their in-the-wild exploitation emerges.

The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619 and could lead to remote code execution (RCE). Based on their CVSS score, both could be exploited without authentication, CERT-EU says .

Public reporting calls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to obtain shells on vulnerable servers.

The publicly available details on CVE-2026-109618 and CVE-2026-109619 do not include a root cause, affected component, or attack path, but one report suggests the former is a use-after-free bug.

Additionally, public reporting suggests all PHP versions from PHP 5 onwards are affected.

Preemptive exposure management firm WatchTowr believes it was able to successfully reproduce CVE-2026-109618, but refrained from sharing additional information until patches are released.

“While we are not able to technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real,” WatchTowr CEO Benjamin Harris said.

WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild. According to Sansec , however, mass exploitation will likely start within 15 minutes of the patch release.

Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Related: Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw

Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Prompt Emergency Patching On October 21, 2026, the PHP security team is set to release emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These vulnerabilities, identified as remote code execution (RCE) flaws, could allow attackers to execute arbitrary code on servers running PHP, affecting all versions from PHP 5 onward. The vulnerabilities were leaked on October 20, prompting the PHP team to expedite the release originally scheduled for October 22. Security firms, including watchTowr, confirmed the existence of the flaws and warned of potential mass exploitation following the patch release. Organizations are urged to prepare for immediate updates, with some cybersecurity experts predicting attacks could commence within minutes of the patch becoming available. As of now, no active exploitation has been reported in the wild. 46 sources 71

Extracted Entities

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

The full story

Extracted Entities

Attack Types (2)

CVEs (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (5)

Tools (2)