Back Securityweek PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches.
On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said .
It also warned that the fixes may be rolled out earlier, should technical details on the security defects be published or evidence of their in-the-wild exploitation emerges.
The flaws are reportedly tracked as CVE-2026-109618 and CVE-2026-109619 and could lead to remote code execution (RCE). Based on their CVSS score, both could be exploited without authentication, CERT-EU says .
Public reporting calls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to obtain shells on vulnerable servers.
The publicly available details on CVE-2026-109618 and CVE-2026-109619 do not include a root cause, affected component, or attack path, but one report suggests the former is a use-after-free bug.
Additionally, public reporting suggests all PHP versions from PHP 5 onwards are affected.
Preemptive exposure management firm WatchTowr believes it was able to successfully reproduce CVE-2026-109618, but refrained from sharing additional information until patches are released.
“While we are not able to technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real,” WatchTowr CEO Benjamin Harris said.
WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild. According to Sansec , however, mass exploitation will likely start within 15 minutes of the patch release.
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Related: Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Related: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
F5, Juniper Networks Patch Critical Vulnerabilities
Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
Microsoft Patches Two Dozen RCE Flaws in Office
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
