Back Aikido.Dev

What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Aikido.Dev • October 21, 2026

Critical vulnerabilities have been found in PHP itself. Treat all versions as affected. The PHP security team will release fixes for the two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC on October 21, 2026. Both have a CVSS v4.0 score of 9.2.

If you run PHP anywhere in your stack, please stay tuned for workarounds and patches.

We are working with the PHP Foundation to coordinate the release of this information.

The PHP security team published an advance notice on October 20 after information the vulnerabilities leaked ahead of the planned disclosure date. Independent researchers confirmed the flaws were real, and the PHP team moved the release up to October 21. The vulnerabilities are continuing to circulate.

How the vulnerabilities work

We’re holding back exploitation details while systems are still being patched. More information will be made publicly available tomorrow with the patches. See the php site for more information .

Get secure today, quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Prompt Emergency Patching On October 21, 2026, the PHP security team is set to release emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These vulnerabilities, identified as remote code execution (RCE) flaws, could allow attackers to execute arbitrary code on servers running PHP, affecting all versions from PHP 5 onward. The vulnerabilities were leaked on October 20, prompting the PHP team to expedite the release originally scheduled for October 22. Security firms, including watchTowr, confirmed the existence of the flaws and warned of potential mass exploitation following the patch release. Organizations are urged to prepare for immediate updates, with some cybersecurity experts predicting attacks could commence within minutes of the patch becoming available. As of now, no active exploitation has been reported in the wild. 46 sources 71

Extracted Entities

What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (1)

Tools (1)