Skip to content
426 Mobile Apps at Risk from PHP2Shell Vulnerabilities

426 Mobile Apps at Risk from PHP2Shell Vulnerabilities

First seen 23 Oct 2026, 13:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 14:08 UTC
  • •426 mobile apps are linked to PHP2Shell vulnerabilities.
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with a CVSS score of 9.2.
  • •8.5% of assessed apps connected to potentially vulnerable PHP servers.

Research by NowSecure identified 426 Android and iOS apps connecting to servers running potentially vulnerable PHP versions, linked to PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, published on October 21, 2026, allow unauthenticated attackers to execute code on affected servers. The analysis covered 15,429 apps, revealing that 8.5% connected to at least one potentially vulnerable server. Many of the affected servers were running end-of-life PHP versions, which no longer receive security updates. Developers are urged to verify the security status of their backend servers, especially those operated by third-party providers. The situation emphasizes the need for comprehensive mobile app security testing that includes backend infrastructure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP2Shell vulnerabilities published
CVE-2026-109618 and CVE-2026-109619 were published, allowing unauthenticated code execution on affected servers.
Hackread
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
First public PoC released
Proof-of-concept code for CVE-2026-109619 was made publicly available, demonstrating the vulnerabilities.
NowSecure
2026-10-23
Research findings published
NowSecure reported that 426 apps connect to potentially vulnerable PHP servers, urging developers to check their backend security.
Hackread

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

Which mobile apps are affected?
426 Android and iOS apps were identified as connecting to potentially vulnerable PHP servers.
What are the CVEs associated with this issue?
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both rated critical with a CVSS score of 9.2.
What should developers do?
Developers need to verify the security status of their backend servers and ensure they are patched against the PHP2Shell vulnerabilities.