Sploitus

Critical Exploitation of PHP2Shell Vulnerabilities CVE-2026-109618/109619

First seen 2 Nov 2026, 19:13 UTC • •80.0

Article Content

1 / 5

Browse articles

ThreatCluster •November 2, 2026 at 21:44 UTC

•CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with CVSS 9.2.
•Active exploitation confirmed; CISA added these CVEs to the KEV list on October 26, 2026.
•Custom detection tools for Wazuh are available to help mitigate the impact of these vulnerabilities.

Two critical vulnerabilities in PHP2Shell (CVE-2026-109618 and CVE-2026-109619) were disclosed on October 21, 2026, with a CVSS score of 9.2. Both vulnerabilities have been, with CISA adding them to the KEV list on October 26, 2026. The flaws affect web servers using PHP, including those running on Apache, Nginx, and Docker containers. Attackers can execute arbitrary code, leading to potential data breaches and system compromise. Custom detection rules and decoders for Wazuh have been released to help organizations mitigate these risks. Security teams are urged to implement the provided rules and monitor their systems closely for signs of exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-21

CVE-2026-109618 and CVE-2026-109619 published

Two critical vulnerabilities in PHP2Shell disclosed, both with a CVSS score of 9.2.

2026-10-24

Public exploit for CVE-2026-115560 released

A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.

2026-10-26

CISA adds CVEs to KEV list

CISA confirmed active exploitation of both vulnerabilities, adding them to the KEV catalog.

2026-11-02

Wazuh detection tools released

Custom decoders and rules for detecting PHP2Shell exploitation made available for Wazuh users.

More articles in this cluster (4)

Following this threat?

Track Debian and CVE-2026-10961 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What systems are affected?

Web servers running PHP, including those on Apache, Nginx, and Docker containers.

How urgent is the response?

Immediate action is required due to confirmed active exploitation of these vulnerabilities.

What should organizations do?

Implement the provided Wazuh detection rules and monitor for signs of exploitation.

Continue Reading

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like…

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both…