Skip to content
Critical PHP RCE Vulnerabilities (PHP2Shell) Disclosed with CVSS 9.2

Critical PHP RCE Vulnerabilities (PHP2Shell) Disclosed with CVSS 9.2

First seen 22 Oct 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 17:14 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) rated CVSS 9.2.
  • •Vulnerabilities allow remote code execution (RCE) on affected PHP installations.
  • •Plesk installations are affected; ManageEngine products are not vulnerable.

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed, both rated with a CVSS score of 9.2. These vulnerabilities allow remote code execution (RCE) on affected PHP installations, posing a significant risk to websites and applications utilizing PHP. The vulnerabilities were published on October 21, 2026, with the first public proof-of-concept (PoC) for CVE-2026-109619 also released on the same day. PHP installations shipped with Plesk are confirmed to be affected, while ManageEngine products are not at risk as they do not bundle PHP. Users are advised to upgrade to the latest PHP versions to mitigate these risks. Fixes for most affected versions were made available shortly after the vulnerabilities were disclosed. Administrators are encouraged to check their PHP versions and apply the necessary updates promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical vulnerabilities in PHP were disclosed, allowing remote code execution on affected installations.
Pitstop.Manageengine
2026-10-21
First public PoC for CVE-2026-109619 released
A proof-of-concept for CVE-2026-109619 was made publicly available, increasing the risk of exploitation.
Support.Plesk
2026-10-22
Critical vulnerabilities reported
ManageEngine and Plesk reported on the critical vulnerabilities, urging users to update PHP installations.
Pitstop.Manageengine

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2

Common questions

Which PHP versions are affected?
All PHP versions shipped with Plesk are affected, while ManageEngine products are not vulnerable.
Is there a fix available?
Yes, fixes for most affected PHP versions were released on October 21, 2026.
What should I do if I'm using Plesk?
Update your PHP to the latest version as soon as possible to mitigate the vulnerabilities.