Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Require Immediate Action

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Require Immediate Action

First seen 21 Oct 2026, 20:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 21:09 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with a CVSS score of 9.2.
  • •Immediate patching is required as configuration changes cannot fully mitigate the vulnerabilities.
  • •PHP environments, including PHP-FPM and Apache, are at risk, affecting approximately 70% of websites.

On October 21, 2026, PHP developers released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. These vulnerabilities, with a CVSS score of 9.2, allow unauthenticated remote code execution (RCE) and affect multiple PHP environments, including PHP-FPM, Apache, and LiteSpeed. The flaws stem from improper memory management and handling of out-of-memory conditions, which can lead to code execution by exploiting partially initialized request states. PHP administrators are urged to upgrade to the latest versions immediately, as configuration changes alone do not mitigate the risks. The vulnerabilities were disclosed following premature information leaks, prompting urgent advisories from CISA and other cybersecurity organizations. With PHP powering around 70% of websites, the potential impact is significant, and early exploitation attempts have already been reported.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Premature disclosure of vulnerabilities
Details of the vulnerabilities were leaked online before official patches were available, prompting urgent responses.
Linkedin
2026-10-21
Emergency patches released
PHP released updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities.
Cyberinsider
2026-10-21
CISA issues advisory
CISA advised all organizations running PHP-based websites to apply the patches immediately due to the critical nature of the vulnerabilities.
Scworld
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (14)

Following this threat?

Track LiteSpeed and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (26)

1 / 4

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions from 5.4.0 to 8.5.11, including PHP-FPM and Apache.
Is there evidence of exploitation in the wild?
Yes, early attack attempts have been reported, indicating active exploitation of the vulnerabilities.
What should organizations do immediately?
Organizations should upgrade to the patched PHP versions as soon as possible to mitigate the risks.