Skip to content
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches

First seen 20 Oct 2026, 20:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 10:57 UTC
  • •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE in PHP installations.
  • •Emergency patches were released on October 21, 2026; older PHP versions are unpatched.
  • •Exploitation attempts began before the official disclosure, raising immediate security concerns.

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2012-05-11
CVE-2012-1823 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2015-06-09
CVE-2015-4024 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2019-09-24
Public exploit for CVE-2019-11043 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-02-14
CVE-2026-1096 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-04-22
CVE-2026-31431 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
CVE-2026-102764 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-17
First exploitation attempts observed
AWS reported exploitation attempts targeting PHP2Shell vulnerabilities before public disclosure.
Securityweek
2026-10-20
Vulnerability details leaked online
Technical details of the vulnerabilities were leaked, prompting the PHP team to expedite the patch release.
Sploitus
2026-10-21
Emergency patches released
PHP released patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities.
Forrester

More articles in this cluster (867)

Following this threat?

Track Potassium, 4Chan and CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (247)

1 / 4

Common questions

Which PHP versions are affected?
All PHP installations serving web requests are affected, particularly versions below 8.2.
What should organizations do immediately?
Organizations should apply the emergency patches released for PHP 8.2 and above or isolate affected systems.
Is there evidence of exploitation in the wild?
Yes, exploitation attempts were reported as early as October 17, 2026, before the vulnerabilities were publicly disclosed.