Sploitus

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

First seen 21 Oct 2026, 10:47 UTC • •76.3

Article Content

1 / 48

Browse articles

ThreatCluster •October 21, 2026 at 16:10 UTC

•CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE in PHP.
•Emergency patches released for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
•Exploitation can occur before application code execution, especially in Apache mod_php.

On October 20, 2026, two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed, allowing unauthenticated remote code execution (RCE) on affected systems. The vulnerabilities, collectively known as 'PHP2Shell', stem from improper memory handling during HTTP request processing, affecting PHP versions 5.4 through 8.5.11. PHP released emergency patches on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations using PHP are advised to update immediately, as the flaws expose millions of websites to potential attacks. Exploitation can occur before any application code runs, particularly in Apache's mod_php configuration. The vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. Security agencies worldwide have issued advisories, urging immediate action to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-20

Vulnerabilities disclosed

CVE-2026-109618 and CVE-2026-109619 were publicly announced, revealing critical RCE risks.

2026-10-21

Emergency patches released

PHP released updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities.

2026-10-21

Security advisories issued

National cybersecurity agencies urged organizations to patch or take systems offline due to critical vulnerabilities.

2026-10-21

CVE-2026-109618 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-21

CVE-2026-109619 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (47)

Following this threat?

Track LiteSpeed and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which PHP versions are affected?

PHP versions from 5.4 to 8.5.11 are affected by these vulnerabilities.

What should organizations do?

Organizations should immediately upgrade to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

Is there evidence of exploitation?

While proof-of-concept code has been released, active exploitation in the wild has not been confirmed yet.

Continue Reading

Critical PHP Vulnerabilities Prompt Global Website Shutdowns Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP programming language have been disclosed, affecting versions from PHP 5.4 onward. Rated 9.2 on the CVSS scale, these flaws allow unauthenticated remote code execution, posing a significant risk to millions of websites. As a precaution…

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These vulnerabilities, collectively dubbed 'PHP2Shell', allow unauthenticated attackers to execute arbitrary code on…