Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 & CVE-2026-109619 Exploited in the Wild

Critical PHP Vulnerabilities CVE-2026-109618 & CVE-2026-109619 Exploited in the Wild

First seen 22 Oct 2026, 05:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 07:09 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated RCE.
  • •Emergency updates were released on October 21, 2026, following a leak of details.
  • •Active exploitation attempts have been confirmed by security researchers.

On October 21, 2026, PHP released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. These vulnerabilities allow unauthenticated remote code execution (RCE) through PHP's handling of request data. Following the disclosure, numerous GitHub repositories named 'php2shell' emerged, with 99 out of the top 100 addressing these vulnerabilities. Security firm WatchTower reported actual exploitation attempts on its honeypot network, indicating that the vulnerabilities are actively being targeted. PHP has advised that updating to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only complete mitigation. The vulnerabilities affect all PHP versions from 5 onward, particularly in mod_php environments. As of now, the vulnerabilities have not been listed on the CISA KEV list.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2019-09-24
Public exploit for CVE-2019-11043 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-20
PHP vulnerabilities details leaked
A post on a public tech forum revealed critical PHP RCE flaws before the official disclosure.
Picussecurity
2026-10-21
Emergency PHP updates released
PHP released fixes for CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2.
Wordfence
2026-10-21
Exploitation attempts observed
Security firm WatchTower reported actual exploitation attempts on its honeypot network.
Asec.Ahnlab
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (11)

Following this threat?

Track LiteSpeed and CVE-2019-11043 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 3

Common questions

Which PHP versions are affected?
All PHP versions from 5 onward are potentially affected, particularly in mod_php environments.
What should I do if I run PHP?
Immediately update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart PHP workers.
Is there any confirmed exploitation?
Yes, security researchers have confirmed exploitation attempts on their networks following the vulnerabilities' disclosure.