Skip to content
Critical PHP Vulnerabilities php2shell Disclosed and Patched

Critical PHP Vulnerabilities php2shell Disclosed and Patched

First seen 21 Oct 2026, 17:40 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:41 UTC
  • •Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) disclosed.
  • •Exploitation allows unauthenticated remote code execution on affected servers.
  • •Emergency patches released; administrators advised to update immediately.

On October 21, 2026, PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. These vulnerabilities allow unauthenticated remote code execution on servers running affected PHP versions. Exploitation can occur via crafted HTTP requests, potentially enabling attackers to execute malicious code with the permissions of the PHP process. Affected systems include various web applications powered by PHP, such as WordPress and Drupal. PHP has released patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators are advised to update immediately and may need to take services offline during the patching process. The vulnerabilities have prompted emergency updates and warnings from security organizations, highlighting the urgency of addressing the flaws. As of now, early attacks have been reported, and website administrators are urged to act quickly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
PHP disclosed two critical vulnerabilities allowing remote code execution, with patches released the same day.
Almalinux
2026-10-21
Emergency patches released
PHP released updates in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities.
Malwarebytes
2026-10-21
Passbolt Cloud taken offline
Passbolt Cloud was temporarily taken offline as a precaution while patches were deployed.
Passbolt

More articles in this cluster (3)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

Which PHP versions are affected?
All PHP installations serving web requests, specifically versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Is there evidence of exploitation?
Yes, early attacks targeting the vulnerabilities have been reported.
What should I do immediately?
Apply the latest PHP updates and consider taking affected services offline during the patching process.