Sploitus

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

First seen 21 Oct 2026, 10:47 UTC • •76.3

Article Content

1 / 95

Browse articles

ThreatCluster •October 21, 2026 at 17:09 UTC

•CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE in PHP.
•Emergency patches released for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
•Exploitation can occur before application code execution, especially in Apache mod_php.

On October 20, 2026, two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed, allowing unauthenticated remote code execution (RCE) on affected systems. The vulnerabilities, collectively known as 'PHP2Shell', stem from improper memory handling during HTTP request processing, affecting PHP versions 5.4 through 8.5.11. PHP released emergency patches on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations using PHP are advised to update immediately, as the flaws expose millions of websites to potential attacks. Exploitation can occur before any application code runs, particularly in Apache's mod_php configuration. The vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. Security agencies worldwide have issued advisories, urging immediate action to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-20

Vulnerabilities disclosed

CVE-2026-109618 and CVE-2026-109619 were publicly announced, revealing critical RCE risks.

2026-10-21

Emergency patches released

PHP released updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address the vulnerabilities.

2026-10-21

Security advisories issued

National cybersecurity agencies urged organizations to patch or take systems offline due to critical vulnerabilities.

2026-10-21

CVE-2026-109618 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-10-21

CVE-2026-109619 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (94)

Following this threat?

Track Cloudflare and CVE-2024-4577 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which PHP versions are affected?

PHP versions from 5.4 to 8.5.11 are affected by these vulnerabilities.

What should organizations do?

Organizations should immediately upgrade to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

Is there evidence of exploitation?

While proof-of-concept code has been released, active exploitation in the wild has not been confirmed yet.

Continue Reading

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These vulnerabilities, collectively dubbed 'PHP2Shell', allow unauthenticated attackers to execute arbitrary code on…

Surge in Cyber Incidents Targeting Japanese Web Systems As of October 6, 2026, Japan has reported 119 incidents of information leakage from corporate web systems, a significant increase since July 2026. This surge, accounting for 68% of the year's reported incidents, raises concerns among security experts due to its unusual nature compared to past cyberattacks. The…