Skip to content
PHP2Shell: Critical RCE Vulnerabilities Affecting PHP Core

PHP2Shell: Critical RCE Vulnerabilities Affecting PHP Core

First seen 22 Oct 2026, 05:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 14:13 UTC

On October 21, 2026, the PHP security team released emergency patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities allow unauthenticated attackers to execute arbitrary code on servers running vulnerable PHP versions, affecting a wide range of applications including WordPress, Drupal, and Joomla. The flaws stem from improper memory handling during request processing, with CVE-2026-109618 related to out-of-memory (OOM) conditions and CVE-2026-109619 involving stale global state. Exploitation attempts were reported shortly after the vulnerabilities were disclosed, with proof-of-concept (PoC) code circulating publicly. PHP installations serving web requests, particularly those using Apache with mod_php, are at the highest risk. Organizations are urged to patch immediately to mitigate potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2019-09-24
Public exploit for CVE-2019-11043 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-20
Vulnerability details leaked
Technical details of CVE-2026-109618 and CVE-2026-109619 leaked before the scheduled disclosure, prompting an emergency patch release.
Recordedfuture
2026-10-21
Patches released
PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, urging immediate application of the fixes.
PHP Security Advisory
2026-10-21
Active exploitation reported
Reports confirmed that exploitation attempts targeting PHP2Shell vulnerabilities were observed shortly after the patches were released.
Amazon Threat Intelligence
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (83)

Following this threat?

Track Debian and CVE-2019-11043 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (56)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions from 5.x to 8.5.x are affected, particularly those running Apache with mod_php.
Is there evidence of exploitation in the wild?
Yes, multiple reports confirm that exploitation attempts have been observed shortly after the vulnerabilities were disclosed.
What should organizations do immediately?
Organizations should apply the emergency patches released for PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as soon as possible.